0a566ec90604e7f1c71c831a145ca3b8f038c3fac2865d8d42870316b91d5c9a

Analysis

max time kernel
123s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f8b2ad37c0f84c0ae9b2a87a4be7c1f.html
Size

44KB
MD5

2f8b2ad37c0f84c0ae9b2a87a4be7c1f
SHA1

4d4b6dda35db08a4c7806adc6730dabc77ccacd4
SHA256

0a566ec90604e7f1c71c831a145ca3b8f038c3fac2865d8d42870316b91d5c9a
SHA512

3cec6f43f64c80b088adaa09e871485cca65dc2f207e2870bf3113a35b129d0d9fc80733387262b18ff43eeff9b27c7898d80c2db9d3dafe5f2c61fefd39e6f8
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2oh/elg7OvFYEG5k:mZJtr/elg78

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b31ebff239da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B47B8601-A5E5-11EE-9B34-6E556AB52A45} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000020991ad3020343f303ec6d6d82d1d555087eec046be5f06173cf7833201c56d9000000000e8000000002000020000000ec9c39c0de6e911e1b84c8b9ec2ee4a7d567c92e0b2a8bd1089528326306bb8f20000000311009e401ae0403df78caa88e2fc4502b3ec784a5a9670923d802695218282c400000001462080628962e102e8d980c4c41d81bb42b56aa7b96580bbe9cd69ef05e0acf3b1eb5952710a4aada9ee127525fc1d373ec12f1722cd384a8f36cf285f91779	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b392967a392c41fec35b48fd00cdf604f9afd731338359196468195175d85ad8000000000e8000000002000020000000cfe37b9837058d32ca418fe621733d786e0c205a10374a9f4166b2d1f78e88df9000000020f320ab2c5d836a1fa18c364c0dc21d6814035da459e3e4e91b55ab3528e4a6f1b45b42a3c866808a70a1606f99ddb5c6da0a40868a48fd28ba3c54bb225b6ea65e6b5bf124d9367812de5b2faa3ecaf61f24085823313ff0f79153069ab5b31355670614df48552d3fd9cc426f508e322185b4186bee33b5202570ba73f900a280ba888f38b2a14927308a159bcc8540000000ce3c3860c417c6cca79158718dc46b9706057b6f8049bbeb59adbeb7fb65c6a4e90ca0f1233283b8dbe9a7c6de1f04f56b2d143483fde148be5695cfece4f503	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409973541"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f8b2ad37c0f84c0ae9b2a87a4be7c1f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a14099c171d1dfbec60281e108fb331

SHA1
9fc96f0c16db781e5c2e8c62a1191cbb28cbee37

SHA256
77c5b53654ac7ec141e612838bb9029e28a9a278376df25d2afa02fa40d5591b

SHA512
1a11e4e419ac45a6266d01e27e52f46d75d9d1ead3f91ba3281220a0e6c15841708f153c83f69e6c62abb6123b5a867845847031d85f5adaf21e7896cf745e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb759c69ae4d991d5006e1896cf7be0

SHA1
08583b5be37c9457a2d18b961a00caaf20e2f45c

SHA256
ad1ed420a4bb15d866ff8691568c34522e9f19eecd6094a717265e6a2a290467

SHA512
157723e8cc1210fb84a915ceaf96c15c147aefa659c205741629777bc6d16a1be146590aaf6d1818232170ec09dce0de0f1f9ad6df85b22b5826f9d63980eab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b04a6cad899fd4cf350aae1075477f28

SHA1
ef7b2b2f74da01f26b5c02ce705399ba121f6368

SHA256
8be86e9a96352412b90251bbf85abdebf41fd6414cb4744468f3a3b3ac59e4e5

SHA512
cb8f275a0fe3d7d4ebc3e05983bd0f12255f2939348a34f4fa31c415e2f84d1a9943aee345098c3ca94335e20d21d8d8f2de194822cc5e8720470ed93d55d8f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14dd9526c788d8d8d52a5ae9d0453035

SHA1
52166fc7d4465a500178bc5f98e3b8fa11ce05fd

SHA256
ccdea453b6b0433624d69789d5207ba8866c77cb32b3cb0c089545ae9a580427

SHA512
6aee55b0d2ca6af8ca4fdfbcf52ab7ad7a237c3b7b702f8be2aec682f7bd278d99110b77af9c928f3093c1eade462b3664d538cfafbb2c33d59f7509e71d25e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce03205c51b2dd345db5363ecd9b9b2

SHA1
c58e454f7f067d1dd2e22af8e2a747e7dc9369a1

SHA256
7b6861b1b2cd429a54dffbe70003ba5ce37dac57fed16f9b53dce878faab46d3

SHA512
9fdefd8acf981d9435ef177e4c70caaf33e4ac513eba197f1271ba3513a423025861d66078f92f555e83ac1903f5e687a66de0d92c4de1258294d58c35f38e31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
520b24b25995f7f78db13bf19757acef

SHA1
ffb201f607adc7eea50d4cd5377c704c030512fd

SHA256
481c68373e31a27695f664a637a17c25bcdf9985a89a82984b3ceac52375812a

SHA512
b30a49fb6aee5c62ea9b3e679386fb9cdea5cd54dba92685dda78dd194dae783e7a46176985e62d61688c6120b6d240195c60509af8bc20c666320f5a4062a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a135ce41052e0a587a6c090ccd8eb384

SHA1
53d77b4b79dcdaa370198b1f4a6dc49d29d6a68f

SHA256
58aa40d3cd86fd30a75a85ce63cb5ac88d4dec884fa98ea8ffd835d17efeca10

SHA512
f7c49a072ab9c22ddd37594de6083d0561f5536d332f67779164965e28f819bac37e160771247032aebd67a02b42a4971fcee5a6bae5cdde48ca0c5333acce8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1d6b6e468276483dff60fc2961a55dc

SHA1
82b9b1c0acaae90e539bc9a221847dfb589b4c78

SHA256
33e5efe44340c6d189e8d6ec11808462cb8413cd5c48b609a32e0060e7a18f68

SHA512
eeb55f2296ff336ba44d6aac70d1eb8774fd0660e10751b1bc71a879a3553c9f09017d0d3c3fb534c450f0b79db433a0ac7c8add179d36ec9543f696fcdefa41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5175924824797a6fe7b0944ba2876fb

SHA1
8ae7055002f3470cc61122a753cf06d348f5650a

SHA256
58b7431eabf8af0f95b4a4fb81fd513d70c56cc91f74bc483b7f9e2203a79d09

SHA512
06d9cd4d98a34c527b128e53f286d7c915e73786e91ce487a8bd53ba6ade3f6c2ec65d0f5e6da15d8519843c2cebafa0e7b8a0a826863b4b06e056248b942daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90aa17b0eb661d6938a6c4b3650d0cc2

SHA1
ab8bbba48f20e3e109ac394f99086e9b60ccb3eb

SHA256
f19e8eefa95468ba44cef3a3ee704ca28f8342ab4024824056f5e58ab426d072

SHA512
3786450d67059ae18056a4640c7e378dca55459ff8b38432b6309b41aa3f8cf438ebe97f8cde37d21ed81316a3a000fb6d706d08ac2d604e347e351146d5a203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae61fe2aeb004203166e7e0aec5ed7d

SHA1
e9f555ffebcf3ff4603d3bc76e72496594f7727c

SHA256
9249aaf8e85950ed0d42e55196a8c36c1d4ac365fbec444dc55704372efdf082

SHA512
c7e4fbdfc4d409bb4fba05655898972f582c0449a29f21c61fad3f0fad1358e0e6328196aa4fd1e78688d19298c1b9c8d64aa065f98008a542c5c755db206fa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de8db9b558fb76e901d2640341d2f312

SHA1
fe6669d4039ada786066ee0237459af8c4809b99

SHA256
ecfff87b3319e9f383e412f0c369310be3f503b0c8cdd381a2bce6d50d6ccf15

SHA512
9febd8df6c30cb94a413f491cb1e798de44e4477db232af96d297f30d35e9d68ef03bdff7e5af8e1950c74b0f293ea4c9918dc01dbc5d42faa5ec7937e8e7d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ee8cba7c51c7f82902e7edac122de4

SHA1
faf79aa566f58c9c06a355d9921a849da45bdf7b

SHA256
1f2e200630a551c77a5c86ffe9f594989245c18de51dbd14cae028b365b1d73d

SHA512
697c2bac63c361ab861ee53e6e9563b9028e5b8a89c4f60c63c538875992792c5b595f78e984c4d53530d01558d91a3988dde51ccaf9cf01c0049e368758c3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb6f235db1f8fc8eeb58a6e286523247

SHA1
3bdbf1dc2a97fd605d17f1cf46db15b1576f88ca

SHA256
3501d44d42d4d24a2c13a421adfd8573f3812f407ab0ef723b7798c11857edad

SHA512
29f4b315586c4399c5c9f5cbcf2c42867bb5870feccc43cebd50ec4982236fa15b98a760e7ac4fff3955e4fa9a1df40929719c31c45b0617874958ba8301601f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e569d95c857b2f28c0e75416f93373a

SHA1
89d6f610000ded904f59de397467ca50c68e2c03

SHA256
10c953871f52e32143fb7e58d4a30adfa2a7ece439cee26ef04cce277f2d5138

SHA512
712ee026f90c52d8c534fb2eef98323c7e165b610e8d488118ce3513c9da7b7a44661648823e60bf79badbdae0405d5361e4728fe41c8dd9a13b29ee883b3901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
098431db57e356f0dbf8763f49666bda

SHA1
f364b89306a69aa9ac22e2690c422178f9b488ec

SHA256
f7445ba6ee04a1f64e21a8eda33dfb7dbd484e038c2bf503db6172672019afdd

SHA512
d0226aa37e0b0284ea6f59d1f4562680d229fa0a3cdf73b573c9575ad6194a49a7a556e521f1813ebd1fd1746b1c6804622e06fe11e1107b5bee25aeda2f4003

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE32F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF09B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit