58a38b282e0edf8bff0be200668ddf2a68bb8fb9bfa8d123c3920376e81d0e3c

Analysis

max time kernel
141s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bcceb383e04728e87c8a4816cef5c15.html
Size

31KB
MD5

2bcceb383e04728e87c8a4816cef5c15
SHA1

1311dd6b1c146786cafb9f7983a6e181ce1da236
SHA256

58a38b282e0edf8bff0be200668ddf2a68bb8fb9bfa8d123c3920376e81d0e3c
SHA512

a0cc65841978dc96dbed32be4d52b983428fd71b4abad3c14c66b01035ed963f5585b460c227ca94aa7eef10f30d6be859d95d4e91bed669343ffbd0b3e09552
SSDEEP

192:OvfzOsH/9Zg6vruj8gF1da8FvruSydgGvru+obgCkvruzxg6vru3MwoPvru9OwuR:0OeglddkCv63JjLRxYDxZu8BJD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000384165f86b1955706e381ca517ade712e10abb6aa58f1eea3cdd6e05d1c0cc26000000000e8000000002000020000000e32c8e648bcee41870a08114c47e2b241d0e6fa110635860548557cf1535bf2620000000575d367bf0e843a91960338bf4571f3fbe0e02fc7fae658d7e07addf997a2a81400000007f2f77b1a39ac98858676320c09e3f28c04aad8c2d0a4e8b211c1c7cdfb54d23d06ae859af784cbd9d5765e8134af67cda488c0489efd06da0e7a24b7ec9f4d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B06F8B31-A3E0-11EE-8B4A-6E556AB52A45} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504ad2a5ed37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409751466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000008a2b18794146172dcb56c8f2b206600e22b4576d9475fb6801d01cdbaa71d447000000000e800000000200002000000072f28fe2cb9a889d645ccd437be288aa7f3e6e0f95327a355260a13573cdf00c90000000732e8359409d612ed43f75dcceb0bed117de3e01b9ad426c737ac39d66721b98f19c3e81a9f97965d52dbc134a34e2e59d724cd89cd28b8d3183a9cdfdaad54fc78dea12af2164a6dc5efebde93d9b8117a7f3a594b9a855e62c94df42570aca263027b47bcbe1b8f372d57c11b9454c4b0549c375f00bad915fd172ee20d263ac68fb60d130424ac196130d14eee1af40000000983b329c75238f088b3c68b34eb1ea1031eb9b2bb20b76db759fb621d8515465d8435bba70bb797a51e5cbe4c87f1c3fd1a3bccb2ecc04523875158212e7d9fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2280	1972	iexplore.exe	18
PID 1972 wrote to memory of 2280	1972	iexplore.exe	18
PID 1972 wrote to memory of 2280	1972	iexplore.exe	18
PID 1972 wrote to memory of 2280	1972	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bcceb383e04728e87c8a4816cef5c15.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15144d34bf29af9a8d91c8a929827749

SHA1
7ccada69a3602463db39dc34f8ad7a385fdb8bd9

SHA256
2dbff3509e13fef438f7eaa2ec84a4fca0d0950b009b46e4c9a392f35cb09055

SHA512
e9c3013f8e301b4fb12712fe851be0af54665c9fb98b55dfb78bfe0c16745988259b0d54cac78fe5aaf5d611a3130acdb9ac2b436095f6c00ead5a0c5be3e83e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
133c5242a1bade3ee9a451d02530fa8d

SHA1
e1b41ebeced0e6bf0a9d4b9de287effbd6bed528

SHA256
735b8d3bf9a2e5dacf1651757f6ebc466ef90d9043c401a27c0d365516199596

SHA512
7c767131a92363bc26c081b4d141d905ad57a806fb01929fc35846648fd1a931f106b12d90117548cebfbea11ff9bed39952382a501988cd708a021bd7a5e959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d00ca9f1d5ab5da15eb46730affdf37f

SHA1
ab473ef2eed9b9d412b65eeff5ad9bce18568a51

SHA256
4067442413b8079b09de418db4cefdbd52fe8294ecb42de582c02728e55c961a

SHA512
6bfa0d0e225bf302670fa8ef6119895d290225d84bb14616aa6604877d27da7ce76597cf0bbe54ca1fb78b1bea9d41d03795ab485683cbbf14eae25eb144e8ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cf60419db4c440f54361fcf877479ca

SHA1
8950fefa9c65a9c29ec13ce6993d35538bf8ed29

SHA256
ab0e8751afef92936e182dfc4e93a61ab5bc6e9cfaecef34400d974686d4128b

SHA512
541db2115ded644f0c9f00143269a658231a17a33d776fd1b07c1b6d92cde65b6f75ea17268fb343b9604512678d9ef97f02a5a70e04fca2c02e26e821366576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40eb29416c4af7f983ac3df439e9d31d

SHA1
1d73a7fb167fbf188ac4b4081d2062663c4b3746

SHA256
c980f7ef8c3664ab94e3fd63f191cc3a7997a35e53534e2f45927c2990b4f558

SHA512
37aa56f643d098c03b1270033421bbb92c56477a8b0d5cac36b2efa7b6b41b732e7b7682c566277721123ea1697cbe0dcda6f6f9c1b18197af191b2970646fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b40b02f19c0ff96da97dbd76e288564

SHA1
b640477d8b447ceab9592c12b69abd3e001905be

SHA256
7249cdf8593ed56b5b4a2ff4c4f53a68439d0a3cf9e2cdf47b030945b3c0c710

SHA512
43544b2876ca9006de530fb3c2c5883a60b671ae50dab9a6e063f8a00258150fc0fa9873e4da438d014c9dc105538f59a40e4ddd7e60913b1cf9072ba89f06a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f5c2ae85c7cfd8ecfd823641134785

SHA1
683077071fef537f77fe0c61da0e1728a364a01c

SHA256
12bd5e18b1534391a937b065289bc996ee0d2dd54130b8ab2defdabacab1d211

SHA512
63f19c1a2697379f91161fedcc054071a09b01091143c4bb8a9c768e195323edb6b0cf980351f018b627468f064815219fbd5e84b12551dbca69bbd2cbf84a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72071f5598a05c8c11bae85a6ff60745

SHA1
2763627452bcc76e8a6ef14c3525ad212f64c6d2

SHA256
799ab7c1ce77e468f4c215db17d02cb75d8bac2e88d7d01895e0297c50b3761c

SHA512
2342c94b80204e9a8ea10d330c5c46d36528648a10ad8f9a2a2590ed5a8a26cc1615aeded8b2023230a63385651677d5afcf6ec88336eadcedeafc304cdd2e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b0a945fb872eae512a23f40b4d958b0

SHA1
b96574c22aa8f54d772259deafc201ea5c025296

SHA256
4eb17ae3378f17ab04f499b802b717fdb8abb6163e414a761d78c77049f183db

SHA512
50fffb47217aec68470432d1fbcb14e561ec4c64e6b273c06cfe8109e8f118933dad9975decb660edaf64214afa81dfbbd24504fa31e56e14f6a7dd8b6ec1645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0047bb887b72a51b67c1821de3112756

SHA1
9db38979d942f270a4ac8c63489bb45d84f8f39e

SHA256
fdc8e2d78d54114ae0ad30998cb38d4b7dadf20ed55df9d2c60e2dd8f3015578

SHA512
f60f801e4bdec8efdb01843b373ca23afec8a3b67f49605990d3c76c9b26df7613c576bd34c92effb154029cb34f7aeb73ccb0acdf7dfce87c34825802ceb51c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab627C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar68A8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit