ddc79ea777b992c21d2a7390971d6fb4a887eb5e7ab029c2770ccc2a72e0b9fa

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fed1f069c3c80b7c8d75e8c3fcae590.html
Size

6KB
MD5

0fed1f069c3c80b7c8d75e8c3fcae590
SHA1

5b3ef909632be97ee77b0101fdc074685d66bb39
SHA256

ddc79ea777b992c21d2a7390971d6fb4a887eb5e7ab029c2770ccc2a72e0b9fa
SHA512

624d25291152b87ea2c87d095577af06e7b054b74b97a979c795683c31cf9bbdc39d504a9a56b489a4a8aaa61e18d90c67e446f65d1cf6dc043bc9e13a1dc609
SSDEEP

96:uzVs+ux7HYLLY1k9o84d12ef7CSTU9dOZncWZ7ru7f:csz7HYAYS/9nD76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5E98A61-A4C3-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409848953"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d7e910fd7404fee57a05e230a176cef4c1d2354e322fcdb36bc24b1ad98918f4000000000e800000000200002000000089d00c6a41e693ec23df7d2c591198a32f08e311cbc5d893586e151301454bde20000000663eabb336fa93bccb04d19bd1bd9796faffe0b768dad6d490ae7d9741c22d9d400000004f1719bc81407935573f00056c693eac331bba9bb9997c03ef204c0caa9847e0e3aa4a03fd75d7c09e4fa5fd97f857e17ed9eaa809f0604236f7538fb17a92ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cf227cd038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d8e1e1fa079c2e5b2ae798b308679462ed2328c59e67981d4d0c9cc2113038de000000000e8000000002000020000000108b26f82701721e6bb356c72fbff9bc73f6b21c74f5d7b7cca61d691c84ccca90000000ddcacd7546b6e442d03caad4bb47bea9e707fc0ccf782203dfb98beb55f8f4519e95f6c92b5843dff48d1684e3aa71a3ee7aa9a71cfb6c1bdedfea060776d7cac57668513ce756ce6fe3aa4a3906dbfc47fb368acf0de6b25cd763edb22b07411275460f4c7f3b0efe6ee61ec467de554441b1ee594c29a95d9dc1928f720bf88b9f8a10985c27ef4024007506cbbea940000000630f76053c5501c9a5f08ac1e433ed7f82420dfa62ee7bd5878e9d8e6517876bb6eb1deeb11cea19d77cc0597ab1106258c61918cd6c4743de1557922469e994	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2876	2912	iexplore.exe	28
PID 2912 wrote to memory of 2876	2912	iexplore.exe	28
PID 2912 wrote to memory of 2876	2912	iexplore.exe	28
PID 2912 wrote to memory of 2876	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fed1f069c3c80b7c8d75e8c3fcae590.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3156085399cfc2503a5dca9ed71b2e7

SHA1
90becfa140132200b741a8aaae2dbec393a79db2

SHA256
42cf4a607bb89eda08b0e2d0771fae4919392d94d3d7bc2b0b7e77660bc04c92

SHA512
c1b666665e21f8425146610f973e3dafc041e3e1f7e643ac48cc64f20e0ec43fcbd7e5c0f11c5faf49e538d0bc4ba8bf87ecced67eedf1a4008b7eeae6fa2bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a6681a0bb405815908d8bb1c2766c15

SHA1
ba02f0b7069bcf2629bbe69740cb347c59bafbb2

SHA256
0e4c915c952afc7df9eb26a5de8dc86b115262443507105411bcd271eb98d9f2

SHA512
fb1a9890b651ff463325a21f87ac26cdfe71719801828c9373f7298691c6d759cdeba1bb025b509f9f59b702990cb51ea27ee767fe3fb9d970626aca731670a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af8b63354ef409cd3af307c00f2e7e6

SHA1
18aaa2673cd4b98c6c8bec1682b9af57f2acd5b5

SHA256
90843946bb53723391d0d10f57444f0db253413245db68eead3eae7768b62ae5

SHA512
f4add23e27f1fea3bd781c732f3ed129429bdd82e91fc0724c8ca7dc506fc8e216365ba224e658f306025a593e1d65b0f00dbfa6adf4489d532b05969d38c36f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e410d0ecbb2e3351aa237b76a33721f8

SHA1
4e570d35aeeb1ed227c3c27555180a5012690c0a

SHA256
f7c301dd1eef9a7932da1b54ae75183bec6d22004d55adb0a57dbc97046a5c1c

SHA512
7127a9518e56ca03990db729ba9baae1524fe438a32daf4e6b1e49b5ce2796204241d27ee44e9d3a8c4f7afb4c999f84b2fac919aab811f53d0e9b2457afab50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5b3eed18ed83e7373aaedb85f1eae48

SHA1
b3b99d55acb65fe4725de1ebbf1e6b0b426e5430

SHA256
2460c17a597cdeef0b2132929226984896904ffed828fd75d4367fdd9981f751

SHA512
cee2ebfc4388ca7be4d20c3c866387e2193b4ac95c07914452105554c7b7f4f8659e7f26744655b6f026dfb8a5ffcae4f46ac35e7379b2c6441d407ffa538f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ab96298e93f44c155809365204e70c

SHA1
3c5caed3077579ebecdb91086e7a270bf7ef5d32

SHA256
a4ff718d8f98a59370ef3c89cd8a392d8d02d838844c1c2e6abc230e2b9f07d8

SHA512
600107ef37a3decae842bd5cf93cf85adfde10b19557250fdf4787d6c88ca6880a6e45581688083223ccc8bc4371ce4a38346085b505fdd93c465f34d7059895

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB26F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC05.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit