dacd740d670c0d63764ebeef35d4f2952e46703606f5989c49ae7d0f4e45da81

Analysis

max time kernel
137s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

186567d838a081d4cee0e9b0b76bc3c6.html
Size

12KB
MD5

186567d838a081d4cee0e9b0b76bc3c6
SHA1

467b1d089aeced22c5b8f1cc8fd38fc8552349bf
SHA256

dacd740d670c0d63764ebeef35d4f2952e46703606f5989c49ae7d0f4e45da81
SHA512

83b582b5e0da5bf8b6b4c4d72c3e31c82ab863611389b7b47bc91b35daad3b0eae4f3f5625569be1003cc779ba04499eb8738a49b361ab76fc5d2b023fa41b75
SSDEEP

384:16qyyTib0ld6rTyv6Rb+nQKrlibQmYMH/pMF1E:+GgyvCAdhi8yfpe1E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e031f1c42739da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a300d78f0bf27ef4f4ee13298faa728ce75cd660a2a11906a0ca9bb31a25ba52000000000e80000000020000200000004260a2302be05580a4680429a4f91947509ecf2c5d31f32a21e1095bf70df6889000000016f242b20ec1dfd5d7bc6f7f69e4266cede15041a9394a5c7a1d9c060f0ad1725483fa8f2ea2619580990f4cecd7f2046636fe41d057e44c0881dcbba7d197c3e84be71f87d8330426eff5e04bb5ea0dd383139754b215c9e22f2f9a97f6acf804be344169b75320ea06d3d9fffc153bebfaf94be5d5da6aa37e0497e04963f52236e36269e24530a08f737d0648954d4000000009ab69eced0fbe105489d6df5f358e10d46120f6e3e8db937ad01edaf364d319c5e37a21801657d508e54c8bf4ad4c70c24b3ddf0194dc03f00ee21d19a17373	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF843601-A51A-11EE-8183-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b763cdb3e3ca2472afadbd062e3f57d16568e8e6b59d115228e8b5b15ec114a3000000000e8000000002000020000000d896ea359e9ec0e0a192d4624c1ede6924875627ce5d9d3cbc1b6426ef8ec36b20000000f940d17cdc80b461a7a340bf3bac51e7f5e9a2a732ba590e1ad8e7912a0cd3db400000008241a454af70df4fbe3892879b5eb841324bed86c51a130a0cfc43c861e47d6f92ca84a4fbfc12867950966bc853318d9aee49183bc3c2c348d24f54685e656e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886429"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2672	2184	iexplore.exe	28
PID 2184 wrote to memory of 2672	2184	iexplore.exe	28
PID 2184 wrote to memory of 2672	2184	iexplore.exe	28
PID 2184 wrote to memory of 2672	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\186567d838a081d4cee0e9b0b76bc3c6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97d93a2c18302b5ef8413db49a2e3091

SHA1
a880b2aa881204d4a4fcd6740b7aab535fb516e8

SHA256
92e6db277c9ee560c66a5510342899b5c5abd08b7cf1fd570a184c76d2cc201a

SHA512
8197ab9883e397fc22cc0fe16a9d3ef0f8d762d0ebb160cbf57f1b0999adff819e3f8b2965267ab37da4fd1707da8c0701b1bf4ba907684043bf2e8652c0a428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
947009602cf0c395d9ec5c3efa8bd6e8

SHA1
5000bef2db9c0efc42668cb5d6a3fb6efb7c49ad

SHA256
f6424030e76c50bda87acb0c21cfd51da8628b32ce81442faf60c402f14a1498

SHA512
47c9f9705692519eff262be7dda65e5edc08323fc68f5e1207a6a6413076c0ed426fe2782e0d8d230d2f8c2e93c3657de7b912ae8daeae4818e477eee6acc88c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63881bfd211ac1582c2b312b74ec2c1b

SHA1
633d056cb7a85b721c778947c7f537eb59b47966

SHA256
3b2cbe3f0ab602015b0dff14caa27e9e76b263a9edbde5049198dada280feca0

SHA512
80271cb5b1aefbdb8e1c8328b0a5f0e8dc844f57a80592475752585243c398b716fa9d3f8aa6156a8bb4e3f2050016a1bf34405ba2d210cf19025667de7070cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b1e4efa353204ba3940dabdabdc55f6

SHA1
6e2c4c9bfac298bf0cb92aeeb268ecf76abae384

SHA256
1a42f31822b578d4e8f4c8d7ecb6d111bc84ed899cc265aeb869d61b7ce824be

SHA512
f522180a96cd008a214cd8ccbc20efe3c9eee785f05de7c380762b243dfaed010616047be62d4cfd9628ec8c2fd0411e24b88020fa1c993bb79a42b6cc7dbe83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa5ed4ba2d0d2d675eee503153e903a2

SHA1
2e0f073edc4fe12e40c5fccba63ca8aa18c0bf2e

SHA256
e48c395f626369013bf41bd5e351f9ca2362526c777d7d98eaf855d463498694

SHA512
78fd1f3627210519421f1aeba84a6011a3f9cb13c3c7b4235a599dc82d2140bf8d0f5c15ab55ec49ebcc48c4f9d13f48676ac0ce97e03e7706ece29ab96605d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4685ccb25e159213e601abf2df0dc209

SHA1
7b1adde407744a237f864e338e0422b490a5520c

SHA256
2804d2ea0a6582ee4f1d10a31aa22a136dd9560e31b93673fd57478a143fa96e

SHA512
32cfb722953a047a247863814956dd74670a148d10c07ffe8ddfc6c7649ba1ae54fde8052d47a8925bc008183b239304b43f7f0639139ec4ec67c127b7f739a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddec55451616430187e376f725057921

SHA1
edeb23059cd5c63ee40652652f9887640261a3b2

SHA256
ae9176e95e740dec3ebb5d9c949f3286d3523d55a402416e452750f0677d3c2b

SHA512
cbb870ce8268a669cb9bea7c56bc06495d00461e126606c8c6fc7f0bada8e3f552989fc39b64d83c307e294dc3eb1093c0057dbd3aa2eaf03dc57fce43844ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75efbc50a0eacde020f4074808bef186

SHA1
0b4d1ee9a94cf1be4472217a2df0d4dae905e50f

SHA256
1e61505ded3f22c3452ee5cc6d114059a930406597b79f717ed3b9602ff6e84c

SHA512
ce57679479afc3bba3ccd796cb98c40420074f393ebb889c0b790cfce2d2460c813b31dde5c87a128141b268427853e2b4e0eaa09bc1fea58184e61e04fc8fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e1c6b52093f79fee90fd91a57b79e99

SHA1
ae8d3c79d75281f7e7813fb123ac3d70afcbf89e

SHA256
a33131f5a8dd4faf7f08128202925f82e8a1f5a7e86b5fd1974c149b4be2b7ec

SHA512
d78d65577fe4d020f3f1c79c08b246b302a97679fd9040cd544896af43acd2c96d0fe42f4d2d7aeaa94046aab0dadd8a34e3811321f208c74a843fb10af32fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a60b9221212564f02b87abbdae8f9a7

SHA1
3526cb7f5974221b1cc66aa3cc05857f170fb203

SHA256
2cd465db615d4a8290349fd605e02185cbace95ae7695b13edf7863eb69fd418

SHA512
83af6a2bec21d6b436c5a75ad8d08092382ed7327ac313de13d460535d08b118b702134db9ca7bf3cd0cdb1e5c19a2ad925faf8297bb1d57bc2ad0a931087a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d641b1f7cfd326e14e3473df8761f79c

SHA1
6bd11332eba209b0e63a0c78c5ce209b0be98f23

SHA256
3e65c797a29325e87bce9e64d0b33a30b60ef071ca1580bd5301b75f05661d20

SHA512
d8b0ddd96e353d8713a87f659857d4eae7c8d64681fbf21b18573949beb0d3bf7cb0dd8e053cc70b5279b8efc0ae005a0e41bcb3eacc81d0569cd1862e10b6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38917fe30bf0375d63fbfa6bd00d313b

SHA1
2afb4a5179418b52645e1399f449ea4d2000824c

SHA256
3febb934e1d9706e2d484f3c0b9806b0c9a32188d1a3e4dfd0f6de6187cef374

SHA512
b49883e7e1537ec07ebda0329fa7700878c413b3fd5c4440a7cbc6ed97997da3ef1a49e45c0c622840692beb5f6462fbc17e42802362ce90099a5e468e890101

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6FE6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7065.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit