e8b1cc7bd5681b4c2f2e11d9dffd5e6cb1d7dfbb1e17e4ee38a7eff69f282cc1

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cb01edcaf642fded71d12da94f697e3.html
Size

6KB
MD5

0cb01edcaf642fded71d12da94f697e3
SHA1

b0370cbc2cc2fb48677e33cb569ee8bbcccef8c3
SHA256

e8b1cc7bd5681b4c2f2e11d9dffd5e6cb1d7dfbb1e17e4ee38a7eff69f282cc1
SHA512

f1f73e1ff00b9b49505dce89ae9ad29acc24e5f075a18547acdefa793e1fd161b860a284f82622d760400d01c84e03560de4646b50919a9f0451bf94aefbfcba
SSDEEP

96:uzVs+ux7a6LLY1k9o84d12ef7CSTUsccEZ7ru7f:csz7a6AYS/+b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08fbb8db038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409835228"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7862B41-A4A3-11EE-B696-EAAD54D9E991} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000043f7ff9b570bb912c7b9a16f2e477e6412b65fb4c5041384a4527a929b637125000000000e80000000020000200000001e16fd849df6d9b0b6fec56456dc4ce71816bd0248e22edee5817bab14b5d69790000000546a643c4573f58ba1a670b554a98acf7c0a0d20d75caf73b1846487687730069410875c25d8d73c49c39b65921bc412115d47212559b0568a03df6d5b3b26bf6aa9338cf3ce509f701a5381cca42f210b5894bf65bba613dba646ec262709d16f0d2853e8ffcfc366fd546ecce151995f41905f57d29e8eef006e466890f3a748bd7cacac570cc075d479c8b9e3203f40000000b488730703d9dfc7d1b99aa85ba2382690a983c233a9b3949c3a81c3eb6c26aee81e32819fe28f63afe6613829985935590f3f772f5868abaf6c97c1f99b6573	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000027510e0640808f1865512a43c3255027716d2dc6b6465cb088659d349aa963f9000000000e8000000002000020000000fbf3416056f08e264d7f5a1d23c86605aa1bc44534bae74307e5b4600b45fda820000000ee96695febfa29057af6888304c03845faf605e7d0f64d14a1216a5be539207840000000b2ddef1d455e10a8516d2b5f20c260f107e2c9fafae39136ab366243f97bb7a4e6369d7ef95f2754aad0831aca4f0fc549258c0958c63d43f6f1618628116ef7	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2356	2036	iexplore.exe	28
PID 2036 wrote to memory of 2356	2036	iexplore.exe	28
PID 2036 wrote to memory of 2356	2036	iexplore.exe	28
PID 2036 wrote to memory of 2356	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0cb01edcaf642fded71d12da94f697e3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f75d7b27b781522a1446621144d8faa

SHA1
e2a3ac8659c02057c98da33a098a095e00b98a06

SHA256
d0d8121c7073941f5e75885b7193e97440daf51dc7501ff8711e2dd10da871a8

SHA512
9c258fa5c4e3a3cfea4a3f3566be9c09baa4ac9befdf54018a9000898cc9051e1d5a4df29a7f96589926a08130eacb75afffe4f938cbfcbb12a296b8e2b09cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7450e1c5b752b801fe1ef804321f8fee

SHA1
9caa2ea62fa71cabb89b7419d78346d35be64d7e

SHA256
2b7674dc7f4d65ebce3747f0611834c00c8bc949ef40b80ca14e38d0a4ed1850

SHA512
2fd5c597d48853b26cfc0f63996f019011632e64de7be3d2de40cf25abd9da8832e95b3021006455b7ef447c8a7dbd8aac9e924a7a8b4f4711f3d9261525263f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44b7728231e74564d0f4bf0503e49a6a

SHA1
c4d6cd01efb013b3d499fd0645f21ca68d136e26

SHA256
3b64078df84be45e9879e5230f7a03fbc28386515bab6cd4c607a91be561751a

SHA512
50faed464d63dac003de4ba8407685011629fb1b9f30038e7be85b2c56faeccff8a97b8460af2c7d5f383f497c8f170c09e62a7db7b75974f7a06e3ea840fcf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad4b3ded7c03e8c6e0d0d99db352211a

SHA1
3c76931635cd20ef5cd3a3cb3ff25837a885a3c9

SHA256
2a87036b7037c50b0e1fa57f5bc6ebf20b7dc93fa4e5f380bc8582408f1be688

SHA512
a5292722df8759d6502f9bd174f163915128a3a2a4fabafc4b6f7a0305fb52f970d90861beefdf055f9fb9b6e7a7e7c013c0475543858abe719f0f6942eb2e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdb7cacd59a01e0a302b6f69e55ae81d

SHA1
a5a6a10fad6ed29f702803e88c27e7193a7279ed

SHA256
a0e464e5efb9766013b1092cf47223428a34ed27b18cacb1df866315e193d359

SHA512
d04b694a16dba6dbac1772b5977f4151019af8fdb40feea2787a8be10a8f5aa458d317c7848d6075d957a845313ce6304369130924e665ce6a3532a46fe194f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d5c7260ca028cae24219aaaae9afca6

SHA1
a132321ca8aefb10fc5fb1915e32f978ad79dfe4

SHA256
4fcd880e8158e1cb2a8d98aa9685690a8961c4c53a3f47baa8aec39353b9f626

SHA512
6b3f4d0254877b947966d90b55c6fa5c9e03fa65b124aff3bad1fd8fdb6a12165b2147fa2055e1997d89a676b9fc75acb2f39158cf56d509285544e1cf50c0a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81f9caadd4410ba20ab4beda1d34ff5c

SHA1
d112537db81c37b351db9bf53642bdc9470eab86

SHA256
c8928825d82f3d8e7ed84bdc3a94a773d65e99ce5b2da9ac2c580a442213ecbf

SHA512
68cf587ba367a27898227baf752c2efe8662f59c3c78cf4cd255806e56496c3b90a30cd6e0a1ef280cfc79dad8684676b45dd07a9664ea875a99c04a9349e500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43f40cdff9ef7facd028b269a079a30

SHA1
088a31078e97509a095b62af60ae05dfe2104fb1

SHA256
8b1795cd71358decf90a749fd92bbb9ab096a6140ab7bebc16c9455c731d9319

SHA512
385cfa1c732e24f64e1e9b174aa101c326a54561854555fe9485400e36b6283df84ef9d85e609d2e54a5926c9bf30c8ba0ba0b6534c609e96ee8d1efe48a974b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91e02e68050d770fb48d791aded048e9

SHA1
8fcfd4003194bf5c738771c61993faa885e6878b

SHA256
9b7ad50986cf40dcfd314f0c7ae081e3bd20be17178f4d61b264818194d5d4ff

SHA512
bf5c821415e0957075c3cf317cff26f87e6223c668194196e6bcbb2214cb5bd3d9c981c05955e75a3ffb01b68046d2389956624f5d972cc2d269a35dde62a22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15475c7150eb6d4c9ff2015a6bc3995f

SHA1
de6f13020d5e441f204c61505f8d3d30ca668c98

SHA256
e6f70213ed2288e18502b9b6e94e3a9eb17b87f543480df3f7a63f5de8fcfea3

SHA512
8365c5b0542d9ddb6a60e7dcc2d634dc8c38f9a0169f2247d0cccb73d7b7ead141ee7c24728de24912ecb7e82ee4cd9a881c27584270c800ad68dbe51829bbae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
537c703ea3955eac933335ca2f7fa7f1

SHA1
93629b5419dee82bb4f24cc637fe942eb1c47779

SHA256
0f1d82bd8d320ef565ab5107015757ac217f92f8efc4c0a9c998e838c0df0300

SHA512
bdf8e858e3992fb42f2a593fadc797628f253026de85c82c631590e45c6ae1bd74f685860bdca6a045d7be65272436e2acb8e2724d03dc5ed2d5a87bc002546e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B0C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BDB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit