ddb97401ef33e9dc84f6f6c586b102b93f3ca44cb0da5479da4498bd2d3156f5

Analysis

max time kernel
126s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33049878cc441a61801df4cc36f5fab4.html
Size

3.5MB
MD5

33049878cc441a61801df4cc36f5fab4
SHA1

e92f2ab9a702c3115d2ebb106df4adcf1c421f72
SHA256

ddb97401ef33e9dc84f6f6c586b102b93f3ca44cb0da5479da4498bd2d3156f5
SHA512

bade8d8e5b7e63f73012e027739ba6a5a7fb7f82394bf0da7cc545f5d503f03a215040e68f1d0c7dede6d495ead8c5084612bf75857f0f27a0c2afde8597de7a
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfv:ovpjte4tT6Nv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409765390"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004952340b4c47508a0e40fa2ec2526b281d34e687b6dbfda6b78ec9d8922430b5000000000e8000000002000020000000980a68e3a27d614183b899db8769aab6611344fd28ced5f6bad0f8fb1459a1a32000000003ffc76dc5d605f9c0fc636b309bf814a23fe07085936ee871e6e2838e8c9a5040000000fa2d62977378ff1e9e7d67163ff32ff730416847c92441ed1129ae5c06a9299584515a79d8210e865659f926c28c6033c43abc198726cf6519252255047aee4b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004d77f06e984b73e19fbfeb420a810be63569cfb0ade56b30c6e039af32e06024000000000e80000000020000200000007bca12fd74eb3eec3e6aaab8d65a5ac934d93c75eb4a48fe2dc68c858da1d55990000000bf51868b28bbfb7995e5e6016a0f990098c1b554cf8042f4d9f3fd365a7b5188719c603d586de28c4980d92646e5514e222baca6b982b0991d22d19b5a9d6d2811b8610a16fbf72636f6505374e7424bef7187e21b87492b97fc7b13845a075bbfb922b60c395bf49b01fd393590d2eddd0b3d419b2fe2754126fac1d5b09fbff2fd86ff60ada7a43b215fce647caffc40000000b478a04b19ceb998fa71a4e4729a593707fb44440769adf2782250d3161e8b946fd82ca2afa136a6f65191d81996a8511f74cd6188303e8fe6d7b67251bb6492	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D29D761-A401-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05681f70d38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33049878cc441a61801df4cc36f5fab4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f366a016dbbb7fabc421f7344a02a8

SHA1
efd8d5778e9f70249922ac70bbf138087474f6de

SHA256
36a64e81ffe634698bc23fa1acce5a672eda5a829505c8cf1224a2a4a06b7037

SHA512
4b2954d1e5c88019fe91a838d7c10eb5ab30dfae4447e27d6ffbdbbac747a403c7423ab7972dd81709eb10871d02ac106c63dfd13670535b4618db6cdcdec0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4105c31fddaa7385d55481c905cbf640

SHA1
90bdbe42d5ef1a692e4eb284a566cba4545a78e4

SHA256
0f126d5a69a56a81df33b7ee617f920c52c8c4b6ae2e18833e3359abc831edbd

SHA512
a87137fc8e432a0665d8711ee2897e3626380277183909fd43121a2f731717d6ad4c2160e0e964c39427e50976498e33e92eaff820c3f92dc12e75e7d6ed0f53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e26629a73f1fc7e98ed0a1691a518d

SHA1
81ae7a26d460514c8caf2ce8320e4f85b9279245

SHA256
0bb2a7814de0eea53a8900d8a684a811c218c3e5e7f10c5b27ce2a7b792b298a

SHA512
2c75aa7351481cd2ae7f105b395f6e10d8e416caa5b2a7d3941c9fbbac683bb21bfcc861e79e6985d548fb0e0881a9bf7165ccf8be068e51488f8c66c61206d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb9b49f94eb5b2b9b49d2781ed192d32

SHA1
2d81f3463c935cbfef18cf3b6363796300e4e481

SHA256
e9b89cf64843caa52229d277f8a24125f750e9f210f6e201619158c0dc6144b9

SHA512
53801178a8dfdaffcebe4af097984442ba74d2c5212c7a340fc3ef7c310fd6503411c4236868cbcc3a7589eee5b474d422f3f0202c31f911593b95f89b936c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec0e999d8e51c5342da76cea44981144

SHA1
534445a0f2789ab7c728dd31808dfc5e81bf1ec8

SHA256
fb9aa690c15b5c03aa1c3533745cc7b5a9fa673237e134bc15164e1b51e823c2

SHA512
4c388182cf6023f348246d85eddf16867ad35404cca8583796c4bf9de19fc6f10c163088eabecc0649a4cf06d1519154710a19505ad1d5b6254c3d7cd75c4908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea5f5f72db93ae8d7d32b1aeb99ea91

SHA1
5472d3f2bea1ea3ddcbc485f40306601d7b6f162

SHA256
e8949d97944963f520c77be9d87fcd28914c83327c84716a17f7c629748bd36b

SHA512
64bfc3e9a9404f05c5b6c0533cfe39745b97bf2bc7067608484c74e81c738747637ab77b0c742ae9f4240c0704245ff6378e58a93a421a50d26cf79b877d401f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c26d156da250fbe1c3ada16237ddfc

SHA1
4cc78bf79f3c2f4e1ebbfcdd2d05b5b65d2d1b29

SHA256
092b8309a82bbbd2be3ee290d0f7e1693be53961487e093f4ec96a9c24a31f82

SHA512
606cf19c146c98bf3badefcff2f7033fe8904b6fcc64f1105e377fec315519a9b2e9caebb62532ce8bd577219430c997990a50d732d3ecde460e4dd17df96843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35f384dcc3145b0ee211639bb159c620

SHA1
b4ce7435f13fa17c67ae992272268d58b9ae1251

SHA256
bef40649f3908ffe1b6fd29d25d83995ca10e3a3a4bb88368d2f0a376ced6c39

SHA512
ad77cc27b839bfb7926c52a3823192fb0f2412e79e8c366bd6c6d22a5cbfdb0cce95483223412cb362d76b3a7169bab5d98570c65f640bf81441cb1378cc7380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37115589c888aece7ba9a62faf71266d

SHA1
2297295ac4dd5c92b44d402ac087a5bbedf126dd

SHA256
5c614ad9cdca12897fccd9cc0da7fd010137b26665c00637a4dd30f29a7afa1c

SHA512
b5469e3d5399ade755a70ed1d5889e83bd4ae4a8dbbd39d069869c77b9ad2002602649cc5327bc75542a4e866d12dbfde8017140b9d85a51fe8e4f59aa934c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6269d119d329f45030cbde1a808b26b

SHA1
5012a5926e37b8a9e857d5e578fd46eee4b983bf

SHA256
ce278eeea918738d8c67fb5fc4087b53594704f2f38d90709ff7283c174c17d5

SHA512
abaf6c60bae5ffc799c7cb1a1a8c82e31c629478905b8b3c514bceba879252671c0679b997cad18a114b227bd4882f6ce69dfe97743d4de7012cf695a58bd2dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb48bee9b843595baed20af670c0fe1f

SHA1
526feb231919c9097bb7c2a87b6823844d45551a

SHA256
1792276ad994151e30d4a0665d083006bd6d3ae2efd152fc3ed4006e72ab05eb

SHA512
0436b3090f1b5118925de1d1da3da47da665f51dfda32edb7fd1ef65aa0e68d36cbaa5a06cb62c15dd9fd9336aff4452a6b667eed13a230a380fc5ef1494fb71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04a43d56c3e2dc6c20666e8860996302

SHA1
cb9ec5e55af591c6d72eaacd46f01f053780c831

SHA256
a869fd7a5f1c29a1e3e8edd5e6a875639c4eb122091415904bd201e2a951a0fb

SHA512
88918f99afa2962210c0ae7874f45504f696241368670018ccf998ab09d69d203733d0290ea45fca245b16a96cd1d314ab4b7ca3f6e373caef6487640b32a057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c37e5594f8bd0670f6b3eae30bf0e0e

SHA1
49b5842951858a365ff6d9f10143ea138f5d8c78

SHA256
ccf9e6faee52c6f6ee7403c9eb8dccabd33db4eb74f7c4127265c4b68054d7d4

SHA512
75bd8a1cb0878d52f98a4977fe896173472f258184d7fb86981fab136ac13dceaa170ed823a16b4aa860a522dea4dc571c359304f3cd8ee5b52739870ff7b643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc93a0356cd7a6b9dff63d9f856a86a

SHA1
750ae284f7ec58048272125945cd88c33ebdcc8f

SHA256
b2f66d962207703490a8663cf7cccd2a6b9132c0a462fdaeb6585ea6ffa25829

SHA512
16a20c28bfb957578f107545fce13e50242f40c72c29ee2c92059e6ede63d7f075a5aab9ffb80ede0efaad88aa637c0629c61a0bb348243a2ab6146c5b3ed497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec328ee4f68e540e90cc9d0ca790e1e7

SHA1
bcdda2a0815864f9a9d113095c84ece54f94d2e7

SHA256
bd1dbc6962832ccd2d4afba4a8a6ebe90755c8a5910535cbec7806ae65716a34

SHA512
5e0f48b99b932a082d7d5794ba3a4fa5a7857f8a8413d50d6c99224c3040dc5e1726baf11707f4335b91644cb31e160a323ce396df8a6606b44c78000f7b6670

Download Submit