a50d164ea5574116e6f891ebb966225765f73e51d201c677875ede71e3182b7d

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

356b1c9aa8f8e2bb94ae21aaf6bd159d.html
Size

31KB
MD5

356b1c9aa8f8e2bb94ae21aaf6bd159d
SHA1

22b817903c3f4c6e10b7fa5531596473b3ebf2a0
SHA256

a50d164ea5574116e6f891ebb966225765f73e51d201c677875ede71e3182b7d
SHA512

932c5827ed2e50e5a066142dc49914e0d1d5588f75e0d4353b11a7c10c966b3d44128bbbd39b6f3f45997082d7bdbdbb0367762fa0f0c2617d2a3048ca5bec37
SSDEEP

384:Sz9hj+sxPcCaHKXceMzdzGg8WZzYtELanHMtuI9W4peikf4Cr9CIp:SLj+THKXcesdzH8/tfHUgTp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005b70df76bf6c54ec5b84ae424cb98b7a6d0b25e2d5341b1ab7abfcc03373c696000000000e800000000200002000000024da5521f8beaf28456bb9924cfba1e8f69365575a353a18d9822c2fbb9229ba200000007074305774be061e7b5b55698dc80fa60c2a008056d4e03735047cfb50908b7640000000f318ac111fd64d107a27d867341d77702556c84b4f61a19fd344b912f196f63662a307f39215a29d6ce68be53c9ff1c9c619266348b1779fdea0ad5fcce7b9e4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000cb84c649290cead0833e3d042bc963813f15aedd4532ebe5be5072fdb8cce218000000000e8000000002000020000000bfec0d9537acfac2dfdb8fc27cd99b91c96d71700f130d5d2be7bb1eac2ca7cf9000000093a25e293feee73fc2761d21593bee95173effc98c96ddcf8eaac5a81be36988762359ebc195f143e58d76896e7aff3a38bdabc9caa787b77bc835eb7d87d5f0d0ba12fcee218731b0043888c39df966b32cb3ab3fb94eef6b562336543ccf5b6c1ff687911f29e855d98214b050c14fcede12ef52b12cc7c337a8235426318f5a2e6935c82c8d86da599734a9b9e02f4000000012f059a1837f10b72a55ee20a0ffd2d26036fb9f5dd14bbd056b08044bcbb33ae75cb1bfbf14777cb2a73ea81a7ce016cecbe00b5db6d9658bf409c28a165ffa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409991893"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AB3C791-A610-11EE-A1FE-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0912c5f1d3ada01	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2368	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2368	1708	iexplore.exe	28
PID 1708 wrote to memory of 2368	1708	iexplore.exe	28
PID 1708 wrote to memory of 2368	1708	iexplore.exe	28
PID 1708 wrote to memory of 2368	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\356b1c9aa8f8e2bb94ae21aaf6bd159d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
297d3500f272710c5f90d06fc6534180

SHA1
6500bc23deeafc1375cfa8a42c8bac325d2d4fc9

SHA256
e85d559ca17dc3110bd739ac150276e861b17a3b141afd76db2bd0fad8ab13b1

SHA512
d161ac95278e216e32cf2107ff95b2b86e5432a4bff842b5d2234b30aa6980dee1d502a7bbae7cc7020416d4ce6c50b649d8a238595488db57a4c1c26eeeee1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68cf587364838cf5de34e6fdd8a57b82

SHA1
aae0888675f9bf443b40361003a0dd116f116323

SHA256
41491b097f5871cd58a6f2384db7fb80e5cf622bfb3691240df5e909a77b07c2

SHA512
d529b23439f9fa8dd5c5dc280ad7465bab6201aadd73f22573f5296727689b0d13837af696b3a0b770160ee11ab908538ed2d16ae04b01e59347bec86d68e907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf7bea8661fc3bf44a2a2039bae07d05

SHA1
a7b54b8b2f2ae025cf2bc4cf42ad5c242631abb2

SHA256
ff5f967ff62f7383f4c41c32aa4dba5be6753554f3d2963eb798ff3afa7ca394

SHA512
ddbd7843dc5d1fa02bbe1014543cca2a78dbf1dfd63483c651b2de9ae8e8356767a8ffe74c50b31673e13828f25299987b9ac71841bc9e5da92bc4f5f78bb0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d5d2f748bcfe24793b8ad6c5ac68d31

SHA1
0009a58b358447669f6ffada85a9529613b88e55

SHA256
f941555d975c547b88a8959f0f4109bb740efa4585b9f41f89655e4aba70d0e9

SHA512
a6eb6a4907ac111869c949ad14999fe221c0930a60884f3135e6be31c7d81fb8df156d095d5940de388ee0bb8165eb9414366d4e117458e95c4120dc15c8ac02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3a00eda774ba0fdf9d9e620c82b0d6

SHA1
b98fe03a6b9a4dbc3450526aa725ac5f5df58b54

SHA256
4a755a495fe8893f7efff509ea1db7b7cd11a83a1a1939a0f20afdb07c027778

SHA512
68bb51cb77a1972762d29b06f0460c0abc4930a0da0b205a6dc8809151aef3c44dc35af2873b7d8cf37e636379abcebb4526bbbf4c57dd285c9f099d3693aaf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9b418ec703735886bc47e18d9c54d50

SHA1
839ee4cbfe24c89cbfccd067bb413d1ac73d3473

SHA256
17f476e8f424150f0fa66f20c3bae9a790d07664f58967bd342d49571c0077e1

SHA512
eadbd1c8a2da809953edfc2feb070f2da2bf8b47fe8f4faa645a0089e7500730e6d2bc58bf2e78483386792925e7285fc528a5ff5608498c7cf1c94e2fd814c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd1507bdbac52d2cf69f29d0655d6726

SHA1
e37c7613a81552964893fc83777fef42439467bc

SHA256
b4b6b4eb5858021fefb5b499fbd185f7343963505df07834dbc47315bf77ed20

SHA512
1bf2bfc97380cfd164733a5f910d38951bc7914ee3877ce55047574fdccbd5cd8cc2777c6f7715cde2ee33290bb9655452ccdd02c79dce5d32bcbc8e13cfcd33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f503037e63f4d4a8f42d586e25a1fcd4

SHA1
99bf3df4338a18093cf9051bcbf449f1209c87f9

SHA256
a576b4dd6900cb36ec522bc49760a441c71a6ec716209a58a4e3787df6077e50

SHA512
a6b942eb1ada288bff4ebcc8c820c0413589142fa933ff9aab0a009482380ecdd3304d535d7d4a2d607a26e00015e6e02a2a08802137057f80f8d7ac9787bce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
517be5008c33d80b3e60be4e8e8082fd

SHA1
b363478f9f7347f5c0d75eb22da2f8dfeea94ca1

SHA256
a20c74707ec06c1b13899760c0e62467655d1ba8343c40168d067dcbd54ff2e4

SHA512
84ff8d17dfc9cba80acd04a44e64d8df38cde850386c9b1edee6cca5eb6ad20f4824778132f7f44e88afb798f32366ca68d893ad58d2d1aa61d82ce9e9b48466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cf772a86029c1d2af18ec27a45dadd1

SHA1
e5ef7c11d561bfdc481264b80dfd980172728011

SHA256
b631b7ed9a0e580b8f89d1188676ae94dd60e1dc2b90f0541a0af98c4503cc1f

SHA512
1b1398da87a7ef1c2dea0ddde536da4fb2f5de16a164ed9401aa42b7675fecf3f77a53c71b65b14d2867dee02a6bcf145601e4a1f328b3c326bc2054ea17429d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c570b17fc937775e184412cd3a72345

SHA1
4395f3aad551ee48a6d73b0692a5de7c41fb6742

SHA256
083cceebd7e5cecfac40cd83414c082c54619ef313e9d33107f7a8f1d82d6344

SHA512
1a0b6c6fdccc369a76ff58d4ea15ee33f6e736f416875bfb2f4b49db6a9b2fe0e50db5ab61484fb032cdb37e03a38ae313649b0d2a1b8fc712ea1e6beaee961e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6e2cb830d0f091f7107282f9a6f29f3

SHA1
0e0e714cf9de4740c0b298a93804d4029c4ca24b

SHA256
d110577c93ca9f8080655ac44554579c9db8c17a229448f09696f41e2cd817d4

SHA512
5011fc38c44c5c7a2776a7d45a9d1dc3660e7f7881687289365f33943b4bab655666497aab1899d09dd817317a2387ff1072f50cb40f490c9ce6a84e33b27139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc6c3de2fdda6c50c37fefbe1eb9a16

SHA1
6f107d31c4ed00def6527e24ccd7d3a9cb425cd1

SHA256
28ebbeae33fc956c3241810e52b55873b5723ab11026204b168ecd8c27ac98cb

SHA512
57050cfdb33c4ef61b1ed0fcaed55ef8cf16dba7d8374015d7b3326fdb8c3fa9d73c0e2d649326cec313f29fb8577dc986e0122fe96770aa848065e44f894801

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6C1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBC5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit