4850e8a244de7eaf88f4ee6c85f361c633c59241ab999d8bbfea31a99722d9b2

Analysis

max time kernel
122s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

228f2b57959ad0e7444e793c75e1d80f.html
Size

78KB
MD5

228f2b57959ad0e7444e793c75e1d80f
SHA1

669c9ffcb623a2e0c1d90a8f0e37c707c175f6d4
SHA256

4850e8a244de7eaf88f4ee6c85f361c633c59241ab999d8bbfea31a99722d9b2
SHA512

e7a26a75e72eb145911d94fa0027a352dd4d73b9215018b3a8c04b6016136b3301f6ea34e45c37f6407dde90302eabd5caef9e3c999df847136270fa5774d575
SSDEEP

1536:7vK++8FU4IKxFrOK3Zl1BGKCOptCcptldNujL82Q7XOj:7vK++47rhB9CyHxXa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fbbcb3c637da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409734792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000ab113532b53f505cef05398fb2c563fac16b0a04491472f33d5232fa4d4245d000000000e8000000002000020000000b8dc0d3eac05cf75d8f3b974fe1ee725a85703c970f3ad8157888930097f205c90000000cbc9bba1598b2a4c63f83c851d360cec521a35823386415ffdfb9739196a538651181f2888342568db7933535f210ad6099762caac3a8687c57f247aea1cd59513c6a74c7a55947772e9a2982c5c9db7e8370f3ad9ea9ee42ebe456038da295df498d8aa68cab08f09b929cf684176075f5f24b91913fdaa7a84eb6fca4f14ee360f1e771653df757dd7b5dcb8822d3940000000ff350aafa723796e6abcf4025f71fb6df4c7de77f64fbe725286e2b4c355fe1a38d838a62ff0d0ca80ae751d3cbc96546d8c6406781a79f6e41da6b8c5a96eee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bd7bdfd4e5030e091ad1f23ce329b94118c6315674c62e1a66e9b7239a4252f7000000000e8000000002000020000000bbe5ace555126c27401baa6900a121707b317b95ec5046f03bddabfd0625bd3b200000004d1d63c080ae0a1491731333b7f3a5dc011fd6d2ddb4e95fa003910eab4d85d040000000294117e88bf0103ef59cceb806005b9869671ab30c10ad1c9aabece765830557c05cbe10244f0ef250ec6298a61206ca779bfb233d2778e97b8935ecb64e4c6c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE267E71-A3B9-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1404	3040	iexplore.exe	28
PID 3040 wrote to memory of 1404	3040	iexplore.exe	28
PID 3040 wrote to memory of 1404	3040	iexplore.exe	28
PID 3040 wrote to memory of 1404	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\228f2b57959ad0e7444e793c75e1d80f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7aec9c28164c02488bff97f7120b184

SHA1
b634b431e29472c0b021755acb47c784a58f8b17

SHA256
02637a0cf985f0a61d662e8d9d40e6808d9de0c95933aacb52b03c46408906a2

SHA512
2f24c67f463290e0242565cdd3ba65ffd651add83091e7928026999e170ffb592c97e2267018882fc3b32e203dec471439969476510b18676438f6b4a01790c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdc09a8b0e4a88ac9e9a076e38dc0efc

SHA1
4a47731905303e7ac8368e0ba7204ef22ab0d424

SHA256
a2eeadfa0a96f1d003d437bf8dadd61111c2cb746c5fa66cb203283ce5d2853b

SHA512
661f9a557e1211b5d2475b4da8f1e81094238f3b7c5417218fde8632a23ee4ccf2171afa08ba1ca2cd581673a0fa119b9e3e1f10b374aeaf9cd65a7fe8a63ecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29dd2720ce96b488dc3b9b525021d653

SHA1
ef222a4a2ad977a331dc05a2763fded5b75b5265

SHA256
d9781feab3bcef1420519332abc16e04500df55d07c70c7539bbffbcf543cc61

SHA512
1e0d505b123a2307254907e83432c5df36f9ef1feac6dc3e3222e7a70b52d8fcc737a8c3f8167e6cf7064f82a545a40b234419f2af7ce28e012ce0ad12d75760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25a05246995cc2cfcc7b1668e3eef27e

SHA1
e2a7e8003b32f049b38274a4c6ea28b92d548bd0

SHA256
a95ef90b7228a5139c6291040b593ff1f4ccb1c9a3784517f09fd889d6a3c6ff

SHA512
d21bc73a7953cf48b06b6098583b983011168d2208f431b2f5f2d7e7566e2b433cca658f27891239b8263dd580e50a8912b4de7784d64e793bd0cbb6cf897692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b193e503db54dd42e744c8c6e43d9c2d

SHA1
2838824bc27c6f1291f7989478aafdfd39d024a6

SHA256
5d31159bd6f67ef8a8a6072d391a03b15d2c925cdde65c2128a9de7f5f2c9473

SHA512
19eb9ff891727b233bf041b2b04434960912b3137bb8ae90f8a670ac225ac7fbb616dc3fe675993bf2cb217559c6b351e8eb524ca1ca38c2e0b4e5189c06006b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79dfa45da9139ecf33732bc45e665a20

SHA1
5d797fb30090f40a1bedb48b1d399b5762243bba

SHA256
da45b0e181efd1d9654fa661a7a6e119c192687b37e4bee1048cbe69d4179c89

SHA512
102ceaa6ec44a4bff26f1940e3a29b411b20d90d5bd3371a60ae50b64b59184d98f415fa270972c6dcec06c101b0f0caeb1ee6dcaee19f17f8469da44f8db932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b74f078182f4d90ab896cfafbfdccfa

SHA1
2c4e1cc61a1b51ee08a0d202c05430586cc8acf7

SHA256
58883c84b82ced2fb2d36e8ae909876bc18ecc55fe6b6d702b0021a4ee82e287

SHA512
e52ab141218aa0ab1c04e55135d27b4ee27689ff38e76aba2c2b78680f4c6e5f9eae2376f6040320cfb1d52b732ddd33a1477c8efa94e50e769bec6a9c19e7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBAD8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD494.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit