e88b0e6d7880d73b22812b87c6e567775405b6eedd4a109a52951c0a5a78153d

Analysis

max time kernel
141s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d16e02a990929604bece78abf9057e4.html
Size

43KB
MD5

0d16e02a990929604bece78abf9057e4
SHA1

0ac25868ea646de5c66c47383593b1a560f3735c
SHA256

e88b0e6d7880d73b22812b87c6e567775405b6eedd4a109a52951c0a5a78153d
SHA512

09789e8de3f42830b91924f64edc489aabbe7e6051fc721c81b1018e77ae4070cdc4f91fd252a2f1d368cd9f9b75bfccf8c1a9a1f569777ba455ab677e0a2b24
SSDEEP

768:3hMT+3Ermy18cKDuMoIANDyzX2NFXryC50q5:3hO9mm8BRoIANmzX2nbyzq5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409837625"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ee2320b638da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003c225c4f5d92f092e5e2aa885908e066a0192c270c5a19cbc74a9cfdec278d2c000000000e8000000002000020000000eb4fce840b4c1e4b931f04f86dde64ad1556e063ab2468568519e8f568ed07d32000000099a466a6b865746c7abbd5866e8558d61958d8637ecb55fe8589b42eb449bf5e40000000055f78b35c5c2a9347119124a6c41cd078d6155295a31bd106355170810abe0665245a163e6b4c21c678038ebc72e5aa5dd8cc5f433b686e70e7c4d17694291e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A9B3511-A4A9-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002e18a41f599efbe498b2db7b12dddf922dafb4ecef89d27939e79add9bc897c9000000000e8000000002000020000000acf145c9afbf2987cea1848b5d5bcbbf5fd70ef138c1e456120904f34485c967900000007addd6d3ee8c203f97efab89d38f74062f41746cad5aa70e1769e8619f1133f14841fa799f81f29711092c521ae23fe70476801944af7606bff2b522bf28a97ddf5960bca94b741040066253a1b87cb50a61407dc10ab521cae0c85f2b3e0d6600fdfc0cd2fd98d6f740cd24bd999b445a29fb1424a47d4defa9e460df472d09412b53fb9c7d7124bcca8c8d20bb5d3040000000a1ffaa61508472e8c7d9c039b2139876c7e8f57387871596492ed6e3d18d51076dff2c7f805794dfb82b329f575d39c790b2bd83327796d1cbb087e5f8d41c99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d16e02a990929604bece78abf9057e4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40781e694eb00aa5fefb75da8dc3f55

SHA1
83f3c3fec40e14aaeaec2ae111607c9ad1aea02b

SHA256
0553d3ccc0fd811a728eb21b9f0564909eed27535c02d2d553d2b60a2c042808

SHA512
b413009463fcceb67be02e9d58b654256db7545dd186fb67fcca66cf840eb0bfe4e7d31bc1eb649ef9198fe40af3f1e9eacf69a6cafbcbd1b7148f72f2e7699d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25744d5439c9c5150de2ef282d9117b2

SHA1
1d5944b209c39d9c8d30b176cc9d2707622810bd

SHA256
2a4e2cff166439a3dd25a8e41e851e321a131da4e9bea4a50f5570683da3144a

SHA512
67ee033ca1b6d37f5a7e8e514cb4b4b0919feacb4a7f143f2932568e027881d892cc8b7b645c942237c3aec5c6de31458ad2251e3d81b8f1ed59a955ae434aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c7db9a49d617298ed9e553a080c98f1

SHA1
a58f4df993be3ae867797847fea68ce40a7938c7

SHA256
ca2dd0998e81edb543b12104dba3b4ef6e2f96d933a4533e70d83b58b55aabfa

SHA512
deefe0b3d6f84a6fa3539c2cd36d071b3ff04ff8cf187c59f51f1f2fe8570f0ae2d8a915f8abcb9f05a77a3f7f0368e8a4e5ffb78ffa0a1782543c316965dbf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1721a9c8173cf347ff77ec4f31667002

SHA1
4ae8c28f306b65b1b4108e3fb6185a394e23d57e

SHA256
75d807c7840a8dfc86ff30ab6099296ba8825892be83707376fdafcef0973792

SHA512
2512a7a7ab91a6b45605baa343a60c183cdf39a630b368de98d187a0f35f295a64f5eda38a983819bc7ece09dc9c3f91750db29ae4b7be60da1695f2cd073654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9014b02692c0aaa42b8b75df0a9b80b

SHA1
c33b525aefe84f66e4130500a1aef324bec3e780

SHA256
266fc9621ef70b45b06d2c8030957ee2138dd36c638d044f892f0206f25180cb

SHA512
3f8c18ff33e2be40abfe44ada516fedd43faa1cb0c83e691ddb41eaaac41b3b3558e2e22ae1530013a8e43cf68f0b091e5c59518a4bd4e137ae6b951796249cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88c1ee4bb8c9b505c7e98b62ab52e365

SHA1
10aacc6a34b8d786e03e3aac217e9dc861380b58

SHA256
0388d89342c375cfd0cb9f0f9ec769fd8fe5ebb41bee789b53156d6cf4efa3ea

SHA512
46b83e61cceb1e0345c1ae753997b843deb3e6231490f501322e358ca887f85166051375e54afb02f4cb92f660977358c805c9289e85b604487e27d3f6b988d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4e9dd86ac2eb0172f748f98dee522e9

SHA1
9cda4b482b68827215eff4a022831605bce1b7ff

SHA256
e5fe66f7acc92b7e8877ffa0df4ec95842783c726ea120c180cb47cf4d090068

SHA512
f5a414393b1787a88fd7eaa5f6ffa2db67f76590fee1f990a817942bc9de87cd883dcf1a3254ef7c763babaf5773ff9a7d5c4f6c0622e8e725592a04f439b490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fcc71bc7aae3ce8b85b0b2579fd41ba

SHA1
25e6e8708b298d8e86b4726aaa9c7d66540e92cd

SHA256
83f691bf12203df88dc73da23f4e1e2ec32c3ed800ca4d4edb49b16cb9618f09

SHA512
bfe63d4271fdf36849b9558fed10260f1139652e0bc2d19bced585f394a1ba759af9baf2579a0d4b389622bd574feabd029cb7ef487b8717e73bcc08807ea6d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594c7987090e178f83c887ea9fadb12e

SHA1
67304194b4ba575cf6d0e67510ff5c08c988f1cc

SHA256
3158703c13eb814ae095d6deda2f3d30af430b52280951703464130dc2372d51

SHA512
786efcc426412601e18e074b1acf437f54ec0b201dae64f8527fbfbeb9d5fc1c1cd7cad8c0e587754ec2d3098522cdebe9bc3a8ed924413059cc0166f3344022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64765bb1bdc03a1865605e61f3dd3cd1

SHA1
e100ea6bab333f8986f9b45398154d6cfa64bd24

SHA256
9b18efd9b4f6074cbf5107cbf803b0049a31c0f689e3e88cff9d371ceb6f8cd5

SHA512
851c6690f2725d4de80339c215a27e998d448dc40ad255dc2e82fe839fb5250a220a39798159470734c3ac76eb9787fb7bce1367705f74b5145e35a462bb8ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C8A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CCB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit