63a87aed3726b86041a8945f6e5786883bee2e6764ec6072fbdbe8f57f63b77d

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78e83a248abcd5492a1bc3d152c1bc64.html
Size

35KB
MD5

78e83a248abcd5492a1bc3d152c1bc64
SHA1

b97a599c88cabfafe36f639727a422b323e6b273
SHA256

63a87aed3726b86041a8945f6e5786883bee2e6764ec6072fbdbe8f57f63b77d
SHA512

78f658af7dab709a94d3a1646dddb426853a66f9d4be0f1a60ec6a26234bb5134fdeccb97483ef317c3b42ca316eda4c049291824af39914e4c7fc24b43296c8
SSDEEP

384:SMZ7Ak4Kwx+WcUH88hM03FDgeJDR6XooA7TAsEVkItVRNyBU19BJ3+L1/:SMZsk4Kwx+WcMaX5PBZU/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CAC8E71-A52F-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c933865ec50cf6aef53ad0e459afa0ffc7394d725ef29de23553e8214ef65300000000000e80000000020000200000008a21b3c370c3046b228aa8792002ea5e5f3e1c4137be931e1ab6a8a265b38a83200000001ce7ea1a41b91c31c455448d1b07978c2c169615a263452b3a0714428c502f4040000000a50143c7bafa003b914d06d4b1ca40220d2dee4b27b1b98962841529dee5785dce9f2c0e925e5b6c0a4f0533268103899b77d336b89f8800eea43e4c758e52e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409895229"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400eb3433c39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002b4eb5a8c4a9c0ac9767778d7a879cb5c4845ed0c1b3c072037b696332aba5e9000000000e8000000002000020000000565319d13fb0bbc6dd9cf9483547ff18969b6c1215af08058b9ab4b0107342f390000000dd39d3f3994a75df22a8fcb632a0d83d8759564525d83c97e920557cece6839cf02c7fb819badde4ed4efb20b33b677aeab1e6d8f51825a9f5b18d9bb03043f72a2d6a2ae5a26bd41c39f7509f83f1f699a1671f3610483b08f6547627feeee2c8e53ee8605a9d1abb6f38283f61502effcfcf7fa3f8edd2702913425c1d7cfbe4d73eade69eecf9b4f5dfe7e4bdd5bb4000000097e8adf3442c30bd33bfea662ddc4b51bda3aa6a1ae1166b372386e3fee589ae12761471227b080f0bd5843ab6d019aa6626368ab375c34cf2adef949c0dc62e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1424	iexplore.exe
1424	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2388	1424	iexplore.exe	28
PID 1424 wrote to memory of 2388	1424	iexplore.exe	28
PID 1424 wrote to memory of 2388	1424	iexplore.exe	28
PID 1424 wrote to memory of 2388	1424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78e83a248abcd5492a1bc3d152c1bc64.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db4d28fbbe2d7ae56bc62ae8869d3595

SHA1
af3195310bd57c5de0b17e3ddac27a72a84ceb84

SHA256
8fb636635aa1421762c1a4c58596767f96c5cf198f08a57b28b86d7810bb6266

SHA512
f49f7a522c535ef76367d04103ca18699d78848ecce37e21061261ddf03d32fa2b7b51a3497400bb5851a85e156b61087076c38610f661e5d0da2eb311f9f989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4df414f741ce7d4707abab7cb474caa

SHA1
76dddf9c004086cdb4f92a3616e500919a6f13cd

SHA256
3fa44377a2a2ed794a8b82ee2cb5a656c6df7539a215e06609d19102decb6ebb

SHA512
60792e00f0733d2bf35e59ca62f16c12dc2a602b909f03a411b421faa6caf68d55855d61289dc54d833080e460e14d96fcf5845eca98034d6befb205093d4b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab753acb10926d523f786bbbb26c272d

SHA1
cb2cabd3a43924c1fe00830f8e715a02be6b4d5e

SHA256
8eab0c958adc594d0f8917211dda8c116020d97a56f0e0caeefb13abb0c1de7c

SHA512
076dd76eefde8ddb166e55c159d940a79ef1a7b7ce24e70413df703e419cb124f7d495d7e023fc3e01cff3befd037121f62b74141f3a316050a4b45a34d31470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1110bd899b83461ff92fa7407f6664ec

SHA1
b08cbfaf063c2d369500361fa82f29087072b05a

SHA256
ed1303170bd0eaeb1f77bb161511f27ad45c3129d521fe5a76f3d760e01fce1c

SHA512
95f8b127f624fecad83decc5bb5eb96f4f1fc07b07078398c5697a14ff5b5d1b647fb025ca8aa94e1844f5ad401ff421537ff46b50438bee0a6f1266692d5a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
478a875f82db6054eea18464be06f7d3

SHA1
7e4bbd6922dbcfebd076d3bbe1b39771ac0a0c30

SHA256
3cfc04145bf1f41dc009a03c58ed82ab2e07a925290c13be84577a3eec6c7345

SHA512
a96505c9772d5d14508b8b9cf0cf08a476dd9701ef416698265bb65752133acbae3a75dbb3a1bca2f1a225069f62aecd448c60c86230a20ae555236399cd3efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a932a99711cb89bcc136f8b868ec8fa

SHA1
37a641251394e9f49e66ca1ed77485bed0e1c52d

SHA256
b8dcff26b26e8aeadb1d31033ae657434aa5bb8f25ab9d61c2292795a1bfdd9d

SHA512
2f4e5f797b255b3d87bb3712827ee2f1281b0b7afcf4538b71173d30b297e0b373bb23ee83ac8406610ba63e8b000d16ca715adcba3de41ce728b9a085456a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7c9f91a6062089161788cd1de14c202

SHA1
5156f2771cbd3a88c1e169bccb1e5bbb0db98140

SHA256
74775c05e39b0873c6b251c7616354872f7148570856574a209cce23690bcc9e

SHA512
9db288f4fda48928427bed5120c6ee7579073ba741da706bc669e8961c21613d536706de090bd00d8f3a372363e8fc6854aa2729f014595eae3d070f20db756c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b671a8cd7b3f216b3bb9f38b60eb2dc

SHA1
15f194b2bca8dc67a74d389c55642c149387ba4b

SHA256
b455f195c0b64d33c2291b2503ed2dbc9eaee02688f6b1f831a84bf6ee443b81

SHA512
870e43ac52c06a0c6e335e05542b39a7b3ffcc82e2b7ecf994d83c756ab3d06fac75a2d4916c43274d890a5f2872657be98aee6dbff5b9e59a23eeb7ea540794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
298a70204d81792acda3e8b260eca670

SHA1
357d974eb76cfe72923c7c49cfd432c4e1e27f3f

SHA256
84b7f006cbd514ac93f1db031dc744701936df4642c8a0dda75255d85b8e4c72

SHA512
0fbc2b7bca61f1d63dc9642f67cf28a1961401a9f61aade1a793315145f0f16defd2716a8055a01d3403778cf8e114ff91f62ea5e95676821caeaa1e73f3288a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dba27a284df7d600a5cf314ed415fad

SHA1
2a5f3be58b0f8e19206266e3f8cc86ee8b7ad74c

SHA256
c8552d7e896583d000091de9ccdbc9fd3e14402486762a5d2098b0085610797f

SHA512
509022c6a7fb1397486aa459b1c9c6d82344b8b2a922431cc40753f26f7367c39f0dfaac65a70b3141e4d83c4ca6101f34cac64ad4120e174283f8b169965492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546d642cb0ca7169906be19566bed5e3

SHA1
7ab1d6880645f9966225a545d7531cf3980938ed

SHA256
beb0597c0c69e1b8934621349f509bb040a946ecc7980b4c007a5ddb9805c9cf

SHA512
d11a04c56d369111452e7f7ab0b33f505a9a60ff842b171060a783dbfdf7f794768f744a465abb208d5570527c6d7a5dc7f76527588707559709ae3fdd377311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
056864affe5667eadd11ebd530245509

SHA1
18163afa5b4a5fe69bc9d4e2fc279a626b777f9b

SHA256
b7898a3657281fde8ba87d53d66d3eee21dce13fe327fae18d3cff7c4606abb0

SHA512
de00ef19e5b67b9a3f8eacf0474f8e15536da029790101556b605da2e5dae304295b2b664e78c05aac72af6f363bc316d2eed1b89bd3cca41972feeb28245148

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9512.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA03C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit