dc6521b60f59e331292466d9b6cbb957421021cd9a3377490c90ac357eafd1ee

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9bf885e8baddbc80a05dcc55ffa99b5.html
Size

90KB
MD5

f9bf885e8baddbc80a05dcc55ffa99b5
SHA1

955d1f9babb1d39431b31d0a19462e263b0a0f41
SHA256

dc6521b60f59e331292466d9b6cbb957421021cd9a3377490c90ac357eafd1ee
SHA512

247963a5f0ae516411f5ff61962301cf1a88fd439ef267cd86f898b5619e90f592eaab32a15f5801f051c14185e607392dbfcf746f04ae5225ee6429d94c260f
SSDEEP

1536:gQZBCCOdJ0IxCJYp2E73MbMdJ4NNIS5CbV+AlrJ+wYYKcRWUaoLuIKZhEup4UWCA:gk2z0Ix7Pd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E92D841-AA3B-11EE-BF28-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000019c9329172530daca9c0b514196b11be54c15005c4e6ea477b42220e2627a8e4000000000e800000000200002000000029f3415b975b3636b95f513a9418bfef385059c4493409110cda94b0a7bf492c900000005533d317d9514d13b673f329579b7ff342a14b8d3650206eba155b1c5bd551a36301acb1f1396a3185cc3babb8719f306a785707761e23083fb4802c4e10251471c8d1410cd3bfa401233a0ecc43ec6c524989739987e825911b0b33cf26c42c4f67ae46e18f9a9094af1bc602209560775e9f1fb0a682e35b036aeeb3f95b5f23d1ffec9992334e1dc61bccc04eb2e840000000ad79bc36cff88c171412749bce3a07164f6c9ee489003ac770add5a5d86447325f9e098644753f5ab40b7c45856a29c3e0e03d0b9c3285903d9232f5bac3975b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fe5a0f483eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a21a8feeeeeb4d2e04210f7a7fc6971049ea006cdd4b8fd6458a75575f604d80000000000e8000000002000020000000073cbbbd4346377ac0df304b19187a575c2e8ef824120c0d92dd06288dd19c902000000021bfce00e9c25dca590669fc186bb2d1b864613c3a5c545ef525c01c348b6a49400000002676b1c32db5076e91f54cc13d923d2bccbb1c1182023d83eead71954450fa739f46e310005c6816aa4cd901ddf038c7a89852f55b40043c153847fa021c1edf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410450036"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1324	iexplore.exe
1324	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1708	1324	iexplore.exe	1
PID 1324 wrote to memory of 1708	1324	iexplore.exe	1
PID 1324 wrote to memory of 1708	1324	iexplore.exe	1
PID 1324 wrote to memory of 1708	1324	iexplore.exe	1

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9bf885e8baddbc80a05dcc55ffa99b5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac7bce7496831fd6a47c4fd5980d1683

SHA1
48b3f244a267df36da73042ed1a179c61433d533

SHA256
23e5d771ba7c9d4822243d556042de69c475aabf83da74e8dd7b65f99611615d

SHA512
cd081d7fc704d7a42f0258fde80bb86418d08197effbdad4a16279af6e74f9e90db15166c93a7177c335e0515d4e7a2e36ba4232f3fb7a554bceaba3ce8b30fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59cd1d97deafb280381415ff170a78bf

SHA1
932be1c5588071d86dea191d7d8f80a28fc87b95

SHA256
f8d98091b72131371e15b803bd3ffdd234ffd9baf22d37bd2924ea9d7afbce64

SHA512
f4f96bd838206a8e67b6ddba2d9422f13dc5aecd2839116141dc1a8cf7b767eb2bf82d9062a940b9d6e19af6006160491fc1584ab28ad7fecccaa704a500333a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07532ceafa5e49b8f6bf6aee729b11ce

SHA1
5edae2c6474df576fe64312acfc3c50dae1cf1c1

SHA256
64f8c49f90065b325bd0ecaba6e2e785ee8c6489b441ec91485017b23368d503

SHA512
5736fb3bbbbc64b3bb26992d14bbb31e9df404b4602719d3fc045167814154d0f9c594f0d1a74e96a04638cb457ccfb04b0be21868a1c716314bc76f3b15663c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
565a9201f64a0802f7856a0052c1a6eb

SHA1
cfd78e1623879611e5a603fe8998b49bc9ab2874

SHA256
f0fc269b2a8a5cf8896a7bb3939c56ee1ed9a821023049817aedafead2f39af6

SHA512
e498952dcb64af01aa3503cf8ec25fa33a868db718a3d5eeea64cdc6384ef34b080b16ef6420bea5ac24843b98601cdc91a57fd39a64634f754a2c924f98eb99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17893fa7d21dba4a44c32dce29c00ce1

SHA1
82e8d6496a41c2c5a529f0a906baa67efd466448

SHA256
bb43639bb06efde5cf80a486e41b5da1248aec34daf98fe5ffa9f5a95d125135

SHA512
087c360129fd34cd357ed15c503d4cd5ea699a7e3e88807ead2979f9d81280e19ad89d5bf8c768340e3b73e16ff2580df1b877cc9c9e38bf907defd46f958c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
145cd082102ff91db009607f6e19e364

SHA1
33d3128f4a41c30c76502b1d7929604b7f5ce285

SHA256
4c257726506a0d8430df94bda9106faedaddc1032979e2c069bc437de0fb66a3

SHA512
5572feaf0ad4597417e6f954afb1cd6560c693b729f55bdf12d77bbb32ca86127ff45aed32c19a60060294817e1ba468f762998a7e7de531c8408804559278ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8960d918e157d87bebb7867048018219

SHA1
79529bc155b5f7e25db040256c14b5c5a633ce7a

SHA256
4e373f815cd78e07d61dbf45bc3a5069f95cbc132aef17bad83b6ebd829a5dfb

SHA512
8498a3824155da19b2cbc57d0a4f395d8ec192d242ee0139fb87aae277bc441538f14dad16e1f6488503a833d5d3cc9692c0b29ec0afacd5f4f2e37231833163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
865d03b0de61e19e91489580a1a7cb4d

SHA1
003068b4ec48bdc0e9a9938595d304adc7318909

SHA256
54690cc3d40657057214b228f35749eaccfde4ebff3e70f69862025886c3ef5d

SHA512
4c6463c3aa8039645eeed6e663b21eae8ebbc26954c0e009b84e9923e5734a7dad67819e2a990d7ef35b51b5228b690fdbaacb0a8242f543c186ab665175c400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d6743d206510addc01ad98bc4386101

SHA1
4af1bbb9540772979cbfc9a1d64d31fbf7d9c0ce

SHA256
cb8eda5020fcc348e963a4dc5e0c0fce60dce728ff80209d89baeac9fb5513b8

SHA512
7abff4d14945d44c49ebf32160aa7f4f2c864614e08bafcd8d107299d5d5336087e1fdd14ee6f225d8482249f9664e25b2ad94f12fa50a92c038f57b2c747d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6faf3b24bdc05b3400d176f80557f56d

SHA1
1ef62efce056a0893acbcc00f536c30461b93b08

SHA256
8dfa06535e7f2f9f12da4ee726d4cd313dc097e468c38899e76d37c03807132a

SHA512
89d792534049fde819d43b91fad83bb92ba03b025cf6d786c791376ee8a9ed7dd08d61f07d2f6aee7420da9ef0e0571fa2925a70148e9b42e446f7bc30ab5bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4776c097e6e5d34fd0002b084bfdc7e1

SHA1
50e5e2617ae145a086100b971e08c3f5a79f45dd

SHA256
05fe3f0cef29fb2615d22d6b2c04be8c27a3cd85ccd0483a85f47157e4a286d4

SHA512
b5b4c7c11a77a1d3b1ab6f17a2c4a8b284c73c6b40ad7a3ccf473b41debc72b0a74be3f9fb607fd6b280fb56ca7a3fd26449d9d6eaa4ca71ef28a40954f7510a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
778f74103d4596267d44526e9b078ce7

SHA1
eb87b39d8e5b6a7ff31d647f6daba70ff5867fdb

SHA256
a561818f84373494b5995873d88c05ca69d51bb9011abc97899342e5faab11d5

SHA512
26ca9637871635e8fc35874bca0162f7dc0fdc363ba177368a880c54411b78fd72758323db09f98831d0c509f67a84de4e08ebeec8f63e0122ba4c824d3c65e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d1ebea23a53174742a9cce45102a19f

SHA1
04effe5287a491b072b2db3352ff61731eba4bfb

SHA256
d2ed6414fb0e03746c4e0e8d8c11ce16c3091b47b271e07edc915c48d6d8860a

SHA512
7aeb4fc9d18aaf8845fe0ffcaba2c11de0a88d17bc423856b9f886a38a8b76937d619b3e3b33bcbb31cd409ae6c0124ed9f32dc92e616cecf6cd00af50bd6280

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC381.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC3C2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit