3ff861b6101ad5235cdea5df441496656a8f8ce852b49a9d9f8933f62553e2ec

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46614ed0f5385fa054a29c237041c5e4.html
Size

44KB
MD5

46614ed0f5385fa054a29c237041c5e4
SHA1

63c161fd46c169bc3dd8cce474e93fae212a3e6d
SHA256

3ff861b6101ad5235cdea5df441496656a8f8ce852b49a9d9f8933f62553e2ec
SHA512

313720b043556a9d916936b1ab931d1f38046321b3a4a29b28cdc416387e58690ca4afd4d773936526cda916bca3f7d51221e4925650e21b8a83b905eb5de3e1
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2oF/elgfOzFI4th7:mZJtv/elgfw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40df8c906338da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000b8b2269af1936beee28bdadd34a814f13a16a034482bfd6c18a81fe64cdb123c000000000e8000000002000020000000d2803d4240424b0bc31bc1ad84f1c1c3bb6dc3eb16dd907ee4ea8e7f5819ac5d20000000e088d2482264f348b6dcf6b7b0c4fcd50f87d6ae24d2448a7a0fff159d486ca240000000ce2f0da640ae176f8b9e01ecb68243eab93b4b4a1d310a539f162002c19e51dade6a3104ea35718b5b00268ede94ab635625aac70d297054b93c1cffe7c21154	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409802079"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000006687fdb87ad35d2cbcd1a41ed05fda51530a249079897ab68952a940d08cee18000000000e8000000002000020000000ef85d69d352304b51e68d5f8ca498ce99e3b50c01bf49f8236baad0213ae7983900000005e9b00a0885c699c195baa6e171b03813094a1e9d02df146cea1b99116a00ae7e479d67d3479054da70f4703caa14b4366c840b737810ad3da91117ff167ae12873cc1fcd992ec1905dad2f3b255a1b7cd37281846faef2e691b3d325da907eacdad21f3e0d49eac4174e915b6cafd00aca72443b94a81ad10f7282acb9f40b6eb181395e326f9edc66b905a4e2eb6fe400000007fb6715eddae0f4a3eb84f13fdefed094bfd430629524f3ba8d17e1f0dd787073301fcd365807fa81fd9fc38367f8ee09b514eb8847f53bb83026a37d0c33145	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89567F11-A456-11EE-AA09-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2996	2208	iexplore.exe	17
PID 2208 wrote to memory of 2996	2208	iexplore.exe	17
PID 2208 wrote to memory of 2996	2208	iexplore.exe	17
PID 2208 wrote to memory of 2996	2208	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46614ed0f5385fa054a29c237041c5e4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0d32e569be5d5f4b0f5c82b2a223d405

SHA1
f1912a87e7ad825be350ade0729dbf7a85c6017b

SHA256
c7242fe83ded185aa07ad9a9f212a5afb48bdb38868bd3ba9fbb54ce240ff2af

SHA512
b41c20bfd4841aa73862529885e08d5f7fec7bbe04d7accb9747683d7080e1400ae8ce30e6af45e1bafe0fc8073f12c448c05b467b681eae65c79b40a1bfc41c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc98f5cc29ba15a943c4e714afa96584

SHA1
afcbcf6c31c2694bbe8cff4f5eeaf5f57dcc9bd1

SHA256
6ec4d04a956ed177ef97d7ecc79434a2d1489f6ec9c46caee7fd6e77e2f1752e

SHA512
ce04aa69fd840178b64bf6c61e7201fe868ca19d26058d58566238dbd5778ca0141c7d68d43ed99af76db1967d02bfe4004ba796a6b8fffbd52878063d0e5797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6a16a54cd377ad7a892b345bd59fb17

SHA1
f513ecab8a27891f41906ea8eac7d45c660ca80f

SHA256
705cf3afb174479f0cb30b970bb747834d9573005898aaf673a6c1962fc9e78e

SHA512
d202a2c4fed76d0a5426de827fbe66c58971bcf9a09e55d4c69b10d364de985c05c964d3cb7ebba95f669259264b0f9525dcffc51f955a4e262430398f179870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71ec56c3a25a5dfa886bac2e8cf92bf3

SHA1
f4cd22c328ec1bc2199cbb5c4d607f90e192dbb6

SHA256
8513739c0350714c07381d888a230ad0b11687486a9677d7550d8b138870d623

SHA512
a66fe03e7011b8caf8aab3165e7006fa36910f827e888310c0ef48b7721b2a5a631a92a0077091b4cdaf7dc85f1dbd8c76fea730e76276f5a7d99750c9dd612b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c4d3acbea077ac1571721f4c586589

SHA1
15b3348de303ebfbe9342ead7c1eb061439cc699

SHA256
62f5ccdad643a346a8983c2e54ff9c83d9c5ab925aacfa74c1d87b31614d8208

SHA512
fdbdf4cb4dbcae218f48544771ae5bbaa12ab8fc8856eac383125b309c78ef29972255b99f24a99c24c44b579deeba56a9a008d48f1423a33c781611e5a69bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9321ec4a90dccad92f1344de58a3de7

SHA1
cbee9dee288998c26a5ba994de50a25c9a1d865a

SHA256
6cb39486136b806c1d5f63e5aaf21fd461c7627557fc06b2e418028ee7439d95

SHA512
fe512bf77e2387308d8d956039479dd720d1b0397d0ad78b28e2c803d35483a96aee70cd2faecc825d4d8bbf7bb2d180549dcfe9bcd5232d8aa5aaefe28cd20a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95c554c9d32679883cba0615bc27daf

SHA1
f995998f1ae8f69c0155fe0893d4095a1a498aee

SHA256
fb35d37af947c0813046cfd5e55c0b04ce882d8f625992ea50d586a0eda775a5

SHA512
34bec53bc57e9f652fba32465da3d3ec354c8c5df2b287d1d00308872463b7732de0454eb014edc7a15c20ed01ef5fd885d7224eb62ece09d2f88e03b5bf4ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd9158ead53195c20f7b7399aee05304

SHA1
757cc93d915595be256aa007b344d6118c9cea9b

SHA256
98c3dbcd8bb248e7437da59daf57e35921074a69dd6b013524e2215e7c76d61c

SHA512
e3ea278bbe2ddf98545eecc58767b3d71704c1a82acd6bf4bfddc111c260bcec45dd18a5fb94d8ece9b0e1183c883084314e07c60bd75f99c214bf4222204276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563cf36a6e4e98bcd3b2148c698bc686

SHA1
f97da0cbd822389c3db278e61b3df62796ac5eb6

SHA256
790826a9bd59fb86f70c91b1fa3856ee5bf231beaab1eb599b9f7dbdb96e370c

SHA512
272abaf91aae06f5be2fdbcd4b10b5adf63271135bbf65280cabc1591e8b0e4b8926e05eeafd233034fc764a972f6696b5b18977c037e8b3f9843200bc836785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6473cbfb443df41a0c3354702f84755a

SHA1
be6fad3d7b5226b0257fd18120bd0bf96c4c5bb9

SHA256
b2f29113a306e9fd6370681506103bdd40f5fca7fd8f6b8ae86cb71807f421ef

SHA512
eb982d3df8a09a52459650708fed488dc57a45eab1117b8f3218c4e66a6c7818f8087eb579399fb8391f64434d0b600d848a8b2d98080c03054718a84f9bf662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab992.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB0D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit