e196cb74f8dd35d583f0d2055cf19c338ed3c1139ea00d05db63de55e85d18fd

Analysis

max time kernel
166s
max time network
183s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba8dffd9d455b89b0576e8805469f99.html
Size

47KB
MD5

0ba8dffd9d455b89b0576e8805469f99
SHA1

1f9808f70b6bb8b52154c3c7c34bca39ae2a03cf
SHA256

e196cb74f8dd35d583f0d2055cf19c338ed3c1139ea00d05db63de55e85d18fd
SHA512

f8d8c28c49e0b1bfb625fb6e633344b5f5113fa94786d3fa8782b25b1324f408c5c0614cd5d5da8214aabfea4636742763304470165b7a24155857ffc76e744d
SSDEEP

768:ScdlnQum6S3YMTXywDwgo8DkzVpGs6XIuM0xPhFbsuxdrNXvDWb1CY1Mg49yRQHX:SoK4S3nTXywDwgo8DkzVpGs6XIuM0Vh7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409831731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{873677E1-A49B-11EE-BF15-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1172	2804	iexplore.exe	30
PID 2804 wrote to memory of 1172	2804	iexplore.exe	30
PID 2804 wrote to memory of 1172	2804	iexplore.exe	30
PID 2804 wrote to memory of 1172	2804	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ba8dffd9d455b89b0576e8805469f99.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3bf7a6c03c4987def2d2699b332f2fe

SHA1
ddfa915e44905981390c7671d99c76bc005b27f2

SHA256
5cfb71d3357ae20886cabc2bebb03e5166cf6b7b652cc12ba43128ad4f43076f

SHA512
6c8f32ad88caf2157acc948a4167beb05adae5cb15a3a1b66f8fc3e244d28a02689de91b5d176406ac64525e3f2fad49e42f220e97b6ec6f59e60561ad836cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808d273f7d1641be68f2149e4890469e

SHA1
42f1e572481340f12183fcc01bd960ed93fdf9fe

SHA256
56b27e3997de5a058a4118c5869a501aec243f99a9ccfd88ebb39494d66ac68b

SHA512
ee953344efd3ecf11e67c1774d7e8f1661c2456e1dd323ad8da164f19311c4c7bee770c2c759534e3a319ae4db6db588b00f11274bacf3c3801665dec8e47bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0684e8675ebd03643f208f3372d0e4a6

SHA1
4f0ab4e733f84682d445ab2a413348b717e59336

SHA256
8908d9261bd649bdaeff035a034ddb278424795f1930ed25256670c238c8c7a1

SHA512
a977a099e55c0dd550667b3835dba6f5f697220d71d6db51594949c4c8805ed1b2048ec1f093f604927a5373551a9088529a8cc4e1ba8b03caac16b7d6abf57a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40db517fc8b630e8d421274d0839992c

SHA1
2ec16ad439dd232155eb8f8d1f60839470d40bed

SHA256
0569e8783b225dd0351a8e2ee349dcaf13a90c01c8e98f41cac204bc54a44d4f

SHA512
7a8433107d0098d332f905e77bd807692c9ca2e4387af61435e01c6fda3a98217fc959f40a26559c822acb4185b45edb0c920b1853c816c483faecf9523debbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebd386a042e906fa0621e717b6568c65

SHA1
0dacfaaf94f7acaa9fb91286c7abd15e95d29776

SHA256
8d049af8e732265d0e73749c38f47d7ebce0770fbf75d5555a45ad6f29d93fcc

SHA512
cb29b8ff8c1187fb24866a4c72d8807293903861b16c6294603c00afd7786b387067212acf6fa4e4d075bf3dd05ab2173f3a2d5c158bc2fd855415592facb1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba950709be3536aeaabab180fbe7066

SHA1
bf2e8899d520f63bd84c0d2acba8ab51784fff73

SHA256
4d2ef5f4a2f2d2951e5be78af196182e5cef7d1882ba052be08e9c83e11b29f4

SHA512
6fa833a66e5b9b0dcaae6914926b0e44c982d4bd133e51adf675c28cd972fbe2b3f3ac2c0d1f67bfbdcaf2344ca27e4d24772c4f6557f62d0bf687ae27ccd7aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f0cfde2e7c4da4cdbad0b197cc34fb5

SHA1
b4dacda334e2266d815d836ca21da8661e8af9e3

SHA256
01cf4c6397020b706be5859887689d33a6c7157296fc6794294a7de5138b1d5c

SHA512
5194af86fc7d625d6676f72dffdcf521a0771ff2928d287d07f659e4bc27c1140fb091565e3be9d584cc03cc546a8e003d4dd7a4a0b1402369701927e4e9bb58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637436563c62fa90e081d2b4db017f78

SHA1
044084992f5db569740c196134783805af72df97

SHA256
8fb0614a3f57596f90222dd2d66322818b47734be2f70dd532c2030a8fbab8b9

SHA512
02e12a3338ffbd3029b6661c743a2a2ae3440c4ff561be257235f823bfdc48c35c4e089fda33a096c90637d01f1ee6e9bcc3d08f5df14ade96660aef072b9f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7875836e02fda13849ac60b9705986d

SHA1
77891e0fda31449159ea4573726101f1805dd1d0

SHA256
c79a690a922f962d4f5a5352c4c392d15ad2e05aadc20536327596b1b8f4ea2f

SHA512
46090e8f02560284f320c556154c4990e184688e1a86357778e092a6dae908c5c11225b1ad90d078eac6e564548b74bf70263350a07dab74662136a9eeb3a51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d070e20be9575279404f9a402126aab2

SHA1
1750912fc869f82ed2d3f65534b9beb28cc9c2fc

SHA256
38b1be6cde882e8f19694ce51cbff3a1ad35336c261ad5a0eec0002f78dfed86

SHA512
6e0ee452b24b3f900d89080e0cd03107cbfc013aa30acc039d03953638dfd50f14c2ca31a0933d9aef82092490fda5bae88ce4dce50dba03fd286344c8ef336f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27b5e25d7da865ac09cd89d875108156

SHA1
c6131c0d24b4cbceefe265e4ce88d2fee9ef92e2

SHA256
f50ecb24da2f9170002f53c8e04e14df2fd52eac560c9750071f0d5d7649dcd7

SHA512
6b6faed36c55232c27bfa3f496a5ee367bf69a6a4d334b5c64efb5b72f39967e5369228f121b29d3b04f2abc645245fb003818affcc11ddb977a1772febd4fc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit