0adf7354499d064479a09ccbd423903fed96510adc21ad201f2371bc6fc64d4b

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c8a3dd03bc1ac8ec717bce684b64855.html
Size

180KB
MD5

0c8a3dd03bc1ac8ec717bce684b64855
SHA1

e60f343d30e3b4670b78ad816bd3597a6d85606b
SHA256

0adf7354499d064479a09ccbd423903fed96510adc21ad201f2371bc6fc64d4b
SHA512

ff88deef956a3a6d40209fd0701e8dc8de066191591510945d2f0ba62afea035e8d9c1dc6f6f1bf26868999c9a61f772d1e3d4ac250f51e49adda973297b50bd
SSDEEP

1536:nyIRmuw/Oi2OX56ticnGKl1O+gV3GdmaAE:nyIAZ/Sgl58

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000807f876194ea6cda94349d19ea342b57da1a2f39de62931f0bb338bfc61e11c4000000000e8000000002000020000000f4006d310d99c5f9e4546c2128aea2c6121b0816803dec7243fbc7424ed6298990000000b894e1824bbd4a071f5fadb935c0723383924d68d38a17448407cfe1116cdf3294431bf2cd18a42f26cb6c37876d1968212b1c826fad1f16bf7f73843bacd60a26482d01d77333ce8b7fdb9de9aac23f3e665ac0794b1c37f8a44ca59177f8180fd25d5e68d83acc3b70202e80514e3b43699232a2eb1a017621fcc921fe8fc13b92109e5cafdc83829988faadca2ebb400000008250afdb5aeeaf8f890973c8ecf08e135ea51ab76f4b10d715153282012c2143770cfaf58d4a0544dfd9020137c4b48dd34f4dc4fd3c1a5c069fbc0a06255a51	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409690617"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c5def904b7c21c8655216b88f92241c29ee2271ca80afd07b70821ac26b576ba000000000e80000000020000200000007e74ff5af8cf9ed75a1dc9502e35b77b0490f2c50d53adb44c29f1b74eed8a5520000000803f6b92fd27894d610f8e8e4ed4a0f84e56f77c4d6ea78cd08ab248ff281ea64000000060fce34af85155c0d4008e5f9ca4a96237630b95dc41301bb8c88b8296faae58866f607fb1e1c4f4184f94337e3481d50c59601aace823759fe6333ae0a642bc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f098afdb5f37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00051C21-A353-11EE-A3D4-6E556AB52A45} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2036	2240	iexplore.exe	15
PID 2240 wrote to memory of 2036	2240	iexplore.exe	15
PID 2240 wrote to memory of 2036	2240	iexplore.exe	15
PID 2240 wrote to memory of 2036	2240	iexplore.exe	15

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c8a3dd03bc1ac8ec717bce684b64855.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb0598bab1d404b7fc748d8392a1be8b

SHA1
ee7459218df5a81472beeccfae2ee3bea22135e6

SHA256
60b06db94aa2d29fb781dea427461b70a54afe2ca13a58124f2c102ca0a83d83

SHA512
be5a422ea0c2ef1de03c49ae5b7a8d120cad8dad0173e588580c8969dc0974120ed6fbd94b105b0ea1a4123b4ee04c5e35f4ca25ead3ced71475861c89b71dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f66c14c2cb5e42a6e1ff276e3fe53d

SHA1
061898dfd33b2e7b5b450c77e77f6b8d195d5c69

SHA256
2e834d251e4ad24385d20f79c1fea8750efaba8e1fa1e2326847d289c6d52089

SHA512
706613a074525a68478f6dee922f7ac14382744d1b9cfdba642c5e0225ec0068c9dda98709ff713448b716659a8887987c0ca3cbc95361d5cccae3423707480d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bfda9be93c74cde21339db60aaa58c0

SHA1
d3bf0610f7ebbabbd1de60ae75a7d24365c55bf8

SHA256
bb4ac4746860c3991e60eef7ad974b20f3804836bee38e3e46e2343f11649d30

SHA512
7dc454a0e92d1532b8724f1e73379d606d6a7e460636ea96fa5bbc8e7c50c1fa2c02305ff8e11bd3c8634af0002076e8233e7eda60f9de3f1d0a81695d89505c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb6c6ee85c6fb93a0d69f8dd1bb08647

SHA1
1fc86fe3c42ca209128d74e66fac6738d0709f84

SHA256
0622cab80a50707432b1776e2bd31f88b4d1c186c59cb6a4dad50fba1d1348a4

SHA512
f6afe7834a07f2a2151ce6a2d93237cc6e20112317faca2cd693f8e9e29308e7f1a84f6e33e9cfabbbf4fb69a2e5b470a2eff8fe6a21000fc5225ba4c91b8b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9fab3ed2a572dce5fd2a679e4c3141

SHA1
d28b822d755a7f7198a57c6bfb3451173080e740

SHA256
e79372630d7332d3805e0868f4aeaec93e790d5458d282c879b4a3dae8d0ce7c

SHA512
b6e0c8ac5756f15580207988d4d95b7c77293ea0502c06ebe9f741466eb7f2e4f7201969feb26a5934342ae3cd22d7fd6398763a6cf9dfc87f6ee9cab4ce9dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2198bbfa13252ad347de85f1d1cad0

SHA1
c12d2b33952b95430d0c91537879fc6275fc60dd

SHA256
b1e1f30dd540339c58a98111eb5a7b73b56cd7726d0b0fafe56a4ab93b710276

SHA512
e91a7e56fa33a63693c68b9e0fa2af8494a0d536c07e1254eb7aea30899959f9d6977c186e31b3a8d31eafb759d298d00ba47990e5bedf1432ed02886dae4a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b54522348ee145d13a0a770f915c7a4c

SHA1
5e4afafdc3ce703df619b515e9d6a95177aafdcb

SHA256
14dcb4f7110e7a618673a4528957a69737c19784725aef6a180c225153693848

SHA512
447fb937d7668d7f5e44d03dce995d3f132966f8570578c3265cc580cdd4e16dcb4c5315680c0d0566a620ad149ba4dfdb06ec675e16bddc29ae8ec1dc2b1312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c469085cc2b7940a2e3fe2dccc48bb7b

SHA1
2aabdcaaa78fd40bfdd06adb4d30798e7aca1ee7

SHA256
728e8311ed563cd64b5375f86b5b8fa241c451d1b2441c16272de746c6fa9042

SHA512
6dd428b46a82e766eb9f81f1c3e5703394241b644a04a3c966e02757e516bffe4a0796041133066930bde08b39649fdec233f8aee972d54e27c06f20325d233e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56a7aa4ca0ded1dd3343663465a613c4

SHA1
aeffcd30c7a0a4d4a6bfb6ce551cb7ee377996b8

SHA256
1f1866e5bd14ab60fa8cb771d20c44de5fe69192490193bc6fbf6c4ace4ad7fb

SHA512
6fb814ba87cfca5816c64c970bc9142555b6d828ef9e3650b3dd329c4d7856515510dc5c93b66da9f78080051641f8ad13580d33c84aeacd492ff3ac977e7116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a1970d891eac42d6f1f8f3df638bd37

SHA1
f08a13413d501b1b486817ae3be7a5198da6d41f

SHA256
524804bcd6694eaef18638db810acceecb2d1c9e46edcee1463cb56c321961a8

SHA512
39d5d4bb0f5b07924c49bc3986fb70571d1e942eeff6db01254022d7b615744746536b2a22c1ddf97ca9aee6db00d1318a5f3a0536329c45212fb33b8fab8bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d8d3bbe0836254ba5f15f2e994d2908

SHA1
c0e6b75782df2ca66faf75d5e3c292f82d4a99dc

SHA256
25c14d2aed89d29efb6324932047e48081b0651725136c8c156d52d3846351af

SHA512
6c78940627abf60528360e55326ad07a0436b6231645794084a31792a0bc260e53fe8513aad20e0328334bf1b1e24037ac3417bc266c199f1c286b08507fd415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89258341f866509f413193381110acf0

SHA1
db0d02b0d2a47ba8af479ff5b8c719c054f91021

SHA256
26223aa7c8b6c26f1e7f052f2e8900d8b1ceb312f1ad52c8c99267a8e3d7cdd8

SHA512
4ba0e1eab93a9d79b304fd3e7bc06396bd85423f9362d3ceb290167c83acc2441e2f2bb22bd99b7116710aa75bd42edeecf97c43d943d9565a55cf1ff40201d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
031a5d472bb1814fff1082ce69df6718

SHA1
cb28fc039d20e0c2c3cbedd2f2de499551417cbb

SHA256
e1a48734283992a286adacb59d74a406b510069ef1c891820e8fca7dd67b7933

SHA512
8cb53d57b768f3549394d6cb36fc6e3c31ab08d5ecb6ad496120a00d24e9ed386df430d2c911581c9f87105e40480e13554abd0c76fb6cb6c44da69960a2e19c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f512d48adac48db5816c7be9f1cf6082

SHA1
fed99b99a9beae5913d78d1cb2a904812ac00364

SHA256
1ad40767b4d7a2874fcc0181e89ad8c71f02de62d90a18392c53cacf5e90527b

SHA512
bc8a3bed00d1cfe2a0489d0199ab4ec1f568319c5448afc2cb3cbe73375bffd5c4b4c08a13cf602c23cae8f3c3d1d9c3215f1a2f3757ae8aa604b48f7b01cd94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3a15596c98988c79633b527a35d9446

SHA1
17c7ffa47a35d874d4ac9ba2ae0a55820bbd052e

SHA256
2c8fc96a26b43a8c46251e54b9086cbd6f04b9ce6dc0b1b460735a05b1a0c3eb

SHA512
d5e4c14f418c6f7407c8c7e03ffc11d907ff310eb564e0f915068c656dce85d3daed6735919c35d89bbf5753c278181a1c5fb6255ae493b52d89fcbfe97822d2

Download Submit