515e64bbf3377d0a4a77d44538a0a53fb3da413439c0ae661ad2e8d4a929d0e1

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

186e21851b21fb730ded69e2e287af90.html
Size

57KB
MD5

186e21851b21fb730ded69e2e287af90
SHA1

3c7cf9c9d129626e8a422992951ef562a3e37019
SHA256

515e64bbf3377d0a4a77d44538a0a53fb3da413439c0ae661ad2e8d4a929d0e1
SHA512

0768358b261c9a33e18f97df057e470803cb5823f6a7615c3adaf941d75b1b0ce5314b6d10e887f0e1f85caf9e44b1956932585020a346917d567c7e3c2d2d25
SSDEEP

768:JgOriWNcaSoagGDqwfY5vm0g+YIYshgXOUaDLDw2zN32SbG:+/lqw6m0NhgXOUCzNk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e2231c9eae07450b4d9c98898019c8c931a1bcb975531d46901034d49ca95cda000000000e80000000020000200000000d34e9eb51559bd7baf8927cc8bf613ad42015009a44e4d6ead56dda9f9b767c9000000088b17c3fbf471386b155b684147b66e9c02e78098d9f21357adf278eaf7b40c75e57e65add384b3e14e2790a2a9f74e1d23eaccff9c80ff9fcd3d246520025ded8420d7226a2f28350319569788e3c847ff7011164ca37ce564e53f2c2432556ae78aac63da673eef517c74d1d3e635ba8cf04eb9528335543ce12676f704f061fe7435504fde051810c503e294187f0400000005115f635cdced54f2ed3ca5b8656cc5d72ca76879be3c58b862e07bdae23320d8a64c2b3fa5ea1fa11293d9c55b2629d4dfb7989eb4639e5960789f3378f79b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409715539"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006fd01216ca7aa8329a99b0358ac2c2c454b310a8ade095a32b1391fc5dcc21b2000000000e80000000020000200000004feac9769357296d4a74ad9b1eaa9e85da07c0c699e06cdd56c74c48c6c9437920000000ff7e44374bd0f2b43db402d2d3778b63f60af1faa83a6f34092371e8d2c03f6340000000606310ea37558781d4cbe5b264d8e7993430fff06d187e3b3ffb2fabd7e38f0068a3fc0b496f77f264a6d561f5999be7f7b3dd938fd82a0744559b07718f465a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300965e19937da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08F8BFA1-A38D-11EE-AB4A-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1352	iexplore.exe
1352	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2260	1352	iexplore.exe	28
PID 1352 wrote to memory of 2260	1352	iexplore.exe	28
PID 1352 wrote to memory of 2260	1352	iexplore.exe	28
PID 1352 wrote to memory of 2260	1352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\186e21851b21fb730ded69e2e287af90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c86cd1f919d4d22b07c87d2ba061f9c

SHA1
083988ab799a3694eab10ce599469b0e35da3ed0

SHA256
baa11046b94cfe8ecc74065ce6e4863a376a6034902bb5cea238c766dd9454ab

SHA512
1eb6b77d2b3efd60f02f4682913805ca91752cf0777e0538eeaae2bf3fffb82e1d4c859e5854cfc2f2680b9c4b78f2b671f4d6b88218a0da100662224da2d5c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ac9c0007359fd05b16ec05cc3d9089

SHA1
6f85bc181caf76dabed7db6dd8c950b5c1cd54cc

SHA256
2c89d8212cb0a767d402e857304abe18764f91f2965bc02c8436e65c5c323fb5

SHA512
43f42e48e6c792db0c04d9a2966fe6ec439b319e48cd035e6e631480d1bdf4e956b44fc0e84e8dd793731468eb3c713a35bba307a6f9878ca535fa4e237b1fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecaa1ff2b7cd82ce31ec5abef416dadd

