f920a19d42da2852e496f70e905c0ce29ed7c9d02687f19a5d2a46cf1919386a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9f0678af43060b1375f56a2f1702bf7.html
Size

6KB
MD5

f9f0678af43060b1375f56a2f1702bf7
SHA1

96291d9d8b55b3cf42ec76fa7590e61fb9c37835
SHA256

f920a19d42da2852e496f70e905c0ce29ed7c9d02687f19a5d2a46cf1919386a
SHA512

c5a1d6563bde199de031e2abb6b3095516acbffb8fc2b1b581b23c48fe2c663857ae3eba5ce94ed18e0de9adcc7d3cf0d814b6651a8f1b7124220ead2a57d6f1
SSDEEP

192:Zy/O8yw4RlDEvHLgszgA0cydXDChxiqEuf:8/O8yXRiLgszgA0c9iqEuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410995925"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000098e41b17cef3fabbc48ce3a4647a39ca9f7abccfa1fcdbc4f670bace2e08d765000000000e8000000002000020000000d092c348258831b573e3d4f09f28398e8a7c6ef0ea07f5ee6cbb8d404bad56d020000000e013fa9b9f57b0ec127d4bc3aa2662d0fed17f4e37333abb103fe37b9b354aaf40000000281cbd5022f68814dab5cfb77763f4c8341648c95b4bee842a9dcbe4830ac9da343aff71b7ef33356509ffa332fe32b5d546e41712f370813f6817f4f1b3547b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f662ed3e43da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e18c5800aba3366bfacf2c0b2eaa334da5a443eb596a3cc058a10db212e56ef6000000000e80000000020000200000008dd3949ac0cec7829c6c3fe59b345ec3b8f4cb1a692e044db0e11e5f930bb9ee90000000d535bf2be0e8651998c7acba9fccead3db4a592ebcef64525e6fe023630df417ad84cc582dbdfc9f9fda812870e7234d937bbe97b3ff52a077b2dfb4db7495e4b21e81dafb482f2671cdbd221d40b21f25412a202352389a9164488182fef589c2cd2a44b40c76fb01fd4c9e3cb8286879767a5f6952ef38ab537ee02389fd54b0a0b924f241d31b03d69d9747cab3e94000000085e8d9ca27beffcb6ab891f307937822635e0d3d0e629905c18c92454cbab95b9e7b620fd0d870ea56d5b20f35f8226c8361fdda543c78447d24c6e0c40a89d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{175C3AD1-AF32-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1348	2960	iexplore.exe	28
PID 2960 wrote to memory of 1348	2960	iexplore.exe	28
PID 2960 wrote to memory of 1348	2960	iexplore.exe	28
PID 2960 wrote to memory of 1348	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9f0678af43060b1375f56a2f1702bf7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ea8f987053e151c239f24ff3e0d9d1

SHA1
41106b4fe9eeb07e25a8f951e3313eb1ebc416b8

SHA256
96145e1ca7cc966f61727e7147268c59b9b69b30c063146db781d19e6db5ce63

SHA512
18dd7458fbc4f0d952a877b32b086eb7a95cd497d80c250dfa8c81a6e4070e7528cb4c3ad216d9fc73149f1f7f5d4485e7bd0ae7ca49414ff498cb6bd31536f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e18bf3f69f68761e7e7ec2709f2539d

SHA1
f4823564aa9bec40a5d47cc1a0986d649a27bad7

SHA256
933284401e17d550c0ffe7974d183056fbb2ed75f8c3981723bf38a6c83ecfdc

SHA512
4325f3195c067d7bf120c266b4a7352e9ade8b816cb2372e13c52a3ba75d3f429daa5ae36093cb91ef0717dd8063029271ae386b70d8627b8caa0d9bc54d814c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa596992e71a3efb3fa5299bcd76e12a

SHA1
0f98925a33737ddc7a4a59fa9ba8e73e0e007791

SHA256
6f657b4ccd78633e41bf697afde1e30698e9a358ed8f1af4a5b6a3ce614091e6

SHA512
666da327b2e49ef84fb6495488e8ead3f7f397fcd09bda434d957e8d179464bdf9e42aef705c28f75d5a5ac13bdb21ce4cd12b930cf402f935c7f7aabf4458d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de1ab1aa2d36bee33038b7c7ed5c6c60

SHA1
2816862751a7483976c95c27feedc7b6a1c19da4

SHA256
22ef39afbeba32e8f13119ac17199d073ec99705d4ee0a0471a4463542a76329

SHA512
1327c43421c1abe9da1b3a5708ffc141236aff69702e852ffebee049a3e0e593e60cfa1dc9912f0225e56269c4075622e0928704f7d953b8f8d1fb02ce94235d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0753cbaaa9a6e26fe7357be20f914a82

SHA1
836112ff010b043308ceb4d88cb12cdc2739f264

SHA256
b3d9a0d1655ee8a58d056ca389f361738bc9a4d03627241ddab43abc322552ab

SHA512
f86337a46ed1c29937b08162d075afc1eee53baa07328712189640c9c6bdec745f75516f076fbbc8045aec9a4a7b28e05d5043e731df0cb08a3572f00cbddf1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ce0d101181e5bc562f9678f5cd1318

SHA1
9a3bf816542b02de46e50b55ccdbb6c992c90b48

SHA256
5a9ba650e495ef88ac018371b507b0864e3fb88161e9ced4f4cbee0672f55412

SHA512
0e0f53d486c26c1d112dd6ef589a2db8719ad842793cf47d37af4915f43f0ba6ac77fa31927716f89c6d7eed61b02ea4a0ab8fc1ecf972780bd2b5a2f44bcabb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c25fb5fa96974f8ee87bb4cec1adf79d

SHA1
196d432993608678c7e70cb482665810728e3957

SHA256
7247c584242cd265e7b04f521b30cd3b8bc1310e847d45f7a6ecf53c13c17a69

SHA512
83c6606279ab1dfc8839f59f6aeb31b4016a22132620500770cdb77d50ffdea44b575d00d1c6f9b944550f37c8f822aec869a5222aa239d0f306a82726a92058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4268933e0c78972a615da329d35b5d45

SHA1
8eb3c7a45b3dc6d088ea07af174c57790d962f24

SHA256
966b84052783048a947ca5f37dc0857b67effc49f2932b0133a757452ff67f4d

SHA512
0a6b693fa38e3baeb5129a7627ef5e0aba9599e5130efab77e9dfe831d76443a3c44c98fe86a79f666b5d25c19066d91e2f39178ce64e2d848f1247ee7d57ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
128246abfa0c4b8596c2b31a65226c31

SHA1
66098036be79672f2f691ae86d3013238a85f765

SHA256
db6ba505beb8770d995a00f738caed194ed6cc2b82464dfc1b5b45a218a689f9

SHA512
ca6906002fd1accb7203bbf351e88d016a6bfbe2fb8705cc7d0c39ebd34835987295194c8c9b7726ba3a339b0fc24c26aae6cf3df04af146635fe23bda0f14a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd2600d3d3773140fb67b011486abc71

SHA1
5ae1530897e4e8713a3446e18d3a96884eb6b074

SHA256
4ac5c16cab54c406e7755172b18bdbd9ea30bcaa6ec8d9d37b8cd6a90e0708d5

SHA512
cd2fa6effc14f6bc4eb6f0a1f5617ce9f7084abe7222d13c242210bea913dd2725143fa00e971b6c30387c9ee924b49cda52d49fca918f1d21c89860e25bafaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73dbd876f487fb5c0bf3d45cae1d042b

SHA1
ce53f66b9667d923bed924b961aa1116640720bd

SHA256
7b0e4876561f9b8fe12e1e95dd533ae00b5d27f883ac683e207899eb6f931a31

SHA512
c03b151993aba8ef43c79aaef64eb20d4f07c394b0babcb6c5e118a5f49612c7b1c74f67bd6c7faf3ecaf1713f01b8f5304ce26f36c7bc415886be9807456e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8003250ca5e70001397d1a9431d75cf

SHA1
65bf46603576432a171ce0bdcdfdb62b4a7f0a9e

SHA256
8e2ecefd0d4208b50333919025092849c9d5abb4fec9c501396970dd3c9e6502

SHA512
92a37ba8adad2b744d8bb8a623356f3e570020c050262291fe887301ad10660f9b2fcccf6f6e4c901bf2a148845c82781267adbec0f6381df868cfe83175732d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADDE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF29.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit