e6cdf99ad344b83810e945dee259b507f53c5842c29f68d2148f3fe3bfa9cb70

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d9edd781fc88bd1151ab125d3aa0ab9.html
Size

52KB
MD5

0d9edd781fc88bd1151ab125d3aa0ab9
SHA1

5a62ff87242ccd6cb56b67e0ea8c5099e5a25d5f
SHA256

e6cdf99ad344b83810e945dee259b507f53c5842c29f68d2148f3fe3bfa9cb70
SHA512

449d33031e4ef2773d82f4b6f1a074f55aca543de3ab073015c0689f24533372ca8887158104f1ca2a8f2d7f4ac6eb1d3046a2c23e6a84f7b6692fc6850bee2d
SSDEEP

384:rpwWbTkpsSvdO+e+WD4TKHz3hxQzDVBELn2s1haXrFPwyufvWhVLyiIrP5RcUq+W:rpwW8/A+eFw4UV7CluIOfXInddHIndr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000005fe8f4a4677ece3da9c4fa82bbe4b5d2e1dd9a915768c59c545b27288f5ce138000000000e800000000200002000000002390cbd00ee5dc1b86aefbdc51271c3479d132d275a85f631e28063a4f281e890000000ad7188e9ed2eb1eb58d83dbb76479d1701edd2f23387362dc2146c5ee85205a160dc4c1d5a526468eb4d67308f6678aa73daa95d781cf095dd344f6eb836f5cc543ede549ccf9ffa3892923615a5d3d1bc78ac447dcb39a844db76cb1fe640206c12be2595d48a7e3d894dab1bdb20224244b9a06324fe03b433d28b35956cce74632d5caeb2e64b48941f2d2e0034ff40000000f9e52005c4a07ad059e0dc50d140ff78bb341673197637e649154841e799af30285c3ac7a28c34648846fb6df73bc2c139847674be49a7f2f00b56fd67af34a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904a5c056537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409692831"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E3C3FB1-A358-11EE-851B-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000001b15ad91a4f878e864f2ad4dcf13d81df6639a744c26f6e2a04121176d4e2f3b000000000e80000000020000200000009603ff3a185f353a49c828e26333c93610b089c729b73a54db97602ae310f9cc2000000053f448d7aa969ba134bb3b0a634fe6a4bc6a5e1315d96077841d6f3bf82ca482400000009890cc637bcbcd52059822c77a2255c7208999e77c1a577a6c15405081f0aa074b3acb4e1cc265377320741665a17d60b2c8fd1aed065ffb3bc71dcd156dd92e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2136	2140	iexplore.exe	17
PID 2140 wrote to memory of 2136	2140	iexplore.exe	17
PID 2140 wrote to memory of 2136	2140	iexplore.exe	17
PID 2140 wrote to memory of 2136	2140	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d9edd781fc88bd1151ab125d3aa0ab9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8075648530696f8e96985a62daca5f9

SHA1
21389e38b63554e79aa70b18c866e8b8c4db3c9f

SHA256
3ed2ac54fcf09be30c2797c861264f059c8797efb15e34dc10cf02da3f6219c9

SHA512
f62d04563802eaf3216b8ddee1c899f9e71e967821cafb2a54eac9a149c7e5f62875d0123f045965cd53f9693227ca92a46a8b44dfc8b15be83c44ead0d8007c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71da6ad4bc8dad63b9d4df8b712789fe

SHA1
4c2da7c5e13cf44f6d1477dbdb86af81312ebac2

SHA256
8a90e67c48b7c2c66e167061920539e4f94101846afa73457eef50abd358ddf2

SHA512
26c4d7d6f33f9f97942dcbefd95cbc468ca1ea885c1116561cc567d1ab1701dffa7257f2b7f95ae9e586043aa0b60387bc586fadf1de9eaad8fb5ed3a9b2c4b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9962471c9ddcc60ae78adcb439c81f9e

SHA1
07c935273934c92b9be9e6ab689bc2842ba8fafe

SHA256
d02b797f5b667de2d2cd69328a0febffe61cc6bcd8e675422ebad2702f0aaea7

SHA512
52f348a3eac291449ee54c4c76974a4452d929e5ff268331a9869da09b3270aaaf0a46ae70e3e9be89a61a11c03642f3ff0e507d8d1bbceee3caf40330d9fb85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4610228d14efb7ed89ddd85a92bd3e1c

SHA1
3d55c7d007aad3b9e5055610995551c2b92d9831

SHA256
b5ec5c76f3249c11586702f86da98be6c4d6e7a6df2c29ac480a0a036ef1086c

SHA512
18d1bae874877cc8198574c9e876a10a5f7847efc4b9bc34b24cfc34682266d0e809de6d8b9ec3cda3d515f5d9e41523fec209e27120fa9b1c3eec878f03db29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
997c2f0c73c27d82789fe413fa338ba8

SHA1
ce0fc90336ae0f4ae958921e83d13ad483541126

SHA256
d5b21a67dd7b22122f0cd03c8ac6d569e889a089d8f7b53618d86a247c66bbff

SHA512
e91a4b851129a23236e6e877f54ca411c80dbc14b8ba2e4472f1020cb4be4eb6a3e8bfa5eee97fb5ef35c85a67ef67de9c1e80bdbcb566181bd6b5ee958ae31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
286847988eccd79a6d43be66915b3442

SHA1
2134815ba3b3d7f4786844c6acb6024d507d2986

SHA256
27768561279e46b670c9967c2fa98c130eadf4549259d52b573fa8974b8c28c7

SHA512
7bbe56c82845ce70beb335a500f5e685f8adad3b0493c872f4107732837f119343fadf6e8d89d74be252dff12e6fa9fcf34d66f1dcfcf7eee0f8f358a4eea97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98fe92b6099f2774cc480a3c4b55274c

SHA1
3cbc4fcc145cfdd026819ad72759b5465ad45de3

SHA256
7783bb2babe061c921f5c6273ec5bf83da3fa9c5afc80230ee9991f2384c371f

SHA512
64deecaca03b7ced87da3dff4936865715ec8ca97019a389cb2310cf53f96f31a701191b741421697ab833ecf7c7f49f81548479e3b2a0894708b127333db04d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540747af3e7727b4b0673619c0f41039

SHA1
4b9dd2115c489364b12f78c6441bad24705b3909

SHA256
cd4a2fa5d7c820d86ac1f48ccd716982244c071b0fe2520056e78d2d87c0d8b9

SHA512
c317618a2b0e19e60e7742c021ffe20d6fcf8abaeb3ddc70e2dfb89e06d870bfb2c7743f072b05f5cd9f07b5df3ca6d0074d1c9e2605560eb8e22191300b90e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e653dc0e68b3f34e60049ead2bf9d09

SHA1
019bf87541bc569343dc1b1d2eab7e83dbd45755

SHA256
671b15af650edbfa82cee663060f15cab0822ac26416f857e6b680f6b23a80e7

SHA512
65471c7f25e6dab2bc512c7dd8a86eba976603c5da7eea2ae9c9e23895eae93c3f0024a40ba2b645f7ee088f30900c38aa70abc005b75d5c25a8e6fcb55935d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfe9818539431a249c3c8c2a056ecfbb

SHA1
08931bd2667de054aa3aa5a1a0269b6c90b75a56

SHA256
324c1bbfe410002355b9dff1efd03fa23bf0e4267b2ae32dd8e0c33dfac62c79

SHA512
3f4cea3755c5ee55dee7554374e068403227bcb6cab18d8ca902cc026bb520a446acc96833eaf9def2ff245c0964f7c3b4735664bb9b682bedefb0358b8aacb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\f[1].txt

Filesize
34KB

MD5
94baeae5a431d3f4b6a82c4a91f59511

SHA1
42afc199c30c4adf7d69bb10cc1b7674102cad6e

SHA256
df5d165b5af8ba63c3b606253a8c73dbdc132bc66153c867b4acbe47efa55f0b

SHA512
866c5064e7a88ff99696a64ef6cb3a770db74ae99d773754613422f6fc4d850eb32945d57aabcd0cbdbb9bec74ab2627a7d7a0cd14bd465086db0083756f0017

Download Submit