dceb69075b34ab096e4f08f8ad17325a4b843661892b51aac680333ee66f1559

Analysis

max time kernel
120s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12933ef6a8d42e65008ae44c4f8c7ccb.html
Size

15KB
MD5

12933ef6a8d42e65008ae44c4f8c7ccb
SHA1

660dc31a124d9539fbf71c8935f1aa5aefe3a4c9
SHA256

dceb69075b34ab096e4f08f8ad17325a4b843661892b51aac680333ee66f1559
SHA512

5f777631dbb2b5a3f7ac06e136d9b5a589378b6e504f14cdc1a3a0211aee67ef995fcaeccd5fb7d826318687a4a3d931bb9e3d967c985c261a8135103790d997
SSDEEP

384:CKTj3pd7maeXEAWOlxVH6hzM0NOfcrafOhnWBCghd+wRzdApU4KkDo:CKTj37maCqbDo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c5079f5776cec59334855fdf368aac6c1d68c5b498d5374c17bf5251b2ab4653000000000e800000000200002000000017e49353070dff014932e3e99337dea162154bf33b3b83d015d2c99535f7c91b90000000b53ad29098e4261b8e65264f3fd73df3ecc643092a8566225a83e2e7256fcbde4fa6a485ffe48ca867d4c7234d4424d91e5b0f836769c5e3a1bbf8d30031987f41fb28c5269ebb045d62854dd79bd37f19186fcbda5c02d20d81bfd8301c3373ffe75f7e8843455d4d8a267686dcc9d1f2a3df668909f424760fa81fb863499a639bc7ce82bf45098f85740dd4e467c84000000082461a919be9d0e0ad9d9a7ab85dde6fa89f3d716dcb61059f649db0aa441d41f5b36f6d859c87121d56536ff88d4b1e08c598dfb59ee4ab0bd83c2894a5809d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c8aa2229927ac50ae200625298af0fbcfa0a425d9c67884cda4ede814eae7f5a000000000e80000000020000200000008aa9f64447c60db19373c67e5a086b45724d6d5ccca09b7196f3d2b4f514293320000000f97ac38114c34e3e693eb43c0a14926775409222c178000f6dd7567bca33e8de40000000fe1936847438137b6d92797ec398938de2cf2165d403f1912eb81699bcfdf9669a89b46f9294551dfb9ff0afa65e1c544280aee58bb68ca4dae40fc81722774f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42F05A41-A371-11EE-A892-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409703607"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04e02327e37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1944	iexplore.exe
1944	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2144	1944	iexplore.exe	28
PID 1944 wrote to memory of 2144	1944	iexplore.exe	28
PID 1944 wrote to memory of 2144	1944	iexplore.exe	28
PID 1944 wrote to memory of 2144	1944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12933ef6a8d42e65008ae44c4f8c7ccb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353ea2e030e29bf0cc1a9af24eb9c136

SHA1
6234b187b842a9b72659041ea0ac4da4fd376e01

SHA256
52cad3ff26159e2b4a781e99dac62dbbe0d772896af173b83668db78b8f93ff5

SHA512
f3cb66c49c3de3814795953aa58167968124a4ca7b81c6ba148023db95213f2714e2102299aa9b4b55d911a01f6b364aec316feb6f65f26d51bcbfb367bc04b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b56a34787b686c4539dc751d47f3faf

SHA1
b2e679c7a1fb3bc80eae274ce177804f461a0838

SHA256
057c858b6432b9135b0bea48b9dd714c7b29f83d014c1210d7b009e0b900dd7d

SHA512
b07250c8ff165729bf9ca4aa18d62f4b5e6afca73930436d2e188714960f1dbb9873ec3f76dca10849db5727ba5155d92352f922dc3491e813b7c17db27fe442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1437b77fe6551ab4d24de1ec88316dcc

SHA1
5d4dc266abd462886b6dc092409b49b530e5e49c

SHA256
e413e0dbd35fae65c2bb165631c814e5f02cb08501833d096f9ab30bcbcc985f

SHA512
8b8e3fd6cecf64c384cba0261d6c8fc01d34c6a2c4e72dbc0c85061a0637c3a120bf49ce1dcd7f4fdb62239b5b432052dbcb66e3a111c339df31a186a148a7e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3092599541fdccd437fc66361d01b972

SHA1
575d947f8e7698857d37166f5fc4a93559a4e568

SHA256
2bcbd1221c6ab36cff25c6dbbd8f6abbac9a66706da614223795f928010681ad

SHA512
b1be45df1df85744d40306276f9ead33fbe50754e880d412c0a2bdd5acf61461d9c0bb22fc9292d19b7f00dad9e0801078983693b351d90a30a31f62571a0388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0789523d323fefd6e5c28bf0b8cb0cc0

SHA1
12c9c0f7cbe60610426f51c7df5f9a3a2f05a145

SHA256
f11962ed10aea00b7beb5c74bc5f3f432d0c19b80382ef353c330d1155b49c10

SHA512
8f5b2234ecd1a9254d4b0541f6dc4baf2043eae7c2d0722b938dcb7db17e87edfe8333577fe87be964c4eae497d1d6ab4515339e249bc448de35e0ab475a21e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63afec542ba096bbdb4f50889e4d3f89

SHA1
071f6dcd94bfbe4b85a74106c1e051eed66bc006

SHA256
87866af5acd187d5b7c1f7a6edc23c4d7cc3b9c64c3c6856a49a68b0839bb378

SHA512
4e6f13b663daf45158a028c471ac29a3e83f30731eed405b6262add50b1a340debf6c2a23b3d2b8ddb378e2d399d47cb7524487e32405f9f5f73dc31a672f57a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd5cb7e217140de1b06265844319ef6

SHA1
81533f65525edcfdb02bc3eb75bc48ef03109569

SHA256
ef4723fe24c69020d6cdd1449c1ad45ac2bf087d2276210000a95aa7d299bc44

SHA512
d4fa32c8cef57084175ed5587d02810e363fc273cc5f4d3e6ccf46721f339c7d1a774338407a806e1ebdf2754fe7b2cef88e712aec78c8154e4690540a7ef56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51018ac57f55831a9cd713766f009acb

SHA1
dc7fee7400d3e17568d53e34fc617776002350e3

SHA256
8f764434f7af174c8b7a32e6b971a9df8a0f34a89a77939e5858fef615b31d56

SHA512
ad233204279b14a2a9e8b44ff1089428b4e1eefe8872b56133d76946d45b8379b3028863e2c2100fc3f31232d2981d2796e8144bafe1d94bc49ab4a3157f3e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90fb65e063f840b26dc51177edd6896b

SHA1
d22ca29dfce7abc21ec1e4995ac058fdf6d5c96e

SHA256
953aa92c61be8fe581d96f2edf247c1f93f9533241484e8315097d9a5f4f289e

SHA512
2e2853216d5db55dfa0b2e4691937ca8b9724a3e641fdb46862c955b0215235622ebf5a6b14b1daea8972d2129fb740f43f48707860a0d096535f93504a57ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f0d6bde886d317548544c266930e062

SHA1
b546d33f0741b7fc8f8820bcf041ccf6915833ec

SHA256
48ae7295330596ffbbf3dcb8bcc3da7c2f1861620da952dee4c26c17de11f79b

SHA512
bcc4314af02b050ded964aff7f9463eae29807b82da00fe16831891bc5ecacfa3ea92072fcfcd74a6381669d765df0d5a3e6a3c85209f82974c51491724abb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a960e4ce07ed3bd16324c53884144b0e

SHA1
4b39317fbba147475a6aa4bdcb134f05b1cdc2b4

SHA256
50548466388c7cf1e4622a85d18f0fdd81db6ef35f3d003b5dc519de3c1c9340

SHA512
5f75105f357a8b48937dafe998cffa034ae07181336cbd52848d7f0ee5292b1a60a47330c31cb17603710f61856b5a538b89a366c593357ece7441c3946c15a2

Download Submit