838f75a4fb191113d1d46db7caff6167c60d17f01e8e4b7ea3c6a7927a8bd433

Analysis

max time kernel
121s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

110dea538e8e663cf06a6747e4a0810f.html
Size

139KB
MD5

110dea538e8e663cf06a6747e4a0810f
SHA1

358154394fddae2db55ce37e67c33b8980d500b4
SHA256

838f75a4fb191113d1d46db7caff6167c60d17f01e8e4b7ea3c6a7927a8bd433
SHA512

69ad81a816d66c47dc3fdad698283458bb9fa88393329ff4ce1a12b1552b632d4395be71e9ea357f657c0a74a6698e1b825b6a0ac0b6ff1de98db3077151d2c8
SSDEEP

3072:KQvm0+JUXL9PP1gAAmRkA4fbqEZQnYY9B/TZN5KTbO2xSwgG4V/Z7/MB0OSY3xvE:Kom0+JUXL9PP1gA3RkA4fbqEZQnYY9BR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90bfa1ee7537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c1bdf6c64e6f8d6e0070f5e27877b420599c8f17ac5838484dfa45ee25623b60000000000e80000000020000200000000ab68625a506c2b8d1c11ea8cff1e704fe928a7800792cdfc20d9d2fa57254b990000000e87f69638e4c9f4b63ce9d5f484e8beff1053288946151a50bf31f3ad5295932362537d01c4d9deaf997980c8934b87a3388cb4714a96ff5a55e2acdcec1f4b3d8303f74fd79ae86d994d04c36bea1a70b90b0c4481362fcad435b3c9022af87388665aae423817fab4d7ef0ce0a70fd9d6ba7a51bb754d65e86266085cc742e1f5343c809607acc65dbe17981b5d37d4000000025112f207283da18eb45d6d7dd46e3e41f9f30848db2b4059e264b762dde36ecf4b76ecb290e04c62b20c72161799627a58398662f8aea07ef0c8dd3d5b73ab0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000293992cbde21303c8fdf2e59fcdffd14a53d93edce2075eb87f4afdee55fc8ca000000000e8000000002000020000000d9676d17cbe191aa4bcd4160e379077ddc8928d640ad0c1a88b192ef0c429d9a20000000c14ab35b8a05774936e2aa2036e921093c875de10c708972c64d0a2c9a531de54000000091e425d4cfce9cc6d04fa8fe72d3ce5da39ba7b2013429be7c377f0c97c8958e408a9dc012a5fd09bac7a51986cec233ab00889dc04cc50d7ea5c7c1df3cde96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{156915B1-A369-11EE-B6E6-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409700094"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2664	2284	iexplore.exe	16
PID 2284 wrote to memory of 2664	2284	iexplore.exe	16
PID 2284 wrote to memory of 2664	2284	iexplore.exe	16
PID 2284 wrote to memory of 2664	2284	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\110dea538e8e663cf06a6747e4a0810f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
63b05c18af9bac40973ec9debb8b71eb

SHA1
08edb57360ec2c8fc18d1eb438dc77248f60a48a

SHA256
7284ac498f158f73d12ce5f2ff67e2599cf01f09d588a29e1d69eaf14ed6c6fa

SHA512
111e36f4abed040c503a2b1bb3b537b49ab1e7d95451ecccbd2674c10eb698e660d0e49842c3db7fc1b362389b74629d4ab6473c7e5de57ba8280eeb5a8bd9aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2066BB08297F715760972468E8DA4F62

Filesize
471B

MD5
9398a48dc353047867a76f47e70abbe8

SHA1
f59dd921ed12112e6226caebd0b8e416f2be58f5

SHA256
1c3b0a5623d7fe6062f45113f5a2eb185a2e3cee2a0b1718b5dae4fd3e145a6c

SHA512
0b6a9cf96765ed06c4f041c7ad61dc0ffce38fdd5c1354c0446d8c42b16c069de6de9bf2bd8b4e25cdb0ca3a8493797dab7a7d3886ad1870d5e9ebc4569e44cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
31be241383ca9dc200736fcacb2f640c

SHA1
2c212342dab29e51d5a0834113c5284c10d226dc

SHA256
7b96e026824558fba41b7415a38aa8e6ebf1ce356898e6dd4a78fb3322c23549

SHA512
9eb27c1a2fcca17f78183b81c226b57835fd378f1506128315980d308412ea456d6cfd12a3fffd272da0b072f681f64ff57f46eed49bd1be638f6514e03beab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c44c4d050babec691006fbc0eb3e3472

SHA1
1488b5dc49dab6eee31223f1a4ae36fc91a865fe

SHA256
04a32a119c25e1de1c0ad3b57fa2e4674359be3ef065fc60f98e359c3351d1f5

SHA512
8ce1883826a454874d87b00c43488e2edbe658b7322856d9a3455d69fa2ad89d2a20233b83ab32d57b44e1df0032c15f056e3a69268ad1e855a75a1b6527810c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c78f01809a1c08ff248939a9ec4960c

SHA1
8e192f4e5347743172793081bc1f29a2a4c936a6

SHA256
008bd2d4bb7e314be5b09b58b7ad9174bb0383c9b50eacd36bb37a92bbb05eb6

SHA512
f83347932bfcecb7ee7bcaf4e9ad5e9bb709a0517e42d006ecf9372e45ccfc364c9e07e02290daef066f43a5a1a46f3a519a3e2e418f0c2c59b8c1cfaad13dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63f98547b018ab13cea7690fada77708

SHA1
5465f3fd8755e073210b93de68c2bf61909322dd

SHA256
200af1735f62e3e33c6e15fa1fc8720bbf327eb6d38de0c9d25466e3529545fd

SHA512
4530e54abedb3c59b29cd8c1a72f66167ed8bd03ee0cccaa17675b9a0c23d57de20a20e7b94e8152c0d2de3dd6cb107f27b16b2aee4b8b90a958d9ae79a2b89f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4da501ad553a20ac0f6ecd804fd466f

SHA1
cfaa6c6be44a4ebdbf5438c293d597f1f1e52911

SHA256
7ceab4ca752925b3abdd7a2d5ab28f73b5a4a402700ad358bb429c74fe2fb40c

SHA512
5a45c21924a304fcfe382c42bb59228ee744e321e89caef9de41f5b01f7e334af99fc28f1db46fb6c2ee08902aa6e4bf0f212e20ce5d945426a21f07e097695f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e253d60802fb5abdb02742d8bf46f6cc

SHA1
b4930880353431aac41d2bce038cb450e4571efe

SHA256
1cdebe3d6e9e87c37055da64e53c0fa5040d21aa1e8ada3376b2f94142024de5

SHA512
a554d10214374c6b7f0c863c799e19543cb0aba50d558139d70f9cee941ce18ccbbdb4e3f697bc02804aa60d47541328cbbd41302c42c24839ed1596bd266fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8153bd333ba9e4927d00653f2217a91

SHA1
9a4fefdbf688e5ea796a394c721da92d7795ef82

SHA256
aa2c07ee1d2c945aadb0958e2d335eb204730f3c5877ae2fe3e81baf3fe9094f

SHA512
c34ba69396933c7e367f00bdea96c02adc76dd8dd7f69a770b2bdb97fd9b3e56f343d16825b73a48a8338d6902cf54336c7148f2c42184ab7417417f757872b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db01380348cf0f710d3cae95f5216d25

SHA1
fb0b49ebb031cbab682d6d10d72e2ff29fb77b99

SHA256
379419b9999d1d80a9be6de723db228b817192075d71ca2ad9e109976d69b09b

SHA512
7a2e35aa1fb6ce21017f2c44bbd06b4a3ba0c9596945023a4c54352f9bdf99672cffee73afe2b385114f514413be51811eacfb5f89b0aeecda3550731add3225

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC5A2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit