140c4a5aae2030f42b7fcb263ce22459838ccc9ae20e5ef587a9d944711fd592

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47863a8bb8c461af91cfc7f9a403cb42.html
Size

48KB
MD5

47863a8bb8c461af91cfc7f9a403cb42
SHA1

0adda9f9b54459083293940e3f354f131aeb69b9
SHA256

140c4a5aae2030f42b7fcb263ce22459838ccc9ae20e5ef587a9d944711fd592
SHA512

af88d5afad92e0ed568db9dcc5484da6dfce25138a776988cf4540f59194bc2ee5a665f0a8350f2ffbd8108d8df6c2c9b43f24e2fb4ba87c6e7c6d0b6365e578
SSDEEP

384:dqFCZZ1DzCWo8zO1iAdFI0nD+VdE3zuaxsJAIcwDPPosoWcxnr6h8SahUYcwQS0S:dqF211V/gyToD4nhxHK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F0811D1-A45B-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e095b06b6838da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f29441cf85072f02fb2604f09679e8bee275347d6e2383ac61e453d4737b6ad4000000000e8000000002000020000000c5761d20b6af6cb64cc38d5be07ed90e1d3eedac1ef44e14e1295b88e80c2a1490000000a5e4e4223646c8e9693596c546d4910bd1080a10c9cbcc88aa2fc29caf04533f6edb5b81608b6155d5d360b93900ef7787bce667ca694f0cf08132beabbe794fd85afb5eea6ede603f5ebb6267917542ed095184cdc30817c7642592ab313c0e2c7d74bb3d8eee1861a7d7b5dc671b317bb38df713a25b826c9901fdff454387583671155a2733b2144d2582178d3e6940000000317ab3f28cc979f928fa67f14ff1773d70af4d35515334b8eba64a1aee120aea2e01b99264670a9640c3dde1f4902f5808077c2c4251d8fd86e5cbc840b7659f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001c26671438dd957be6ed5a4df49aeb9c428b3270a8be7273555e96bbfb2e8d6d000000000e8000000002000020000000da357694ddd7f2f30c130147e45c8d5361becbbacf155bb0e13fb01746d9d3cf20000000d84b495540d189a5d137b8d6a5ba35b72521b4bcd5d2a2a8dd42f22e26b901a54000000012a3dd209a796691939369a06b65c50bd3e59d5e0adc6b484efb6725627a6bab4a0ca657bb19e4ccf9a3528c756a85f311847475b445286147b2bb665065046b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409804236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1064	iexplore.exe
1064	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47863a8bb8c461af91cfc7f9a403cb42.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a595c953cc96babacc3eb138395f4cd8

SHA1
0a20e91dd64d9cc0ba582a6f21226e72ec9475b2

SHA256
0bca91793b1909d5e92a7e2b28f87529b3841e9611c5d129fcfd98ab8a872b7e

SHA512
e9b9fcf0e5fe4f5474e006f16068d6a073abfe676c9797513df90b9b7751c974635bb9086f5e76e42bf62744f43f7b7898214a6d270998b0587aa9b4e851b2fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4878765658ba32551abd9d80768fa4a

SHA1
ee18f3ba70d4abe18202f0dee1329c6223357b01

SHA256
a5b98a7a364c7f328e43a1def489a9b5eee2479f76c5f2544539574ba24b4aa3

SHA512
77ff3a2fc5ae4f20f2aeeed3ab1d0fbfeef0040b3fffe851b91f2f8fa17c1f2f54d8e760171bc5068f00f6b367252bd5f6860daba9d76dab86fa1f8eff12f10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b63aa07cb0a4df8bdc3ded03393c0fb

SHA1
4dcdfb121c4f65f62c61dd81ba94bb81b0ba274c

SHA256
e99b1e93898e487248b60b5f769b2365968d8c5702bf3cf63505670126b0734b

SHA512
88af7ac2028f8a3a2699a4b3f9c749b05031f33ff74a6d7c8f32cdeabbc7fa926770129c43e172f024f98228d9dc8c113c34db89b10793b319e8468a4f6279c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1a95bba694e271b8bba364369b59803

SHA1
906bb3579a475d032aefa26f94c1fc149990d440

SHA256
b8cdb8adc24b1f190c5b3bee1e7572477357a9cfa918a55937fbd267a5c97352

SHA512
3ae349ef34caee307a16df4039615642e558a0eb21579db566ee04fdc44305513e749405813b5ac01b4905ee4ed8afb999d4a756377b005680ef9f0cb8c9a9af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b3b8f60a413d397977334277908c2e

SHA1
c2321d8c213f95a82aac73191c57e3854463e5da

SHA256
1269b5dd74f57a7fc1f85309ca338fade446f846e9bf772aea5f7ffd0833fb8d

SHA512
25526bfb532d7f8de467a981a90e07622624313a2144cb55d8808ab29fc8db0eb659174bc6663f3f05d37561b348f2c742ab7d9e53fab633cd83310d9cebaa27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b13f2bce96a14dded4b269945c919a45

SHA1
ee8783d013fceacb0de5597f0c037e16ecccd32e

SHA256
45d92f8de9793b8448234e040948c7667d792692ecf298efa5047d40a894cb7f

SHA512
029baed731a8cf90726720e869a1e4b7377e54ec8db1b49ea9ff937d642c4f86954415456288d525fdd3b5f60558c84757b4b86b7ce2612e7cf547afb7564731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a23ec66cc9063f7e7443d0397652296

SHA1
25f96c8e9a60c6694d9d69ca2adbf73944f1b2ca

SHA256
4df0b060f5b7d4bceb56f8c21ddc669a69bed7bb2905f12d444d132c0e7c2996

SHA512
b267c8db7ad6e630092759b507071b46db1d71ab00a00d7eaba14c8a99bb140cc8673ffd32ca0888d133f935ccbba67d8b4ae57c5bb6c1eed58b2b2d133aaab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72eb63d6307bfe5b0b1cf5f19748ab06

SHA1
93140feeb78d19c3ef901598217ebedcc1172be8

SHA256
5fb7e031f37f16850e0f1c51f27d313ed0811f29443865cdb3794569cfc110af

SHA512
69b6459dd3beb5e9c0d0a00b0876baaecbdb74fb193b942492fe399245f3fa867f480a6cd18c149720ba60c9ba2030ea11881335d38beb4e9784927f32850a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8deb3ee8e52bfd1933909122298cf34c

SHA1
ed07503f5adc5412940222a47d5cd1c9465e9bcb

SHA256
cafac173d5c749727c700d0def3cb194984abe2bc731a8b8c36858315a186f37

SHA512
63ca62a3e654f88a4e2e2d598e17472a0b743c5d0b384f94e351b4612340868f2ae4b92a9129a3b5ddf6aa4402a04f02b56ecd51e1ff4a58eefd8e88d9887e2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aeaf41991f06c913d9623c2d704f38a

SHA1
5ba15bebdc81c05b0f961a2e429054e21f33bbf5

SHA256
58766abe1413e51f3ad3d82e2100788cbe072c5f36c55bb6a3ed7240b35b6917

SHA512
21f84af8d74e50f66cec2071e3296cbdd23a8d90bd12b9eab0ac904434b1274f60350a04d2b8d674b1b89e9995e6a2f9cc0351ce25ca12b8adf6ce3fd5b3daba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11a5de6e7cf73c424d5918f8fe8423d4

SHA1
87fa10cef7ee61058156ea57b5233f079c0253a4

SHA256
23716f03584f761e3bf9c457930ee706ef6b5f929089f2911416436e8e6492ac

SHA512
72d10612f985364b53bd99b29a6737046751b0d1bb168b6f247c170402757fef9abd388417935fe953ae1d82d3ae638ebf683ffb6c1a56104b735dea751ab8a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f760835b52359d322313916f7cf2f10

SHA1
1b5c83d3042b7b9c4b1f9c1fa8d6b23dca4f6734

SHA256
9e88acc1631e63283429db940c9a69a0e751b83f8bcec124ed6009ac93c408a1

SHA512
a1d10be983ef4c7365b85f834a93f9644d801142c42d5a404dc0df4b5bf403c2056584d0895d08a0927ba11224c31da4c12895d482d1fb80072ab143b6e443db

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC5B3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit