b9b06bb8088359806391632cc3596e0d1ce7fe4da2815e205ee7eb760232abf7

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7de2d707040ed86f72b94b986538b0ff.html
Size

139KB
MD5

7de2d707040ed86f72b94b986538b0ff
SHA1

174eb42d1c4618d7f8fef5d112140695c6e00c9a
SHA256

b9b06bb8088359806391632cc3596e0d1ce7fe4da2815e205ee7eb760232abf7
SHA512

514b833b8e384d6cad53d4038dd253631cd3eba9818c7ffdb96f76f473e029df6eecd0c1f3b25f972500e12e0c9306e560c8f4b1f9bf747f4f5acd0f741d73e8
SSDEEP

1536:vZkPr29seV0GLzxhBjH/qr6dz+efNI0U9Ck03hge:vZOYxhBjH/qr6dTfNI0U9CkQge

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ba51165139da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31078736"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3814590966"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de60000000002000000000010660000000100002000000076635e83e6ea666c46dee07e59bd843724b6822b17a48e6ae3523f624af9e0d8000000000e8000000002000020000000eb0805dd9594766af8093d88469551b500601e832f00c4232b3c013376ae85cc2000000094d25c04d0bac5583b62206dc32cdb9220c85e789ad7e08fed1ae017ec40b46c400000006a87613e990125df4884b7c839ad4aa2056b19fe2818fe76795efd15e67d7819e4117ef89973ad93b1f0f75900ed908bb0ef7830caa986c299568f6b6966e699	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0F005062-A544-11EE-BD28-524326B4BB5C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078736"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3825054446"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078736"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3814590966"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410507199"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402b54165139da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de60000000002000000000010660000000100002000000048e14abf4b9a41559899361046650e8899ca05375b73c92b197b930ceb5b2860000000000e8000000002000020000000077db89007161d24b74ee19608b1e6815e2ed58f9cb71033701194c39cb9df47200000002b29ccc47b178ac68873163e162bcbdfe94d1b8ca4992406b1823aaa54c558e040000000f350aa187ea30af4e02b50258017f299a54135031fd4aa56df6c57e759563139cc6feb44e51b8c5fe404988dd06ea1cbed95b70d33ee066e0848970886801290	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1860	2072	iexplore.exe	90
PID 2072 wrote to memory of 1860	2072	iexplore.exe	90
PID 2072 wrote to memory of 1860	2072	iexplore.exe	90

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7de2d707040ed86f72b94b986538b0ff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\2128503[1].htm

Filesize
14KB

MD5
ffbb5a785462af2833e0c59569500ae7

SHA1
5635cab6ab32e52c3da6e338dacdd3a30af8ad07

SHA256
9993addad3dc7067cc0e2139d770c49733e3f6584f6c91420d75a7bb7a760d71

SHA512
ef30098c9236c499b93d602d646c884959e9f984ef6d8ad33ee367f5e43c3ac4a75bf227b1cb4aeb3c0e3e87413b42f2b255127135936445dfc680938825eaef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
19KB

MD5
d3907d0ccd03b1134c24d3bcaf05b698

SHA1
d9cfe6b477b49d47b6241b4281f4858d98eaca65

SHA256
f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f

SHA512
4c5df954bd79ed77ee12a49f0f3194e7dbf2720212b0989dad1bc12e2e3701c3ef045b10d4cd53dc5534f00e83a6a6891297c681a5cb3b33a42640ae4e01bbfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\ad-provider[1].js

Filesize
120KB

MD5
c1701391f44ee4a0c803a40450faba45

SHA1
d7956270db30df603312b2c647c0d3f0546bb2d3

SHA256
435c66905e1d49dede5e9cc5af6ff756f709cced95152bbba018ab1e5eb966b3

SHA512
2e45c661f1b7bef543fb5882bb306829a136e2800e7dee8618948c51e66f2091936b33d7fe216a93541145bd3a4881c63f32bd0f1f2ab50068f6b9d39b60d52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\css[2].css

Filesize
532B

MD5
9fd3979f14dd0e6a72e9d08253e2e7b8

SHA1
3a91bf3bc4f9a10653b0c5f21182b3872fff849f

SHA256
ee0a04ab25320efe4bd56542f5c02f40208613c456e4d9f1999faf9a7297552b

SHA512
5afad42172882c5508e8b7aebfa4ad72f8301b565f7baa1d5d0d19bde423db921ad3acea7700c76160ba1f4b690c1e7ad561fe5a0a4236e01c58bb953ca4c27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\KFOkCnqEu92Fr1MmgVxIIzQ[1].woff

Filesize
19KB

MD5
4aa2e69855e3b83110a251c47fdd05fc

SHA1
23cb630f4424bcbfb339037767b2a54ca32f6e1e

SHA256
34e9582c1371a3b3a20380266dae994edc6eade192dff1a4061dd6511352c102

SHA512
4a78d05f3a6ff884f727c11292b05c2e5f974638acc1239429a21c2ce2ee499f4b3a17d8cd1c4d3c72822931b4c13152f57180a7f93fd5705104bc5d2dd3679a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\KFOlCnqEu92Fr1MmYUtfBBc-[1].woff

Filesize
19KB

MD5
bcb7c7e2499a055f0e2f93203bdb282b

SHA1
d4a23b132e1ca8a6cb4e678d519f6ae00a8aac58

SHA256
f6537e32263e6c49bf59bd6e4952b6bf06c8f09152c5b016365fef70e35856cf

SHA512
89e5e40a465e3786d35e2eba60bdc0fe2e5bd032dd4a9aa128f52e5b4b9e0871c4c4859f5b681c497fe3c9362e24827ed7cdc55515e3da0718f5129dcc82fe40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\random2f[1].js

Filesize
570B

MD5
1bacaaee31b7694bf5c3808fa860ab41

SHA1
3e939a5ef52263a7814a69816f7b500bed79c045

SHA256
31f3baa85c0cdbd7fdcb4998ce8ef2985392b8eff76a6a126eaffc4cfb11ddf8

SHA512
e437cb56a030e200448ceda1ff9285716c175767a5619647c7037494c6728c94ca6dc4be1c2ec7c8d7acc21538fe960169c383e88cb29ef76df8d26482b9c370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\reset.min[1].css

Filesize
773B

MD5
93e42565f156d067f72108759177a957

SHA1
19b2c8de419fbd69c38971ac4923e7636edda182

SHA256
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e

SHA512
3662e40c85350bf0bcf308b7db81c173e4b690b862d3c3cde460de5155550bf055b7ff48cddb1cf5255e55f0355196d8dec1d49434b2457842cc77ebea198f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\style[1].css

Filesize
8KB

MD5
4306278fa7a3d01bbecea83bcb70e145

SHA1
dead3f07d2907ec670940668954409cdde850eb5

SHA256
baf1ee143c9f7fd4a9ce9307846bbe2bb2261618d0a5d616cbed9196582fa5e0

SHA512
4e7f81841a3cbe056c53f37f58473145adda1accf39b0553e7e4f6dc2a314ad302ea58fc57b44d6853fb6edc10ec3da69a8ae5a4071e5fc4a3745bd8d1cb0187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\index[1].htm

Filesize
935B

MD5
d12061a4b3a065d0a1fe6253c98b9cb2

SHA1
f2e40dbad4eb2f80a5e2e040d8e5b647fe2fc0aa

SHA256
fa8a38faf8f3b41f34ab39324a7b007adeefac796d2457c75338333c6056847a

SHA512
0ff99fc1a65b3512ed47af436ca535f72700cf8206a3e20ae50bf4b6eaaaf9ff0096c8a61bd2c932bee874c30f80916be6c9ea6113c2aaf992aaae9b9af5ae2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\links[1].htm

Filesize
2KB

MD5
eff3e181aba78e59e6b2369621dddd69

SHA1
c9b042f400ec5aeff49b2d395d2ab9ddb0ccb743

SHA256
33f6740def24fa649b1dbc61bcb808c7fd9f83918203920064211940f1f95ce6

SHA512
9e08515916834622352ee7c3fb2feeaf05b8e54c0fd6d7e6cce812b3f82ff03441c2972679b01bffb9850e4d7b2fc82421183a1b6e6d16ec614776ac2df01040

Download Submit