5a91a061ed0eab2c97689d4ff790383b0f9531ff30329e57449fd252e1b25013

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10ccad0fa764e0d0bc352d74f801f180.html
Size

15KB
MD5

10ccad0fa764e0d0bc352d74f801f180
SHA1

7f2d1a03ef2a6493a10a32b6b467069e8544dde8
SHA256

5a91a061ed0eab2c97689d4ff790383b0f9531ff30329e57449fd252e1b25013
SHA512

084ecc5cd8f9f6cbc158469921cd70671e45882b17ebefef2f60eda28bbdab42707689ea7167dcbf2a0d6db80eecd390971c867fe8a27d90bbfc82bb4db29541
SSDEEP

384:ln8uqnGDnW0ql0GW3qLyvEbOMgvL2L6O6F21ujJBbgYK2FPtOa9NqnMzLu/huz7D:ln8vGDnn4kfp558TQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{599B9EF1-A4CD-11EE-BE5F-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b97a2bf3bae4fd1d6f2d16433d49f0018a963901163cbbb22b1b24b80621b6a6000000000e8000000002000020000000533edfc8f230dd7124f7f6955020d09a95d9580ff5d0087b17b0ef6911b0f62990000000d671502807742872ac7008570acbf9f10d4447989e996789235a587e958bb0e0a23d54ff535e7c6b6629e65376738f4406daf796c9dd796821d606d09a49497476f71b8c89c1326a645bd1a369dae176ec9806fcb37fe6be5bf1f0107472d5a5914b2431d627cf5676b0bc33935605eb04f7c7b793626fae487893b3269473f54d7a4a18305498346b62a309da355ec440000000bcb3f9eb3f3a1b8d2bc0085b49fa401be1d7a0f60036d8b3da7cfeeb1bc51c71b509091bcdb2e745a4c13eea16b426f91f4a3d933dfc35bae8acf57003dd8368	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107acb33da38da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409853110"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005625343b7139352d373adfcb5b3534d9d1e99cd03001fb58e6b6319ec64f1c55000000000e8000000002000020000000b15523cc9894d764282583775180ec7bc455e22e058e2be48ed0c2b377bc12ac20000000f36029b1a61db5a606b2fd2671784212f609bae551c446d1fee910c30272c80a4000000008d804f735066518902ebec8ee9a8abea3a5be6be68905c3b9a5bdf334c2b0e2a6d141a680cea7895e524cee2068cac6c1814348fae9a49f20c09464eddd510d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1888	2168	iexplore.exe	15
PID 2168 wrote to memory of 1888	2168	iexplore.exe	15
PID 2168 wrote to memory of 1888	2168	iexplore.exe	15
PID 2168 wrote to memory of 1888	2168	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10ccad0fa764e0d0bc352d74f801f180.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f864f21de1bd09bc7e8737837708ea

SHA1
0bbac176af2ab8353e538c326cf448041f7589e1

SHA256
b69525dea9f2873de0f5d773f85b88d7e677844526839a214cd218da0e49f681

SHA512
0a3cab81c6252c63c435041ebc9b66d61afdc8235d861791d413a96ed05ffb14fade68ce75bdbe67c821a1aa0a31eb57c980bbdb69692cfc026debc7d4d3ebff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de98c86332c76e9c77573ddc50c9446

SHA1
ae72bb815026559d266fbb1643429aedd58a4f52

SHA256
5d00b0e6674824453d1fa6a5363521271ff749c77140346b03cd59c976d8eca0

SHA512
12749120caef8a9ecd5aeeb4605ad6f2abfc5f7287bf0ea57e494e5dcb6f3ea8bbb1a0b57c4a3b89b0db4b51e1553f3dc0abffb5adb1d98d36efd0c31f51c596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0598feee4afced51288d56157a01989

SHA1
583e1fe8cfef8e46d2a316a3a0c3acb2f9ecd0ac

SHA256
083717a1b53795fffbabf5d7327c09a375806eec89866ee70de9ddca9ad405c8

SHA512
33d81efa9a9cceb0bf9f08a4c6067e7b541c9d738ede540f83a5208ad006adf2bafab947ceeb9383b00e4ded36e5a5ca65701c417c38489ba3d50b09448b3b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14cda9a91ebf8a0f0309ac83d63398d1

SHA1
dd1ee4814da377cdbabc74bc65a159af03c11aee

SHA256
b588a6bdbaca179f74dc445b978a36aa8875df7167f7eb196418dc621b25e3ba

SHA512
6676a81343d35d99e53ecec3f18d8582bdace7ada27cc8f36cd0379830b29e41c10a102e70d0d4deb7a63134ee34ace0adfd92e8ffe83fcdc85653dbafdda21a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29252247ead504aa20720724c115d02a

SHA1
0a059ed4f1edabc3ac364f66c0b7cb1c5c9be282

SHA256
4de09747bb5d1a47154ee6821530956203bc9efbebe85847442e00241dcb9dc4

SHA512
918f01a3c716cc68ce64691945c552ea6b1d2ecb5860f0becb1552cbb07bfe4dcdd5fb312e56fa90881c4cafe5d438449059a668c4d75d4dcaea38b9af63659b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6488c9e626e8cd27c2a39d05e0ff634d

SHA1
0eed3853c9b50fd3011b29079b2e7c5127adc31c

SHA256
f234d08064142c22aa2b15497177d758f97b92eaf2c20c3a04e2e89231a9f4cd

SHA512
6a0bfe2b42f5758a859799d38abae05e583783c4af1ed35652aa75bd82e2ecb1ea9a5bedd244314ba3794aa17cdb420a1ba507ea87c0afb4e5f4723814f5a303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b20760f9741f24c3b00e5cc8ca37f6f

SHA1
b1d944d699ea70d65cca3a51939575926dd546fd

SHA256
fe838cf5e99b5d61d5209eb3d686217c0a25d50544c40adbd56b13c45b6250b2

SHA512
72c3eff1661c43af549840e4eadceb010e73aa595d441ca4f5ce229afc86419c9111bceda7d7d47d2b2f0e80ddb9b46d859eab6af6e83a04196b98fe69b185a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d22b566079133bc3d2313f7d005545

SHA1
3c30271dae0f7cf88bd46a8a8d6c5e59b0783e8b

SHA256
6822668cf44b0a20661fbb3673ed9dc01b9465e5806f311a6860e7cb8457c4a4

SHA512
f1d41254c202c294b43ebc7c20fb36d45591c556a8e28ae5d8a1a3d254e9ff6dad48cc0c421f9a87683782575a289525ff222e1b23e2543a58b16dae44176812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
763ec23967ffba612dc0eb4f487b0b6c

SHA1
793fe9d070d7999ca70a39c13711ecea394d4ea3

SHA256
3b199138be679f250680730f2ff638cb252f67943e5e6893cb09e39103ab70a2

SHA512
e481896dcdee769219218b9fbf2274e9c06382fc9134c5292dfbe716f5cbf64ea213b090e46ad319775627d8eaf56a7740ba50ad2ccf1684439f3064cfe17448

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D1B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EA4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit