dd2d9b9d156e3efe7f0ec9999a8f7abcc36624c946cc76c9be5cadfaaaffa8bd

Analysis

max time kernel
110s
max time network
205s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

300400163a7d662922829e91a6a6ddc6.html
Size

11KB
MD5

300400163a7d662922829e91a6a6ddc6
SHA1

49de3146e144ef3def7e64f0ba5c229cfd74ebe2
SHA256

dd2d9b9d156e3efe7f0ec9999a8f7abcc36624c946cc76c9be5cadfaaaffa8bd
SHA512

9ecd7c4334a75b968ee7fa7412d6d065e1fff0ac83872c8cb39f0504f722a7c43f214e96c960f9f4d3a51b556026a973afb528d95763f9bee6032b5d71e20dc9
SSDEEP

192:i+fBF+9bHUKEuP9blL67lRvyxr8cYKiQ2VkOOXD1KYtDXpyeYqXEB:mpES0rvGrcKiQWkOwoSvYqXA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0138ed3f739da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b1fd6a0c54b655bea00c7521cf85929641e46502fb18396cbded57a1bc68c00e000000000e80000000020000200000005bf6e8c1edac86c8011279c602ea8d1803af21d4babe45c51cd6e1f2c092cd7b900000001cbe2059be524eda26721b5dffcb7ca99d4bdbcbc1da43e070ee4f363754037e5430ba608f37e3748af6109ec40084fb094e646ab530ef48310d8d2e05b89bff3ccd073912a481251291d14d7ac93d0ae816b656210a93daaf4f905eb51ab070386388471c9fa439c08dd80613a00361c627e12238d47c57b7229dfd143ad554210a14e24a97399c6716e475ea52af1c4000000027dd3ac95ecc7cb93cd6876821dac91f1fe21d067b2be5c15e177353ff6cdf692639c924791726136dc54e7dfffea496c2382cc7f3a04dd78d7274afbfd76765	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE379591-A5EA-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409975794"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000932e8615570737534d945e44bb0fda34d137553c733d74d8a9c2a8a7d75dd764000000000e800000000200002000000089221fa473f09c7391d86000f306ad0728bc774a7360a84b616986366a4efcc62000000065ded0395761fcc1c38c463af78031822ea7f9c569ce109b33a2c30240911a5540000000605514cd2a202fe454dea03b2eb17feccc4f2feb2953e6592880b21415ec8027742a6843997532caa71a9724e6c69d1c4d540fad72546bc25dc4715875ee7158	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2596	2580	iexplore.exe	30
PID 2580 wrote to memory of 2596	2580	iexplore.exe	30
PID 2580 wrote to memory of 2596	2580	iexplore.exe	30
PID 2580 wrote to memory of 2596	2580	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\300400163a7d662922829e91a6a6ddc6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d9540bc92ab09d5cd6b63f6e6e6a11

SHA1
e22f9949c6f33bc9c67195181dc602ba7033c9f5

SHA256
409d0971887910f64eb4feb4786a1296ffe5881739f2a75ecc3cb2f62ccb9fb5

SHA512
20c3dadf334984d27f3ce90e15baff4cfe906918ba94be378bc96bc6dc517961debe07436085f41a149d52c63637619b632f6d822dead653f9b918d3973fb361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e5bfba23d2608be4f1ef1832011465b

SHA1
9fbac680d309c99a5b9bbfde31caca7723e1e272

SHA256
f62baf99781d34a517472d49fc942aa42cc180580c65b19a931d15fc7dbe3fb5

SHA512
2432c2cf79db1c60d84f9c69a74d4c7a2affded732f86bf7bff43549c5d3388d13e359fb29665cd071fc200539fcf25e0b10b3dd8062db0931d77a74d545040a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79a97d69af6a4504a4ada1de4f95bacd

SHA1
44e5a4cc531b1c565c36101a729dfa0f0fc2c623

SHA256
380a468cc668518bdf02e67800b067f3956687dd4621386833d0b4f03fa27d48

SHA512
a2b6a7a29af9fe90a94c4fe119a5497588ca95ead3aaedf7fddcf9fb83f54da02bbc0ebd04ead0ec1a41737b232fcaf4b4819911642f671a99f975d1275bc5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d43283fffc2b82b52753cda2b9b4f422

SHA1
229e51198e826734ee3f3515358bd46b05e806f4

SHA256
16ccd09c41e899ffcae4f618da33262b9b991ddbbb72d0f1ed5c080fef8cad9a

SHA512
ff33610d83f1561d6da00838c857aa31a989f974bcf0d7036e3a83f5c7a383a6bf95772595588326c173ce0456f5fedc33bc3ff49066ccd6f916532709a81c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3bc87ea838ae53fd989f6e43cfe5dc9

SHA1
56327e542f03d3f4bf9b9789010c09330e3ec30c

SHA256
6e4d22d74089b50f7d439a918e5e3553279feadf6faf92032eaca4149db16382

SHA512
99a2248c832a1292e53f49fbe344889504bd0dedc6d18ec97f22b6f84dfe026b223345821beba3b179c1aaf6be48a95c42567cf40e491acaeea0054cb21c8663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
425048d706368736eed1ce1ce70d1e11

SHA1
8c9b8f5faa9f80ca12251f451a66104131eb8345

SHA256
74121ce0aad1b12b5a6ec9bd1ea32970b439cd030b92037e409514d0e402320a

SHA512
5eabb05831c51e4af33184b64a543fa3b25dd0a152828fb02bc0b6946e3de7d9318882e6e4bc1da7b714fbc9a64c44679e0877f239645c4d9ef0b8a9681fb139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fd3acf0e93ecc7130fb7655fc1e5cf1

SHA1
f6aaea0c837416bafd30e7291d233ced0ba45498

SHA256
cc708dfd9f826a1fe90207259d11c658006557ed2d26bdab7a7f4bce0d9a434f

SHA512
abb7585a9c43dcd1ed937e405245744ca4a56a1c0bc7b0a4d37f6b691d5d7ba6a74fd9937ea4d185d8c2f4157f71530dd92830c393ac7a5f23e0d2edf6d1bc17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb93123dd60f747b7dbb3a6d8b58acb4

SHA1
24706b17d646d5870e89c43c4ba90f074da48f3a

SHA256
0e97d714e627e1ef87c0c85a93d549a74428c90f734bc03cd288928e323e80d1

SHA512
5130ebdcd3ce5792166193f07c99d20b15dff660aa3d45a9802bda3170c4c7116934d62f7ca5021e4941b6af5a66e0b3d1097158d36b6ed39a7f712fdbeeac8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a6f650011eed289016af0186bfe0b2a

SHA1
083727f63f59dc659d66e8151431382d1565188b

SHA256
a2bce078a0635823133160701460f39be0e023eb1ab5e02f52113c4e9409fd2e

SHA512
d1fc13df18007892b64fcce29f4fd2b6c28d4c726c384db0841239339a0e9d2c544ff7cf253bd7955a5e6fb31c595eab5dd2ae2eb4c9f7cc179241a25c255eb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B3C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar684B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit