02be12765b2c9ce4cccd52faed470d7298cae25b5358ca68cf98117f75054d56

Analysis

max time kernel
139s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca2826ffe0678b83095190161e4199f.html
Size

254B
MD5

2ca2826ffe0678b83095190161e4199f
SHA1

42c0d4d0323b201cd24503408db979810cbf74a6
SHA256

02be12765b2c9ce4cccd52faed470d7298cae25b5358ca68cf98117f75054d56
SHA512

29468ff93c5b96c38cdc7b837a09ead9058a8b91028bb82e2a18bade652b425a64dd67fc7584314404c18e5a2aa710947e5110dc52f3aaa499450ab35cfe7bee

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409963109"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000053523397ff5809688152acfd103a4b0ea7444f7d2373e19fd916da1a17bca304000000000e80000000020000200000004cede5aa61b4b609c69e13b539fb63093b728942bf7027d9d86fe0ae1fe4a8d2200000008cc0668408ee16328ad4e299b72c46189eb488f87b389f55370719188b4cf41f400000007e4b8c15f30c5a68608b84b733f0a126905d4e4a30a7a27f768d9f6c230d90deb22dad00383767a9a71ddd606c34d23bfd8376e68a302dbc77bc2f4fc5b73942	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a057c74bda39da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{768EC1D1-A5CD-11EE-8427-464D43A133DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a119b589cfdebf841a26be0120109cfcfa332e1eacff213a77ae2653983f15f8000000000e8000000002000020000000ab7a1a7ba49bfbfc075e387740e68d1a11ef40bfed71d56d9a4cab90f769450590000000372e6af5ed2d47b0640bd63afb077c0d9eca8c6fd357d08200f01c464575f0fd6c9de1412ffd1a163fe091cbb69cbab0ea9b5bfeefc34d93188200fd3fa8e99d457a62ab773a3141755783e29ef646e5cd6ab1593771bae4d574cf20ac33a65eb789379d7122ee188fa5887974fd4583c821e3969cfd5a650d70778ebefc6e8bf5a45b9067e932a39b84c694bec6dced40000000640fef36135f9a8a6a5f6633f2dd63c80189f7912aa361fdc3b9b5471330c0750188857c2fa18f7ba812b512f28af781fe94a0b6820d433826d098d811fb626e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1976	3000	iexplore.exe	28
PID 3000 wrote to memory of 1976	3000	iexplore.exe	28
PID 3000 wrote to memory of 1976	3000	iexplore.exe	28
PID 3000 wrote to memory of 1976	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ca2826ffe0678b83095190161e4199f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29dbd86b6530635e3b682b0603f4ee9f

SHA1
4dc9869690cd6c1860690657785cde30b2c2213c

SHA256
a9f244e9e158e13757188bdb7159fff97c47528268eac67391099dd75b54f057

SHA512
c9f3fbd7a619aa465165a5b73103f81af054146c09bc2a31c65a257f5a3bf7719787ba90eb524ad86fcbd2a79a4908b9931fd35b16f6db924b8a6f4072493b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c46d0b1729a46d689bc54caccfd80f5

SHA1
20d1f0e71f8618201b56260141550d2480b2eb12

SHA256
11c9c9044be536749e6a01ae5d74cfdfdced7fab0ea757f2d5b7e246b450f0d5

SHA512
debb3ed2f1021907b57d91330e5b08ce2c758d92578342fe87a5e8158afa7200b25de8452d378051fd4dbc36e9a8ceb84456f83ae2b5dccaa2386ebf59bee5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba08f9f6c1e78539689681fdafc0b3f

SHA1
445fcb7fd1ab4ea8922295ad066fff3e0d6e2003

SHA256
c2bbb04c4c94efa49cf9a54361fa82eed9a2fe8604f9eec46aee05e3633f6666

SHA512
f512f8bcf072dbbc3282f9c11535a9ce729fb1f696e5396c6109960c306c04b54c2ccda4663e0dd0aea4b0a3fd47462c94cbe1246b2747a26dad4064435e1e8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c1ef8080e1bf62515d9597b24527ee7

SHA1
0f4bf6b54378ef691b8748010ec0c6a100668601

SHA256
a6dfddff5e9482301d2f4dcb329c10bcebefded34fd27829b70e181e9d1ee4bc

SHA512
a95cc1da700297b80c8f1b757e6417e4019da333c99e439870d61b7e9cfef62b032b32f161427ca27a1a4381639d628326c911f31f0d507b6939aef44fe1cc39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2caed27b113e6e5406150cc99bd3b678

SHA1
930d19cb7d98908bc027fa68bc85c5800d0d6066

SHA256
bff70e3fd6952c0255b82f0832b5581ec82c848c05f995c0b6e61421012c08a9

SHA512
47afb621e4e730db885ee8b57347154f6f4d6c0b97e0e38f704e26a9758e4953f39ded6d9fa739fb5b613f932fbb46a13a2850d6c1360081f215883e6d2030d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d4ed6faca8973e19885f164617216ee

SHA1
9e8f16341401bac6b190b05ad086039d6845c50b

SHA256
c68feff19b21301e57faa2d4f226244397e22cff331ae897986823ec75e930ff

SHA512
d8a32578d4c03801de88ffd1d418da69d4ad75b92bf80f082a11b4da7f808f53ab8fa3e01cdf2aca5287265852cebfc2449c4fbbd8cb9c9e94be752e884df953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4540a71a4ba21ac42fc0c89b22a34c49

SHA1
dcfa42c731630d53ca745d05b11a264e4148144c

SHA256
bb0ab81d1697040a7f7bffd610a7e456845d7a7232045d4eaab4be2431a7d373

SHA512
3f88527922af6177cd01b8f7599a6bb11368e27b10a0093464700822fdafd4d3adc3683cc9597fa849b5d6f65743e382902c1d5bfc33d410c84836a79e981db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabaa788c6df527634ca466139205d8b

SHA1
947e42e8698e332a523c224832aab5e506faf58e

SHA256
80e751166d15105df2331432633fa4c82ef89300a693607006550ae07855aa2b

SHA512
11c8d111c82abb96b765f028d1c13b81fe2dcf26ee762ad66aee9d0eb89e6f067506506aab2cc04ebaf30c78f66b40f408b69f95c8485931443f0bf4adab0e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f00695fceafa704b0a77ea3e0b00c972

SHA1
7b45ae0f35b17068c21054dc65120812ffd15d63

SHA256
c576707fc02b0790091441e707b5b1098280b85e97ee4f4d3967b42b93328256

SHA512
e96e87c55c324a8361136ee0c9bdfe57e974a1ed89e6abceec93dd962516a7210516436def936ddad889177bd94ebbfb4228ac869579695e93ab13dcdda83f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dfc8adb07431dfde91be06e66a240ff

SHA1
78ed9eb1be2060cc9a24b4e0470ca2f174ef0782

SHA256
f349f8d92f1e24d9b799753972dd0299160771f00a5bbbbe436446a5b45af5a1

SHA512
b0db61dd7362d02b1fe57f65d6442f573813141b488ce455460e2a38abcc9c1250e890629f03b0c184039a8479b300ea5ed80fa06b9f4c3ec2ecb213086da995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
907b8cee5c3e35319d3bc1eee5e21062

SHA1
0265dd7faddd940583b007bef617fe7963131fb5

SHA256
97cb4c24569684d450c3a825e2b630368b2caca77abe609cf9fd65970d71349f

SHA512
33ac7d60f6afaba192389f9418e4faa7b17a74693a185f26915c5eaf9d13c4739f3b42d75d4dd84fd828aec9a796ce8bafd10c63ed1f4ae5789daffc978d2c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA95C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA99E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit