767cd559371ca9adade207ae2b50ba1bda59b13a545534c7f7ca49b7f4dbeb6b

Analysis

max time kernel
153s
max time network
246s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0deccbf7731841df14030fefeb2147e0.html
Size

3KB
MD5

0deccbf7731841df14030fefeb2147e0
SHA1

f696ea31671a1f56b43192e7d2cc13cc6d1baa34
SHA256

767cd559371ca9adade207ae2b50ba1bda59b13a545534c7f7ca49b7f4dbeb6b
SHA512

b7da640604e2dc898e8f4a888e7a0981f6e8e213c43d77ecfd8319dde2b3a816a43643bedc6c870c483cdfa056baaf117a0fb0d4d2690a0b0807496c1482c378

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0341377be38da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409841165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000007d787a05f62f71f5dd92c96c9cd0116abd1abc14b48eae17281cacf7c14e779000000000e80000000020000200000009a6dbd9998e6f63233335d11afc4699059783fb9242b0618cd4e7f4d86d4516c90000000293514b63961da3dc7a71fd4df355c5668fd1d6e3fd4db1958ac28ee480270edd677a396e33dbc23fb996625b48c98960556decd8c686e7896360ed880e3c62e82716424c9cb575a98bf61412dbd6b643f0e0771a250bc968b4ce5c3842f098c374213772e59d4ae064c86890a25cb714bfa250bf985b996cafde81578fa80a9024860ba9d3ea8dc48ebf255a30749704000000080b12220076af078b532488fad616e80373fcfecfe7f9109ec930e2d9cbc3ab3fa08c234321d3291bacb74a35e9d362d3375751ae66f70c9ca3d608b01aa948e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80317E71-A4B1-11EE-8F35-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000099d949d84f8bb1d01c704ebc42c105eda28e066fe71441b5761739179a3865f1000000000e80000000020000200000007671732814eee00564a8726580c58a5a320bd0d471ba683d51c4bd083caf4aeb20000000b7b4e601e80379797477ee16bdd6e114f6396bd76f2ca833c502db59a5685d4b400000004fb7e8ed9511fe68f1b958a2d12ee6b76bab1b780d5c13a95f960c582000bf9349fd050b6d0197af3a6333680952f5e76d4eb854ad1be9813ebefb39b3a3bb8d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2560	iexplore.exe
2560	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2536	2560	iexplore.exe	30
PID 2560 wrote to memory of 2536	2560	iexplore.exe	30
PID 2560 wrote to memory of 2536	2560	iexplore.exe	30
PID 2560 wrote to memory of 2536	2560	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0deccbf7731841df14030fefeb2147e0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dfb0b406b89c017cb5ddcd6cedeb155

SHA1
30692ce57d8c6d57a119856e9d4896fc8907ef7d

SHA256
f6ace3cf90826326144a5d4093829a49a0260366b22add459c49f9ab140e1480

SHA512
070dd8df5234679b1decef220a91ed94f80511e2814c2f5635abe93e19b747af7a2de91178fbcf88641b01df246b24658e305c8feae8007a29e97769dd389cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a6e72ddd541648a39bf331ae8ebefb

SHA1
af7bd461465695ec373242c48878560d109ca99c

SHA256
858921d23f0a93c24376112a8d7ebc54e64b2e641e163066649382dbe6b394ee

SHA512
4a092b762b23192ec31d7416e3137bd12c8e8ab61503051b2797db8ed3d824f92a91ca657931cc034c42d978f1ff5cacbe47055f1c3cfed01db38142e2f16893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7786368dfcbc94f08f00dd3106b1f4db

SHA1
a26ccf9b3e4f5dcad303ced12fcc924ddb0ffd06

SHA256
273ae98ed3f34b043de764d3051f4c186abfe1379d326fd60466b1dcd632a5e3

SHA512
f002a0a8febb6e474de3b25c85c6bf7e5d746acf7194c6d3c3d16d5d961b8ea06ef0217e3116df8aed95d6b7809462af6499c4602e3e2d43b3601ddfb1d67e8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c527445ec781cd1349a8f7f3518f0859

SHA1
611df9f220798f5b02b855e2269a759bf04702c3

SHA256
e14acecf334335d06b37762235b77660a09be773af65a453e1a3a313cb3878a5

SHA512
888326065e7626aa519ba22a5511457c429b805d3ced202ec29d6257721bc4bccb253b46220e60ab49b432de0ebd706abaf931ba840f0c993515e3764f7bb7a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f0ac1d21759b9e9681ca6e854b85d0d

SHA1
f69bcd042076f0d1fd61e15e8037835d65c1f31a

SHA256
7f31942f85669721c77523746c229779071f4e3f0eee24c0fdd168e3484723d3

SHA512
0876b121e2584b6275580ff118c6f19f41c82226c5cc0f36f9a878317a7d712fa4e5e738d7eccdd0407984d836dd791b60d73f2017c2aeddc783aab59d057856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fcf6e4e69a77f5ad1035f4aa25268b1

SHA1
68df4c94511fcbcf8f7e91154554d6f48c974ddf

SHA256
92f96f81f9d2860573815c6b4681d49a2fdbd20f1d3b3acd4dfa5a49559e0b44

SHA512
7ff4abab2ff922ab4d214f726db5bebcc6f8e8cebf6ea985aa2e225f664563f2b49d2937d35a64981828be4c8f0da272c930092662bd80f511859d0af5448b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b8619cb12e6e60cfd798e3702396b8

SHA1
953df64f1bec553a4f923e51fa5b6eaa55412f8d

SHA256
c3d2f5fdb5a668485773bf43d988562a5aaedab2b2b16d2f89f90520d61863d1

SHA512
ab8e51ad2de315c748253f0c71d04c7f65de6a7b2612d58d7b9bb7484b500935ea11c527c18c4f7fa03ff07735cf75579c6c0b2428e8a7b308451aea49773e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d4426d109952992cda999ea5928221f

SHA1
f4761775a1136b82c9a8039fa01403f01c8d8bc8

SHA256
4cf30755a31c1c52b4122781fa5004fe92a3008892f30d052ec383df22e03f60

SHA512
7cee0464853208f0fe306d10795f2343aeaa4d2a81b7530fc43738a35f1828f3e22d31576b37a6bd279f35a93f6552c3fb6cd685aa7fcc44143643ab5dcb298f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51309a15649d652dbcf800e45c9777e2

SHA1
f71558bb1e2ac6bae44e639b28fb2f32698c6899

SHA256
a2fd4fe19c4d2b9fa73674a38b5433253a32e191ef39c36500d248cef0b1ceb7

SHA512
e321511f7ff0413f9167315d4fe278bf06a73ec1a18f270e41994899ca04e1a00bbece0067ce78617fb82ab59a0d8dd4af80e59b0d8036d8e311908be4436a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d716b7d49dd1670200d923b986c462e

SHA1
e0e0c0c101ba8595f60f35239f13666a21a812e7

SHA256
271e7eadc53b6b330a5b52b197f7e83bddb1b70ad10d2d2031cb175b58a03303

SHA512
97c5c092eab794c88c927c98f4a579827706068cf96c3c7d9e13e4174837d9376299942c8d8fd2a112830cf7161080e568445c2d1213f97b9b3a08ca4ca26cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb823dd94cb4af7ae7b30673bf84d0a

SHA1
27bde7a6e389db384393d18498b8f389657bf592

SHA256
5a97b233f4c40caee02762b630c244e2749e398f52bb228626d4f720336e0bea

SHA512
1c4924c4916944d055062eaaec7c44ffd0c1d62b2cee49bd5f780b0cd36a267217b78bd06e678cacc21e4882e7d31fa9159892ede64bebd83205e0102f46bd62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae9811f50f0f3ff511658385b270dd8

SHA1
82cb2324363a273a4ae02b9dd8553c701db423b2

SHA256
d90b399b7da674ed90fdcd77a7dcd619f7e800c76889ebd6d532e52d4a9775f9

SHA512
e4cd6fa2f91ddeac239578636b7712d8a63e3730b19d937dd25ec1ce8803080670e217b01af8aafaa6f89a079b8f834261e0a6ea967034fa571fcb3650825421

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA871.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1A9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit