d0ec31bba54d6b395145593e8b4f928986e491b5ea99bcd63c1b8d58a256ed62

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bfad6ab5f830d3a5a86e797e8e10166.html
Size

97KB
MD5

0bfad6ab5f830d3a5a86e797e8e10166
SHA1

fee52950051af4c0673e3625a4e45af35e33c770
SHA256

d0ec31bba54d6b395145593e8b4f928986e491b5ea99bcd63c1b8d58a256ed62
SHA512

8af7a0d739eb0fde978cde447c8b4c3b683c0788593e2e6e07d707413b10e7a1578a89acf5592edceae40651eb604da90658de9900aec936bd99eda85af408af
SSDEEP

1536:EetAb6GYFQrWI/oqWoIlqCXr/y324/MHOhx9t6d6hBmGTEwdUJ09i:D86aWoEXr/yG4Muhx9t6dx8Ewg09i

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405d78de5c37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFDD67A1-A34F-11EE-B665-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409689323"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006f4de0b97615d5993eeafb189dcca0365a4fde786122912e6f84dcc827d753bb000000000e800000000200002000000034ad0ddeadbf84861ca68250de473d6b9bb0ee04beb9602abf4f9908dd49ac11200000004d1e1f5c28b3cfb0e40e19784304129fbc36ad5d8742615ae5adef746944f92a400000009bf633f06f86b7b71e7798859033f5d7bc24094c0aea62ca2b9b087a3453e74cb89b11789b1c1b518e8f91b7fe6ce2fe577011369e28abe5df2b2957a9acf32c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f698ea78af7d68dff13dfb4ac164cdba70644b9c54c58baf240c73ad3df58ac0000000000e800000000200002000000031bb2d0c4c8cb2e91e400056dd83c4df71422aef6248d956f20065aaa4fb7033900000001f53d404c660828ee9de68149ca32eab9be04234e3e506e47870cb4e6b095c4022f5a3dd1ec42c4641d520a14c2048fc71f1f30c4a2debd95899c8d49a1ec6b709432fa78ef14d9377882bd31320711081786f6169390028a3d12163a19877e1475bcb0e0df17133346afc5129b9939d16626e7fee9c083b98db65226caa49a8e4feef116684117849a03f96c2be76c9400000004f704ad03c72676144a305f6177871cf03d42112e595070648bb17ba2ae561ff4c61e4578fcbaa9319d861dbca5a9b0da9dfc4b2411d7b8fd69433de7d8d556a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3044	iexplore.exe
3044	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2260	3044	iexplore.exe	16
PID 3044 wrote to memory of 2260	3044	iexplore.exe	16
PID 3044 wrote to memory of 2260	3044	iexplore.exe	16
PID 3044 wrote to memory of 2260	3044	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0bfad6ab5f830d3a5a86e797e8e10166.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb10ac622379b8981a5277efc732b207

SHA1
957c95e09461d8bf7f54d1199d8c7604e4dd998e

SHA256
e15d9bed1b3789cc7737d9a103ebbe3aa7235393258d89f2796c0d8ef4ffb55e

SHA512
5558902b2a7052fe1f6caed7c67f7f7373b0be4170b1632bc8ea0993424d71cc2214239695da4a5f54ac6b14a63d3d26ece79b41c6f3766e60af728b5a9f1e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a79c690fde7af759e404b188222bb066

SHA1
3852ad87aae0fc3746ccc95585a859d400aaba2a

SHA256
4687428174c7a92df940d76a0aab947002bc43b9376873bd4854b70734b07d9c

SHA512
70ed96f058c754dcd0116e740553ff8d71ded995484a0d5fbb11fc8d27abdc721e3d1eb8aa40f58e96c606d4b2cfc02b673d12fac7eb77e9363359a8fb4ac808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7223d5f67d417960c0247c587d521c92

SHA1
567204eeece0fa8db7b4b83c66276add6a4131c1

SHA256
f77c6671da400f2918f2c000697e1e5e830701db694311fdde8e388c7d7880fc

SHA512
dbd08bf33cdcb5f03545cdcbdb41f911fa78dcaee6748ac741d57022272f76822a9538fa03f2a466763bda120845c66f67d875679aa4e554da8a488689c681a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec445a577264ed214f25ee6771d1d0dd

SHA1
accd340676f36f04da88b3e3ac322b24d745065a

SHA256
22a5b3c94f8aef545795af34640496de986234fe0fb431c56b94058966245e8d

SHA512
7f39eadd045faa4081bf5536bd5b0e5b9e04bdb934789b2597b36888ab4ac8d78516d2e359aeb85ba08fa919ce2ad8d28d9d978e510a2bf80df08fd3ff524255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68fc6e0173f2b16da892fbedf6d09634

SHA1
a1bb62612441e374f9a36e24e4332d3b3287a13f

SHA256
becbb26ac7f66bb61f5c38d0ba4e890f99543ecd5b1980f178bea918a4098a3f

SHA512
f210a309f36a313e968922cd383b5b617fcd2f92acd4ced8f71707f9b141e2b21a24546372866e8583c60f073f7418b86941463c61bcb1a02370d906692afcae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bef07dce2325d6c3bcc788598e32437a

SHA1
9e2b0fad875197568d4456fcc694729bb93dca9a

SHA256
e32bb54f90ac975b7d69fba21eee65e97333e08033bd9056bd6edee52e62b3b7

SHA512
d8d6f2581152f33cf286bfc50e6044d5b8996139637b064363e368afc95226720f4de5deb5a873ababff901cf8ab1a26d29fa11733d86775901cd6e9e419b4ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c5154328a93235c984b9caa1c2f5ac3

SHA1
369f350ac9b43b22130b3bf7625a2ad6eb7ffdd0

SHA256
f04a0ee8d5cdd42ce7e826cae538848dac92ec9e647c19a3d249e5dafaf5e03a

SHA512
0489d0ec13b6780d6fb83c0a9219c398e01995d2de974ef9387c62abcb0070318a9397538c30e3ada2dafcb64ba2e9f3ac7cc9aced8a61e3b2535b54343a7ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d75768c4f7aca9d85f23f0d0bf9d9b6

SHA1
062d8323297c2337649d6db90a242b3bedfafd0b

SHA256
d0270fa8eac456343fe763cea0d68e179c117908451279522c39bc383c74de66

SHA512
12ea5165ad90475f49961916d77c9e69d913735d5e7726282d898880e194d24a594ad7f06d0de0450b000478bb7cca125fa9ac22f319f8a243edec112fa16fc3

Download Submit