e3f2f1a2c120dfa70a96b5751d6b6843355720994f12bb4d6bf4224ef5b448f9

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0873826f2011d7c5097c2acf40e06431.html
Size

158KB
MD5

0873826f2011d7c5097c2acf40e06431
SHA1

52480e5d449982fbb3c68ef888c42ce093eecf1e
SHA256

e3f2f1a2c120dfa70a96b5751d6b6843355720994f12bb4d6bf4224ef5b448f9
SHA512

696c7b2950f312b0cf9d35f183bb0b8bd55074b7987b5bf5ade1eddf3ab902344672a8c0b7e7adc5787b13d5af86321eeb0266d2cc15b5dce4ed482d7706b8d0
SSDEEP

1536:Si3C/2oKDKr+L4PN6tGjtrH1slZArfqUP3KDKr+L4PNZOc/hKDKr+L4PNzGH9fTZ:SimCGc9dD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409682742"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cf1d4eae85517a12d2bd78ee2aa70154268d9213e9106915976b83a5c19105ff000000000e8000000002000020000000e0ffeb611045bd54f288b3ab069b4c385d9450c1f0928a2695b0c6b8fca20df2900000009eb33db7e9912e4303770566197c6c8ac03926f717818748700c13716e5eb0e7847c9e9beba9bfa57e971c40811130df968c8aeeb34cc9997825924691feb15ea04b2c3a42c28862e43fcca1f51a83a2f74898feb25768ed5d17885200a162e626282a9773e95f107021a1b99bdc12957fff8952ca5953f693728e5512d5f6317436b03ae9a465b64ef86f1cbcc904a940000000fc9289ed5c5ace1a95ffff667be04d760cf9086552941dc67aa0d60310382c83d3475cf6a90b5e0bc7cd3f0cf64f0552a512824319d6fde10249e4fe44caecc2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ae63f8f3505d1ec47af63d2d6d1fb87ec15dd9aa19f7d03ede0f29b3a9c51846000000000e8000000002000020000000a892a175b694a60d4ff6a45f843bf059f4ac7e21f804c3f033b7b21190315502200000008c4b0a29acd55e9cf2fe5d2508282f3808b669a91488c1c26f62d795c6d7440a400000009e371c5841b8f601ec3d096edec9771e3eb800f49964570353e1729ff6bfbae20ed393b8749cb719c995b4f5451d6975df385168730323e9604062aa9211ce71	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADF0A601-A340-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706273b84d37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2840	2120	iexplore.exe	28
PID 2120 wrote to memory of 2840	2120	iexplore.exe	28
PID 2120 wrote to memory of 2840	2120	iexplore.exe	28
PID 2120 wrote to memory of 2840	2120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0873826f2011d7c5097c2acf40e06431.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ee0d907236a504b691c8f241b377dc6

SHA1
8bf6120a92f959c59f2f21976335bf50af0e3c31

SHA256
6318834ac1ffca04d3099d3f96216988ccf8bd01b2315c59dfd2faf778f5ceed

SHA512
3ec06ced678f930f1190a0a355dc243a31c692a3c66524508147419567ebb89f9bb1aa395739d03985f417500653e3fca502bffdc87574cc8f3837296dec9aa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b562c375f87836b3f7ad98cefcf6555a

SHA1
810e5471f2804db0f369993a6c8f04fcda0eb7e2

SHA256
fe220bce28a0d428e83445f5ba8fc88285717848c231122dd8e5bacd771ad57f

SHA512
3bdae0237f4c10c90d8c9fa6d20daa5a0470e3fb47c9076bff96020e21683b33df723473f05eef0979a24add2e8abecd26c0367d81bb70eafd1a705602d958e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19f29e17191408b8aa5284369bae10dd

SHA1
fb734e7af86838c2968d0ffd452b82559f35541a

SHA256
2a4b25e9a0e161a5cb392aeae570d17b8d2e16fafafaae24ce04b6c1d5f860ea

SHA512
0aff0e70d004492537c472038e9f1d57f2aa836ac55e1be4200b3ef8611cd3b706c5c17d4e4212a53ea0885e2e35d0d9bcca1c172fbc28e28c26800f0cfbdbf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faabdeb3cc7331704e4113cdcaa734a7

SHA1
e82535b9d0a01d24f4f2243247e9ab2eae259f84

SHA256
65327961d9bd50de5315279d8df9abfee145237fd68c41aa98b2c89e4d7431f4

SHA512
4bd47aa7cfbbda71087fc6dbe665b25e66ee1a15251148662c5bd7af175943fc0601e47fd2f63f8d77621bdd07b679907d48a2f9a68561be24dce539f84e7466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e5ba7bc9ba0975d3533e9ec083d531

SHA1
4a493e969f9a92aa7f1abc54923316c0b2d00fc6

SHA256
aae1e0a5dacf46b21e369b716385a0274cb140a9137afa4b9b3d04a659c496bb

SHA512
d0035f2dc6cf4265bdae7d295a8af951be08cf8b38750fc632214fd97fec5583820895df2daf1768d7f0252d9c7955578019e98daf0da2329e5a77d433e9dcb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e74c19c4d114bd628de7c4de96955a55

SHA1
21db32ef4aaa2dc734e56c9706bc8dce913e2fa2

SHA256
63925b0b6f1427f72bf9a8f11851c4fb8ecd92c666c231d55544be140b93e84f

SHA512
d0991d14a50699885d0d45888323ae1005a8de555484710222f5363d8e417446a5fb3e4d782cca80e49388d18020e6cecd866e820c876f9572bb7f7d0625d877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6434d82d538bf7e4af6c5e4ae3a0ad3a

SHA1
2a862866e2f421bf4e3b31658df15d26f4a9893b

SHA256
14a3c7b0c191bb1db65a254acadcfbd2512846f80f907a2e1e327b35686391bb

SHA512
d0f219dd6c5c5aad9921400292d66c35dacb87317e70900a222dcaf4ef3fc7ae839dbd24add56490bb7b66c25f8b2aa6fc7e1e5b3f23ceffa3d4efecc5b1e44a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14de6d9b461c57eb757db67b0b7bf434

SHA1
c508a65856de955ced4e402cb626388af21f5d13

SHA256
2ee62094eaff9f85e6278cf9eb63296a129a1f3c99b9d5c1fde76d7137d78b23

SHA512
24e406c8b662a14798c522c5e18f4f073cbd4eb8d349e30815187ed7f6d903902e58a10914eb5605f4b341a1084337bec7b00d71cedbe36b6d2918901733c537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f018b7295549b5c9699c8de98e7ee5e9

SHA1
cac1031bcb20daaa22821362e115c8362fde7211

SHA256
20469e93b66ced37f3aef0e7df4c13d5e11609eec3e8fd4e8160040ebb9e68c8

SHA512
ab87ba5a721516ded42c6b7c372c3a4daab83a3bcef2ec7719bf67ee48f70ad9abf3bd009594160fad795a5c4836cb530e252b2bb854466bfc8db614df48d4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA525.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5F3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit