dc46224a1183869d87958fe80408cc2924bf58254c4ce445d18d352a197dccfa

Analysis

max time kernel
67s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48a25caedba037865338d7ded1e750cd.html
Size

6KB
MD5

48a25caedba037865338d7ded1e750cd
SHA1

b31644cab1baa392dcb0a852297554095468d328
SHA256

dc46224a1183869d87958fe80408cc2924bf58254c4ce445d18d352a197dccfa
SHA512

c2ef1743176b327dda1e6b73969744953666c7e0e762280a3d0305262f12ff7a6fe69413cd99444acf3f95bbf6f089a33c1de80bd7a67a32b1a0591a62ca63fa
SSDEEP

96:uzVs+ux7UkNLLY1k9o84d12ef7CSTUiZcEZ7ru7f:csz7UkNAYS/hb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000071350ca38685bc3045470b8135182f3d0902e0cac9eb80279841b8ed6a0a32ce000000000e8000000002000020000000288d14ec3d98d9767fbb4ea89d6e427a94d419b38db0881fceca78d8094709fe9000000041414c73c307cadd4c826ea2ef958936690b49a902cf3955a5b6918791fd4297c1e88906fd4b5a6e844aa5495b32d19d2960444d43b7466cd6b6d5e4583037aaec0bf0625b7d0f87de5f4755fc8428d6342a45656122200093a20ee46f4d09107501456960d2489a5b8120a0d8084b5559aa056bf3be890073a2202ce9c60ed095f4cc2f18b764457fbfb72fc56c3e3f40000000b44c73c9df00080fbbdff85415c1d3e90aeebda24ac20e70d47e0a3b7f8a56eb7dd0c534905be97ccbd1879b4f32a6440a27cc69dd7a3f5e92425b2d94f94be8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e060986c38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1AC8771-A45F-11EE-86E5-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c454b11e524a7e08493b351ef3c50195452eff804b320a38e64ae11e69c96bfa000000000e800000000200002000000013f4041d04c4554b9a778caaa82c677210b1e1ad311d883b17001cc901955569200000003e635a5e2696abd46ec6b9d97249757e1759742161db434ffd0aea8835cb3ab54000000019003a8d4eb1976c41d7b263e007000e0f87ecfb4a4d1c608bde5539445f1bd861e01ccd8bafcbac761844e3956af3ac0f96c6cb253c4ea32b0c4b38b0d31f9b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2708	2488	iexplore.exe	17
PID 2488 wrote to memory of 2708	2488	iexplore.exe	17
PID 2488 wrote to memory of 2708	2488	iexplore.exe	17
PID 2488 wrote to memory of 2708	2488	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48a25caedba037865338d7ded1e750cd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87fbd591f406762794e3dead99a18470

SHA1
ffc1b2d123a5f334777d6da8b172168785b2ba22

SHA256
c3fc75b0d7a6da9c6ad02409adc5e1095a88596ce14edf63865cf678cf1232fc

SHA512
0bd7e1a54a1b67e1e9e12e176f5dd4f428c721ac1e5f1ad5780e1b37f83edcd371a5da0fbea59486603e51373244fd2dae99c1c19daced9d2466979b1cb2987b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68c9f3fcdc00b20c88cae504f9fa066c

SHA1
8eb7ef1820136809708183199d54018758c89a10

SHA256
b6f37ab77d6c6900ca3d45b72ec9f608d0f021d2a157d19f2f3a6a9d2e770791

SHA512
d37f10a243f616c44c5b24fa18b5450aa6e22b6b0e9d9053cede5b5ad1315e6b087a85ccea317a9facb33da30e410bdd9d6471b04388b16ae397bb4185105a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2531069865e0b806b4a8c49f40977869

SHA1
535acd761cf6211c6237ebdf16ecb135b0492154

SHA256
6f6536048902a650dfc6cf31b4772a6efbe7576d114f8e8d4055037986f7fc45

SHA512
2a546df6795763be4cd7c31599e09343611e5f753590a8b37ddae15ca1611f2d0d9d5df740f9de8f974658feda7addc8c24961d2d81f33386f2a81b15e672824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e02d9542bc328a66fa01a9b2439afbd

SHA1
df8133bde4cc70fab12bf9725412999a951cf0be

SHA256
0d0ac172a324915d886d4bae95356720c13c6b899ad619072d03fc27c3b525ac

SHA512
8c67e7c1dbf314856e7445128775ba1a5c082708398bd746bb46f691f2b132555b68a89fec20753c62f7eca20152f24b33e930fa68917d62fd5b4576103390c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1bf12b43f9b7ab1b16352ef4728dfd

SHA1
255af43f9b47e7c5d91b7c0e9d6266a3ae7fab4a

SHA256
5387c579620c5ca84234b37869d3e19ff9e549357ee4c54da34b0044fee13ec3

SHA512
486b0d5aca7e6811a212b39160f26737447f442da4bb31a0be4fb33457be0250bd8750466d960b97844c5f1da04a68267ac434a8308dd774341a43052a8a17bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48e2525275121084ef22580278350744

SHA1
8f59b910ca99ebe9168820152f3e5f446dd6543c

SHA256
977e9fd84c888bb84b0a96abe2eb5c3ea7f441fa1b01eba8492efae7f4545599

SHA512
34a992d2c595aabe4715ff95670f18b996a478a8725b272f12f06738329eafbf807d8aac19864ae542239803312436a4a9a0e51af7e4c1b69d817f2476bb6659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
960478de5cc48f7ada6f0d38e1ef4892

SHA1
98c61e2c693d3fcbd4531c78d64b200bad37d725

SHA256
1f789ffbbd649ff35f28e05d1e8d56910a5b6c7986571afe3629a96c5741b667

SHA512
1fde0576717614c14b0d4f9a06d41ad7eec492c695e8a724d8f2f71db2bbf543960afe9f4aef49d60364da05ae8872e1a714b00e9e89b71507264b722d37a9c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
123cd4ca60769a2d9503496a2eeb6de1

SHA1
a1bfe335c08414ea8535b194b16ba34919abf339

SHA256
3842448061015e6e282f61192c5935859bb3f10ebad951c8bc56d064f804c6a0

SHA512
31062bb90bc54fc26239924a3a02d797e501966b7028777a5368acd03282a806f71a6d15c93aed2bd339368224788fd186909c6c62b298ba4cc867240f7394cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd2137fe12a967c968710b5439c5b59d

SHA1
d7a54d31d500abd1dffd24dccddb6704165681c4

SHA256
78cf0a644668fe8d36e90f6dd786ac8a690032f046ec708d6f79e35e22dbfdce

SHA512
8e2cc4d7c286f5a7d66abbf1e3a87b6ef23609e054052d52781b47a63efa89e6d4d4ff9876241ec19fed6dc29d948a59d6663d8a9a50b704fedda19a10583bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c24d85fade795590ede23caec4d11976

SHA1
9018479be9b3d170af17475107edce6bdd12f40e

SHA256
96d49aad42bc391b7f37b8862877fb5d30949a279a3978bb9134099b80872604

SHA512
39dd832a21f7ef5792dbc446f92fc67a54b7758b73811e3eb067fcc2b7dea76d50bed4681f581485d4cb159f83d19665fec981aa594bedc5478799b9fd221bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
025d1a26ddf065c42a5e51ae72adbcab

SHA1
eb61d3810e18994b97912edca82133e58d5328d7

SHA256
f245504974e50ed9883eb8c3cadde6c6cacbf732c6324b283d95dff6966182ed

SHA512
d69f17ac966bde6eeb9173e54b5260af6a8d302162e6ef9e3f7003eb488588ca9fb8458f6a497be8544f6c5db83054503dc675c79bc5b84c85f7ef7b779db07d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75f3ffc12f169b43a02865abe5c3b4a8

SHA1
624754a7c8474d0808d400e6bdcfb2bea7ab9f09

SHA256
df9140ba04795103de2f14ad4f36925edc8f2a5831b502ea8871c41ace188421

SHA512
79569ece274ed4a445ef3ec8de7a796737c958224b95a169bb53bb7d2321f7b39736b779b78963e56b0c3b554deb0e6f281ade43563816963a0936b30e17948f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
617571b50d094e0ba329bf9ba2cbdb74

SHA1
2a14f1f0526b6f371113bff118d33eb4fe4b6328

SHA256
cca00bc77bdebe9195d87a1c51297eec0d386edd562b6841dd68b7fee9bf5210

SHA512
e60da781e3d92a1c489980e41385844e2192635245f79748e8e7b9f6b6608bfbe28f3c98b757b2d0fd12b4a03f0fe14472fea9e0e082dd0d5ad831c33f4a2a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d20ff0cd28273e3d28d17827063c1fc1

SHA1
199af1dc8b5d244b556a0418b985f4cc76c89367

SHA256
3ca18b80a6b346cf62b84a078fe45be0fd897ac42009e6e006f25dce04327605

SHA512
de62e3a1ddf299e9787cdc7e331b7b2b95cefccbf4fbf4632c25fa3a25fb1d9b0126fbf27f02ef3241d67db965310844fb482460d6dbb1190c5c0b97fae5db1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abf8e3951aa5c5b8f19401653681d648

SHA1
ca9c0475a4829b3bd823302122c3ea62a335823e

SHA256
df97cca3d3ca2b1916132fcabcc9c6b7de37237a3f8292a3a2bbdb6d1293e9fe

SHA512
9c2d4351e0e1e19a12dbb96916c7a1c93dc2f231ab2d2e3faad65ef973e18c49fe4e70680d0504a5bda92a324c4a06d8eb54ede1b4e27427d5d49c37c72e8cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F5C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3411.tmp

Filesize
139KB

MD5
5be83adac37cc25a366000976a04758d

SHA1
fc6e33ed812e459604c3de031a4f0196ad76fc3c

SHA256
2fcd63fc541e2b0279ef45a39f591126fc66e79f1d2aa07f5aca17cdf93ab2e0

SHA512
47555af9d9c00d09a1a4b1d7ffdb6bc067b70317031a250b1ee4ffb22649d4c52ccecc2f66303036b2f729b5e1aa8bda63db3b9c59a07640e36e3e03d61025eb

Download Submit