989c1db2aa264b97228f9458b08f225c3c85cf991b513826f325224bcaf1ed95

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

188bb2981d05054730fe2ba201208963.html
Size

12KB
MD5

188bb2981d05054730fe2ba201208963
SHA1

48070970fc9bbe142577c283dc53bba4e5b56fe2
SHA256

989c1db2aa264b97228f9458b08f225c3c85cf991b513826f325224bcaf1ed95
SHA512

859b6f1d4cbbeb888dfc0058ec84d33f7e0b1d28038f6ae9debeeab7c245642a6bb7a82af974a30d661eb67f0243859ea1d635f29c7b94f9b7fd8f8454113a12
SSDEEP

192:FMiM38WxWhHUW/H//O4BREtxeGv9fA3W903NltN29Ur9b4EPz98Z+pJ8stT9IGWo:Cin5H/wXg19I82pYPsLjUv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b8f7b4fb87f85a71b10a05d79139f49df2b1fe48543bf378631cc868071a448f000000000e800000000200002000000041b6518f78827798d0fafca4876e3127c10dc863926c2d7c00a536a1e49377a520000000dfb4a05cbeecb75e247542553b0cc7db0a8f9afd27560373d7cfea597c43583140000000b845b590eb0f136adc3ae5b1c502aa9e4db6b791979996ab4c2f2d4ab141cfec922da9f8acc8292d834cf3eb7bfa879fabb33e584c1bfee02c77dbdaf880f8f5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58083BD1-A51C-11EE-B6E5-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0095c7372939da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a9171fcde53d48827de6f01ee19b66bf5f3640951f5c062bfa2014734b9609cb000000000e80000000020000200000006be3faf405db55740a691101039303c72f7080817e5e87f19da5f12df9c4c05f9000000057d7aa9bb109daf52b0faef6db75c4515b3fe2146cf9b7ca4f4f074a59f02cb1177bec0a84f1eb3e3fdfc3d831b6fc32c4dc3da36a967732bdcfc955ed439929e81a606c0722715415a2d2f5e09117169a46df57ff5577122666bfb38af88600e481ffd20c76fbbf7b98965712d74e5adb7f8b0223b3dc39ac43ad60bd019ad00bfd443c80178d610935f5bf349d2c07400000007c60ad480ae98eb52d855b6f1fd0584a0092a95095ae3971422d06d73859a16fc45502b67e3803828e002bfe8495278c128ca736d8e066a0b4269da1fa23453c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409887042"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2356	1996	iexplore.exe	28
PID 1996 wrote to memory of 2356	1996	iexplore.exe	28
PID 1996 wrote to memory of 2356	1996	iexplore.exe	28
PID 1996 wrote to memory of 2356	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\188bb2981d05054730fe2ba201208963.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eadb8b239486de46d73c09d34415d55a

SHA1
4399c9e2d2e876f77b6e93c6bb9514d5ceea4787

SHA256
f8392fe85d0545f4275072c940fe8ed10e5bea789843b47d48cdaae1a8f8f75a

SHA512
77b92984309829147fdf98c16140f45390212322c6c5c423ab837e43e579bd78bf77e78d5a8959dbce0076b9bdf56322a3360ad26e78276d7a167bca1185b206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dcf0ee3f035c5e6189a9e006eb3e704

SHA1
ead20bd3fcfa8669e249ed33ca6b98efd8cf0e3e

SHA256
b06442ccc265df842004b3b041ba8afd827899ab9e61f787842c8fe78dbf705a

SHA512
d94e6f34a38c8786920d48d0ff8a8ba781aba3f3353939048646a7bb822f28e87d2351c091b8d5587c06f1efac1d249aa32501901c71f5a7589f33ee729adafc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
455728204fc002ef25f96532d8f01c68

SHA1
9e9145d2b0e41e22d64901a575eec1be561d3861

SHA256
a50ee3bc6d09c94e1843a17e07f61133450ee5a1ea7a2cf9c586f5ffd1647e45

SHA512
86a5369b2ff37ba5963a8a3ea123d39e60a1bb9b4015bb9e0bc73ce3bf4bd41e423b057dc5c2b33a92f54b9bbbc45b757df15f8bb10b896f1f35e5fbb09332bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36b4018807acde295fa9e30bbefe445

SHA1
d4466a7d0cb8350b527ee8bd7663e6f33c5851cb

SHA256
e387fb764b7c84fb9a6a057e4bc0a6d4b55a317d49ac75fa6bbb55ca0d04fad2

SHA512
d1709d6e79ef8f1686764a04cab1bb58f86b25c77519d112aca05ac989edbdc6820f3692e37f811f1fd4926269b16cfb4c47d355c1607ea2df0db847bc224ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af2c71302a693bc2cbd69d28e2e92c6

SHA1
60b5e5c1c12e0c487671af60129157434f1c1de0

SHA256
d01f57e33bb240691c8bc7e5e8e242393caf17a0d4891695dc72871e620ae9af

SHA512
a90ec04279631ab42175dea628a0662e0cc7c966de3ad5933cd73e42dac4c54e1e85b58b9eb53332c31862edbcf2a2bbefdb177a6bd97222b459adeb3f852bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9104dca0f177ab7e05f6977f61655eaf

SHA1
a16ebd921ff309a59f007744c08d4f7973ccb652

SHA256
00a522e43865cf70b217ea3f0d6609eb8e333c54ef36f9cd94a7c7894c0d8c58

SHA512
9957d02221ce056b8e8f62f207a3ab1d793911348df478f95bbfcffef7b45e6cad79bd3c81c45f7c301eb11f6f07bfc737fc86fabc132849c2181514d8b08150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb1c2b6c5885737f74299b1758433cb

SHA1
f90c5e9e73a8a638bd299642e39290493fd2a067

SHA256
804db1653494602c191838c2e42b2f62408b4abb474bd39e1042a062d8db0de6

SHA512
d8ff70568b37751ccd42d1de9147fcb22e6671b83a820dd72ddda5ae2e65a91c17a38f09db86c84ca83c1cb93889e869db0581fbdd41ea5e6b63d6ae8d28b718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d33c651213d06a16e3c8476a0a900b9

SHA1
69986c0dc72f8c6a53e0361d9bc985f1912fe248

SHA256
58b833b875384e1afd42042eedce65ab9d0c2acc264c3a17e659109af1afc1c8

SHA512
5ce525926f86350e2fb404c309b2d477a7fb8a194c5588394c9c46f8003434870fe62164b6909078c9017b7218c7617de8c1f88172147a448164f7e30a72101f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB78D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB993.tmp

Filesize
128KB

MD5
a34be899401d36f5ef0ed9d1bd4b2ffc

SHA1
49ab851a4c1c36c79895ad5e63078c85e6db4486

SHA256
bec03bf3bfe6a20bed12efe3ba625c1a31df2d8c5e008085de11f76cffe695a8

SHA512
68291fac36f3b7df0166fd7b689c735e220a5b200512eda4e38a6d81255a8d4d7155efa928230453d854277b753c86c02a46d09b73afe1ba842940bcc55c2e2b

Download Submit