SHA1
d99958e7bae74c49a4aeebb57a974c7995f8aa38

SHA256
3e2e10b422b985966fdeeda1b2854993db31dfde61707178cccdee91fc294af6

SHA512
811263ae50cd814dcc8852cc047b7ced3f65254640561f9ba35557fedada96e481d4d9899c63750521d4c909075e50e170674d50d76f4e94bde3c8664fa873b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f71994d92c8d432b8b6c2f5779f4303a

SHA1
cd96248e8807699511df6be5a16bce687fa3a8e6

SHA256
8821e5023f5d73ee750cb1821082355a89744d0ebcb60a2d1aae0b8da9641fc5

SHA512
a526e52075e1076168e825fa36e767951be21e95e873dea0b711d3ebfba589f3fe7f440f5ae02d68a4e527c7df0852e31f9585c10b9eda22dbba764a9a291a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97deec0e80f7dad7602b75eddbb65802

SHA1
a055b79703dac1a8092895f9ba3feae22784d895

SHA256
2da37a9dfea94e0d3997e205f1218d405605ec9746208c755f0f66212e66a0fe

SHA512
78a932d6ef0019e29dbbba6b66509840922f703acbda5bd87872411d855376f869d63796bef4013d61db510d7e8c3a1492279ae80a2a3772402aef837ec5fe6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1495bd71976eff3c417b93d6f0497d1a

SHA1
c11bef51ebab0728fc7189ff2279d74e525535eb

SHA256
9b1c0e0554bff5a5e141cd7fdca1b8e8a2297d57887dc3f2bac99deb289c145a

SHA512
99fb7455fd75cccd133ab4d0629a382b559480b28b9a5418801145f7affb202304cae6fed980164933b0c897a72d3c51b25f3bf18af27c0b0dc7380301aa5fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f674d98ad4399753048461bf27fd398

SHA1
1271a83aa9909d0b138f4e2c10567295d43b2205

SHA256
7834d3ca216470c6104271ae1249b8c306917ed10e4c3427c71864229341e9a9

SHA512
594b6c579b9ab12a709a4fe54434b455447809d1bc9fad2601db3200a09c9fdd980e2126fba0ba27c77be2a70639403d150aea00ddcb1bca5af386d347a443a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a35b3701fcb71dc4e589943d9dabdf46

SHA1
d0ac72192dd3d020d0bf069cb7b0a10fadb307fc

SHA256
86af04d600209b93dcaece1b3b7895afe4ae3a14fe0b9609f647b4f7dc8f6841

SHA512
1228b1dcb3986fa65d5af438a80ebc88b8a5a3e8c4b72fcf2d791748d6fb80f30a35605a7a50516aebc827987515710bb143d3dbfe1be853ed0eed136bc74c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aca64fafb6283338ddd607e898ed3117

SHA1
521cbca91a874035d0c5cdf88c7afffa65f7e546

SHA256
6178f9e265feff4944b05415de04defae48efe748681f8fe9ff5b43ebf645bee

SHA512
8848821f244a61c157e21744316e035f1dd66d7c7ceda9c5961535af20d98a397fa5b95997e8b61bdfd3e2c2fb7c2b003dec974e0aa9ada0a99a37304c9eef72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e040cf73fc897d05b0fe6feb9119343c

SHA1
05d1a4ced76683b04d1b853a23e68c0fdddd48b3

SHA256
88980677c33749bb09f2a0e418ed034db54dc9f8acf36be8d88e2a5076592d09

SHA512
9f3316222324d5e0d55ee474939ee78cc00a6ef51a7efdd434886996c98f94c8fd09251330d5e572f795a19bdd8ca15864e29eb348d51209c009679991ec0c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aecf1c8bb0e4503840cd015cd90da32

SHA1
15438a86999959b736ab09c3bd140745989995c5

SHA256
2c738dccb10883e9964a9f032d4da7c5ae76346494e47465fbacea2066bff9fe

SHA512
59babbe5fb4c93c62e91753d0bf0b94ffbd156017b6a184d55b5913352bc219573175fbd9c60a8af269a04955dbf23b0dca13aca67ec11e9e1eb3fd266a6081f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8CF5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C04.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit