e36ec76305a604d337c479bb1ec35ed20f7960d4127fb026b5e0470e276ccdec

Analysis

max time kernel
205s
max time network
221s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0db17846814491d5895617d3811cc1ee.html
Size

53KB
MD5

0db17846814491d5895617d3811cc1ee
SHA1

851a44c99f9c565b2a4e063e76c05986274ce25d
SHA256

e36ec76305a604d337c479bb1ec35ed20f7960d4127fb026b5e0470e276ccdec
SHA512

53244e0ba8c4b3327f9198754111d15ef48210e04d319b697fb300ee3edc10d3ab94c366dd30f89696d7c15291763c1db801ef9ad4d8436e71c73b7f5ae3e6ac
SSDEEP

1536:CkgUiIakTqGivi+PyUkrunlYs63Nj+q5VyvR0w2AzTICbb2ol/t9M/dNwIUTDmDg:CkgUiIakTqGivi+PyUkrunlYs63Nj+qa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF66B540-A4AF-11EE-8F35-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ae90b0bc38da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000acfd7a51f13efced38e2e35c03fbc73bb2d3d58183174509f20c528e15b2f069000000000e8000000002000020000000aaa3e7c4fb27aca8468f74864aa51392d3426669171adb4b6017f28ca14f5a339000000013b38440887e7382fc921eb5eb459330629d53b78cb2308e4e4e81d3f06f3832f36d017ce1bbafda66cf7df49541db0b5b359f033453617c456c5a1f9cd6ea8c0c6d72a510f95b9cd280a33ed6e1609177354361a052f89d1e616a3d56a7be93a710d81f6cf3e1112f77931ffa56872725ac73fce3b8df98096e2a72f1a53a5cc0f83d0e39672c1b17239b6e47a6727040000000142f9830e59f0e487777135332e7126faab6f5891ad86688d034f6269afdbd0180ca8e710a48bbbea0e4cceaed9aea0ba765b47451d331337d3b9fb817bc86f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409840374"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006f371902f67d08a3080f97bf073fbcc9ea1f76255b84bed4eb6db5e6700acdfa000000000e8000000002000020000000c6052c7ba28dfdbe13f81a150ec22535c784dd7b520749c8c479488962175f8320000000ec4adca341b372838c5c965aa95f32a8ab90e3712763a25cec57eee5aa47a08740000000fa2be4431fa5b7bdfc8b4a9565c41e81c7af4bf8f91f3b989b44ddde163cf5fc4e596dc51fdb11db83c48053e85146c595768d2163d48f1dd7afc9163e25e430	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2196	3016	iexplore.exe	30
PID 3016 wrote to memory of 2196	3016	iexplore.exe	30
PID 3016 wrote to memory of 2196	3016	iexplore.exe	30
PID 3016 wrote to memory of 2196	3016	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0db17846814491d5895617d3811cc1ee.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7a44418e0778bcf255637f30be33172

SHA1
523f0b0d206186df570129f321c77441f5de1911

SHA256
e141ac13963570ec2fe48e5d73d8a8896a30868d1221806eea8be1d1406ef328

SHA512
76bf9b652cd07dfb9e8af325804943e46edf6ef68ac427dc4ade40ac52cb3d833f0efea30068bbfbc14b789acf2261170228dc3b34114f98dd8d607c89c7a89f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
becfff8a6b453fbde23e20f42847f8ed

SHA1
3c6ea0f8053a17064fa5b7cfe44460b544e4abaa

SHA256
889b1d6663e510e10192ba5c5d87b374e07138b3b2f0f0b2b89d99342a340701

SHA512
d8189d3f65eef26e3fea6fce7c98672dc47259f2ed064b2b1229fc4772a1df6187024a38d5d945399aa0c7185fc8448e41c58f9be0e524e019d1095f5da5c253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05a347f466248d375bb8ac17622fd76e

SHA1
3b3dffa517cb058b7ce5b788818d09604dc1dd00

SHA256
a73dac1aebc7b78c5e6eb9fe904d5bccd664dab695fd2c7e50342209bdca83e3

SHA512
49e33af82ee53ec3764373e77756b2413b5d73f0555343c7a02b613933ea562ca1ccad7358fa2b86b0718f63a49ac71ebd859cb5bb19fee575960304392c0530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
543eb37bfbf4963a7b6515e6c5f617cb

SHA1
f6aecdafa8ba7d4f7721f8fa84a8ba52fe686738

SHA256
f715a9bf9738e3ed91405b1c60f010e6e3d9eca0bc5ac3d856602464e4b51b62

SHA512
cd05463e47e1433a9f7db2c0a024d2acef3d0785676dd114be40b61c2be27a7fc59e62380f607ee173d08114656355930f98da6c8558394aacce59e19452a92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790c7946a586a551d559e0320818c899

SHA1
48cd715fc5948d90a54ef1dea3c0fd56a8b6f895

SHA256
f515f5f14e2c6ce9ff3fe4116c4532b52114f3a06a8d4459da45d6473db4175f

SHA512
3a022e9cf1bcaf26155f07d5e11c260fa1a6ff276610bc9d2e3a09af32fbb2f06af0fdd68fb10ac1c179785d599114f3d390484d53287f38986999cbb4ce0e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b222786d865842d0cb00b708d15b08

SHA1
48d4cc84fc2710ceba2c5cdc34834aeba2cbbfe5

SHA256
53a37932440a681e11ef9a49ab913aba0485171df0fc7813ae547f52a5643a8a

SHA512
770dc79294a50d59ead02a8a883d97b810164f984d053ef19c109842d7b26b52940642f17954f7cb14b20a9e2c36a4de9289d74674b3dfc4936a1af10a5d2e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14c73d9f17f179375f9d7b3429bd5792

SHA1
4fddcfc330464fa31a19f17c35e90f36494805d3

SHA256
e34ff68c407d09f96d99f73d5d27623947070f3837e42be14ae88fe1dced06fd

SHA512
44e1c4d4921e19593469b93b237d9ffd7e9d8603b508295aa01ecb317d77b9082be38f08412cb519cebe3ea6f7350136ee6962f6170e8c730b24375b9af396eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e06a6854bdce047b0c340f1a08d8507e

SHA1
a2d0b58b3c9a945c920e5fa1f83ce71bf3b79878

SHA256
4b3545f3f82ca8506c0ee9fd2dd84e20af27e4e2165e01fcc1ca5d3bd32d2480

SHA512
bdcf2ff8ced4767b9d1424e407d43d9b0e48b5c04338cf81fd6747e0e4616de89e48d83be59372f53c661a4d92d617993d830554e9fecc2d585c21be3529febb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd7547378ed1726f6347599b5093520c

SHA1
b7584b98f59d5c47776027d1904da8dbed7c3c4f

SHA256
d032c03be0743ec30ee31cf6f9399eb1e9f1658fa3ca62455c053bac4c442e28

SHA512
6df86141bf4a6cdc19e5afd22ee81fd0ec15b0b8553779926fc0a723a9c33bb3577f863ec7bed909d7c8f4fea04576d1d72ee33e800938a4dcb102043e5e9605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0871f36743ec86884ad727da3c161fee

SHA1
2f06067c9da575e495a66df8efdde0efc0a42158

SHA256
0852b76b8dceb39af4abdec77dbe40b31b9f187371341572abbc239bfa9546b1

SHA512
b4d24e1177af1ba375119873c63b8d32b69dc9644c8a93696b35a215c7ab80219875b9278bbcd4023a98b36c74b5b1ddba40bfc5eeb5817a5b3b7fba2d9c7c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f9820dde53a1828f5ec09fa24432f5

SHA1
515f91913c05b0960afedf603584aaf33e4e3271

SHA256
1bdb2e961ecc0546e351c57263ad083b92c14999e12b47c43905ed74e6687718

SHA512
72beaaef61bad4666d1d194e7805b8d09cd480c7fd7c28e7670999a0f4b1a233fd539cd814a19782a62ef0317d96bb5ee1cb9b84eca24f69f8c693ac37166a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d81469f69ac8e75dac517173f1b78f7c

SHA1
48e3d9c3a755f3239ca06bcb94908575d6797c6d

SHA256
3889f6a3596f1a00bbc6aed738659b46418b8b85ed3d2bb95a2ae87e4ab26518

SHA512
a410732b39c658d943bdc8ec4e4170828b2942f069ff4657ec2907c3a3cf29824de3c5e0135aa4455e4be10f4d7b0246d885abd7f914e0fcf9652454bd9a17ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab53BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar595C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit