e80ce366c93099e89d8e8a21a1c02e7196bee40889e902ebc42faac4e04d1732

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a182f68d49f04b5b167200611c9eaf9.html
Size

9KB
MD5

0a182f68d49f04b5b167200611c9eaf9
SHA1

3340cfff110272401741b6eb372db3eaa4270e28
SHA256

e80ce366c93099e89d8e8a21a1c02e7196bee40889e902ebc42faac4e04d1732
SHA512

b5442566c98f50f6c07496e8bdd09003f1bc77c961e15f274ff637842250f9fd866737e69e1a928092674bfac0b02806587260d5165e5f6a3124ba9c0f4f6b8a
SSDEEP

96:uzVs+ux7wHyLLY1k9o84d12ef7CSTUKGT/kNQpglVHcEZ7ru7f:csz78yAYS/7kgPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409824599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000009ea1a17664e9bb17c54ffa7ccfcb53dec7788678c8451f6989b5f13071a95bb2000000000e8000000002000020000000720e3d23b2cd77b0d4bf52b872d4b5cd41d4656df992ea7fb543685d7b1c5f759000000044459c91279f6224a5d92d4e754d3a772b2274021e0aa2cb2eb7b3b47cee5a2a8df4cc5757f4dea83f73703448d0eddd02f749cecc4f13954a8ee1ff231295ac9ac94f9a59920abb50dd87f26937222aaca1222d696b19f99d636ed68729249c465742c585bc1c7881338f2b23b570f2d2b518daca98f630ce8ca46cc0d377bb58b0362f815221819e7b92aa75d6a0c44000000093bf6a32e76a95fb0579124f29ee25caa210b1ff688df10e3749bfef34bfda9a8c6a955b745675d2ea49e68d6434b67e9678988994b41a0a9590978cb8473845	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9519EB1-A48A-11EE-9075-EED0D7A1BF98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000082e254efd3b4d14102ae14783c58f6f25e98b1f96e2fffb12ba5f48cbe83c33e000000000e8000000002000020000000d589e3d999a2b962d2e8642f0b0f90eaaba1cb197b2cee1c84710ca287828f44200000009952c2ee63a40ca79a33ec4a1372f9d1e833080322a6ae27759ceacd4754606e400000005b580095a876afff9e7bb5add7210ab28a46b1c23b394fd2210022d4400ca30bce3d8824145deeeb2ce2ecc95e874e58c74eadeddffdf96d86c7c5cd0574e9ff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0df7bcf9738da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2644	2600	iexplore.exe	28
PID 2600 wrote to memory of 2644	2600	iexplore.exe	28
PID 2600 wrote to memory of 2644	2600	iexplore.exe	28
PID 2600 wrote to memory of 2644	2600	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a182f68d49f04b5b167200611c9eaf9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85bd894cdb6f73e4d0e44524d181d147

SHA1
e3bdcff5558aebd00884772426dbb340406b5f88

SHA256
cc0f5401138c243dce1d4a1a7cdaa82abe972834fe8ac77d9e5ea3d968d32bba

SHA512
82f5b18831fd193a7d3b7592d1cb904941140059f68c555a9406cecf361426123658c9fc005a1bf21f65efce168f1d5580912c6ba5a16bf44fbeae782c4fbe05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b02d360ae94d605c581148872546401f

SHA1
d5b6679f511f8ea6958ed7dacbee1ee6c0adb0e4

SHA256
952c1a5c412503b5541293956b8b78a9a0fd225e49652c41a734d113b4db3ba9

SHA512
d320a90407fef5628b8da55079ee8a928801fc9fc4b73e0e3a79b0ff41d9267278bdcab329045c2f089404c45e3ecc09ede863a6426c1e5df0d627d9a7f2b196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ff9ad001ec3c7588fac4706d1c0b96

SHA1
6846b39c1302d14ef8c06615eb23d42023df4ac5

SHA256
d6250d6e4c744e394cfbd645bdc4486493b19e7a2c3514dda8769a5d6be21b20

SHA512
3341cb23300f9851c3d9271ab5db76f1c002e1e8a12a10d99316ff3ffa770fab0a0d68ca128dd46ab58f5824bb81de2cc6f15da2680d4e02a860e4edc20deeb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
054edeba00e40f4e8a435cd5ae1035f1

SHA1
cd8add9ab5ef0c7599575eb2b8361afe04c3e27c

SHA256
1568460d9c9093d5e60789d90864e3408357ea7790a1ab7f11f5be462e995b8e

SHA512
684664f2bc6d61e7207060b34f40bcb44ef38428d878b2f1c733afad749e8aa0b0a82bc7821d96b161ecf51d5402893bfc747f35e99cec32cd6c0330c4ded64b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3cdd8f6343e00549d83824986e5025b

SHA1
5009fc914e4ec1cf9abbc73e0df056eb881259a2

SHA256
cf39b978f342593adfc811e6800b8a6bbb379503a87250bdc944d78c9c5b9bfe

SHA512
8a00631ba27c49e1a616d43e68dcfa7f12bb11dead537201441ae39cc0dcd07fd3308e5f2e7f95d21c5bd289fe861f6b4cfb8cc2e12a8acb02c232e7f190f9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f28bf09732a2f6f6a5850e6142626ad8

SHA1
af3c690c0ce235c21216c72ce1aff7ff86551188

SHA256
5392957c06b06ca62dcfbc4e35270c6711ae0a5a16dc878e92495f109ab2d1d5

SHA512
148d75a818324b95f98a94ecfb06b88a85b8b137a44ee31caacc6702c86e39ac6a64bdc750715b5a27b5a1e83fe5db8058eaab944bb568cb75b35f9a1b0f024f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1697dc50b083752b73dc130e5d931890

SHA1
f41e09d4c0427c858a216c5a0d7563f47fb859bf

SHA256
872108fa8aca6796e4afeb7f5684e087e8b32fd7bf0854d4e1606ba2cb12cd17

SHA512
9d4141ee37d72912b2667e04c543fa56dd07ba14dec4fc07def51ed1c9c941ab996ffdfad0b9416385b567d5891c9d674ab7e10874c1564e719fcfdf67122fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
885cff906afc7b314eaa25a8c2c602e6

SHA1
c9897cd7de4dd819e191e3c10a5c928ac4ff5624

SHA256
09c4d1ca79637b5336150c8ad924848210291dc9ff891e878b6dc7fd336b4852

SHA512
1c84678b1ef08ae6706005d5a4ddf6a17441603e265c702a92cc685ac3f1dd1c0c9223aa1b9b3db37cc8cd7abb65e573d4a889f52b6e61f04cd3536a7d3faff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25faf33a4ff72a1c9fb6d44a9ef8257

SHA1
57749b343119cf7c2197499640f4136f247ebcf0

SHA256
61a8b662f69a21a87fbf3d7a008067fcba060249202e2013699366221a06c35e

SHA512
7f7265313f98041ee7200a711e71b1b84ed50c13fedd04ef5aa59b3bf555078c3c285b7b3d2c800c55016daf2117da374de96302a51dbf600cff4c8c07deca14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7ba59094e30568ec7b0b650a737a094

SHA1
14e0f91b972188d31b274e6cd74a5088ecdf9dc8

SHA256
3e402b97c259ba7be797a5ae79951b4200c204dc5ee35c4cb5a32df16bcf0658

SHA512
fb37114d66f5036e69a0a9ad1826fc0f4e407db051d1433c958d2f117380c4dce575df30625579782fc72736701ebffef7b02f414fe78518b459f337793f7c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f63d358d524da6e5aec2c92b672129

SHA1
b5f6c26497929c6551b3e3fa542535b41e74eb25

SHA256
7340d89af5b99ff74882352abe5689fce6bc01755f96f957557141f557c29b2c

SHA512
67282b43b5b5f87513674386b82dcbc0194fa5f681cacc9eb6170e4aef4ed5679359a663816bbfb2790ff69f04cd29c6f4cbc30650c187d726f3596da02d63cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0579e60bcc7c01f4562babccf0bcf1b6

SHA1
10df8fe08809fa0292c8672ed690f7aa2368ae90

SHA256
6af529922ef3864c8cb4d81ecd308a65c2372c6df1f111fe1a2748406fe4ff45

SHA512
612ee3cfe6c587668648876530c36931c4374217dab72c82c6a28ccd7b4bd1747298e7812abfc2d11a6ecc3d9f7051a982b72be712db8738473640c5442266a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b1ac1b48f95db99f765414362021e0c

SHA1
d39221e4319db6e55bd944bcab8aa8b6dab9db59

SHA256
8b89ecec0609de24571979f2f88cb7d80a70dc554daa64379a04e12df4872f60

SHA512
668fbf1dc9db015a6a07dc2df9feb069ff0c1373954dc4e8f3fb19fdc9349f38f3417ef7374558b7825a326dcd1a4f8ff5b9a100ea6125709f55a10c7cb3aee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
037b0a03d014c2d9bf736400d908c041

SHA1
1fbf6b168d6e1975730904188bdd6872ad9f1cdc

SHA256
1ab4db599b32ee9d11b8005697eb0e4016d170bb4b6057523ae50cef97eaea45

SHA512
f294dfd7197b061547350b3a8d33caea2276ce632da66beeab7f29ad708b27d1afbe1e6d1185d414bc11bdf04f93acb6d0e7cdb693440f20a3b679933f2048f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
accfe170e9ad03abde5ebbaf42e6a5e3

SHA1
38e40f88045a6e1e1f310d62415d43659986b202

SHA256
ee4b95a653a2a20889e973e73391576b03a41581488f358157d21610478ab678

SHA512
a579cd98de1eba2d6224cae4ef1034975def733663c02dc72374a76eb378cf08e1f3349136c993f5428b28614e284de496a8b8f3637a9c42a33d6d86672be832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f07bc80e193edb9d52bb32a755c52c0

SHA1
5e1ffa40f4c8a4096c47ddfaa234be2481ca7077

SHA256
5f9bfac6bac045d35221bbde888a2a954f39149cdadd6c3884bc6a7a196f4aab

SHA512
7dc9fe451d6e51d7d3a49e085ea6cfa0912a4e0964e51e39a2e9cb853e1969c034dd1eaa0ebafe16b946981246d1bb9125f0d3ab275779a217f4b9d3e744beba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D75.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar881A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit