e60b88550256b026646e5120bb0e1cab165919fbb4b49ae461414f3fdeac2187

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa5b96776ddd76be60628ef26edce9a4.html
Size

98KB
MD5

fa5b96776ddd76be60628ef26edce9a4
SHA1

a9497a2d95642bc8e8cbd3557d70143c05f4d5f9
SHA256

e60b88550256b026646e5120bb0e1cab165919fbb4b49ae461414f3fdeac2187
SHA512

4ccab726fb077c23a1eb1320781be7fa2bdcdded39b5bde5f389de4bd55abf5bdb202bead9753ae5329444f6990e15abf293942f8a2921fee73997794049d50d
SSDEEP

1536:SZSXPzo7S4KjmVCwzZ2wQzR/kFZWJRigGEFhH2csw:SZSrCVCbTzR2IigGQH2cF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002c4d7248d6153bb58093c658b2bfb52da64961410cf0eafd7c6f6a27bbf5756a000000000e8000000002000020000000eb3a89a32b99f40cd6451fb210a302a03497261418f45c60f73ee992803fbbfe20000000e35bd9f8d6489c5ff035ec28709c98d4c4355eb3138f9c1c903d4482a6d979a540000000244382ceb7fe1dd2566b8e181446005dc8bdcff55808f2afb7d49a21aac0ed6887cbff9ce48e24abf6c34b9fbb763ec73ccfa277d6345a707f2860821ddb56bb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02ceaae4c3eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013a6fd1f08d3ccf761e5b9b7d1570d807340cada5fe1927d85f97c9e32ff7ccf000000000e8000000002000020000000404e84b40f2ad2aeb082c57331de28187526ca894391a4a676556e1788e1c4d0900000009804c44c938ec5a21613898252418b6125adbf54f1790179c8c1de79d58c5ba204765e3975b96d6b324855af69cd932587678d9de58408b1f465ddc3b2340f217fc9d8d1a59096c5f7b6d179d2af5ef3d223cc4b3957727949b327632f2e8b2c18db852a47e1d76f1eb2af7bd52528078b05e226606dda0e03d8635035f91d379ad83b888693968e8db7a38f6d876f3540000000f9f47c54e2f12ae8068732e343cbbac35f430ef9da6e1d7a633e5ef49a931c622473a4b8b48d80034862d9470bff5d5b5a0dc8dd7ba14b1074189682249574e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C104E0C1-AA3F-11EE-9D00-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410452003"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2184	2288	iexplore.exe	28
PID 2288 wrote to memory of 2184	2288	iexplore.exe	28
PID 2288 wrote to memory of 2184	2288	iexplore.exe	28
PID 2288 wrote to memory of 2184	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa5b96776ddd76be60628ef26edce9a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3b39ce61ac5bde2a77c10f4fa979ba

SHA1
b8360bf0a7a23029ebca44f41fdcfeca90579ca4

SHA256
bd65cad1feb657a7f77e7aedd007bbb4aa81201304056aac788e62a4938b74d1

SHA512
1c890d7c29473f295045635da3edadbda9e8d963dcfd51f92542a025ede879aeef1dba7378f984daaa75fbacfe9d5daa008ba71b3b575784ad4a8a4311e396d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7ed028abcd06e1750f86f4013026bfd

SHA1
e70134f75e5d454a2a684a1c13f84258c9d9770f

SHA256
a1bebde774ff51e1c695c0f70acadfbcba5baffe30408636b7a7fc0e37a669bc

SHA512
3b4491d18479cf6f830a8175d5d2bbf7fa1dedb8d766e586824993cbb877804ddd59ae805fe93f9d7cfa50dcd7beb60f2f596adea1683ffce3e303feeb4b5147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d19c08ff0bb7bf681b4160674e286f

SHA1
f37e5f61249f05bf52e27fd52ab064271c1e9f70

SHA256
a8906c285c136d255c0f65fc392b7e71c40fb5560f30cebf75352101f7946317

SHA512
d4539cd1bbed3f40e02d18e9dd532b3b621c262dcd8d3e54d6b1c22a43ca2990121d42c22853283022304d0e8c00a80571a9aa290eb2b8dac2098bc61d22c804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f551bab0cb0c124d40fba64d40b72c5f

SHA1
8653ff68cfc6f026811bd554a8bd0fb41449767b

SHA256
1217f74d826164421e0e85ff151fedcc1e7aefa934c9d44adb568f0ae6b35fe3

SHA512
26ad3b4c78cc416cb45dbc0c3a2f4e38c33ee17211708ba014d8df2ca41270bb6c2b650eebf9027d49d085e0b12b0a2f124e0b4cb725582cf444828d8fbb0c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
038209d24ddf41108081e63039941110

SHA1
051dd82b88a8ad5ec27bb7993f4e3a1184d4185e

SHA256
9f5d5be454110e70f76a44d20598c7cdbac7099c76ed6f062c94cad74ec2e384

SHA512
d5c18e9934ed57e51f47d5cc895295882874b21b7e0c0208b972c9af502dd8696aa741d0364664a4fdb39277dd8907ceb22cba1d76697aa8ae5408eab48ad142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ced8a1d4b9f7c57253f49d90c4ed1b6f

SHA1
2a51df6eb2aa400a87696b4b721f4715bba2dced

SHA256
d6d8bdc3e6a756f6895fe086739e4724a9d24286e5bd889bce5892a62bb9f255

SHA512
b97a99611396b814fd91f4432ad62967a6d8a8a09b97c05ea9a72831cc020a4630d5696f98c70f6708af78175e005900e46a9dac4a7212cc05f892a47241a6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9131daecd357db8409dc731dd7f7c9fa

SHA1
6310627d04a3ccd36fc6142f0d2a928d63d59677

SHA256
fbc30eb26d5ad94337f7979167c1fb31951d3af33c3d5d7e6e92fbaef75b7abe

SHA512
a7a81c9169b397e45179a949eba6b09601c525985f91ac20524fcced82fac9fc339bd5ab015c8b4863282ef85d435806131012d267f451886339b1b447ce0551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
066aad40ec1d5e87c7dd7b278f9f2527

SHA1
92e78a0b85c40cade43a81698368a74d815af998

SHA256
eb0046f86291c29d3fc5f3f2802b1fcddf2cca29f3d51ba1d7d0ced0e9fa96ec

SHA512
c29bdbc6c792c85600e3a1219cee560a92966d886be60b72923d3099f8e3526afbbcf3b031f2bc9b80ccb444544a10c69e7d2ae00a5e09abd45cd672af825794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e6242a898d437eaa63fc910c8d44dd3

SHA1
87a3000d3bf920443ebd839d91cfd07067faec4a

SHA256
836f1990dc66ccbc8a1eeec1322d9669d1052930bf7d9c896e3ef130587f4a0e

SHA512
04bee801197d872b93dce2163b1beecf22848df7818b5408949c3c6297246ae26ec3956e6e0771cdbb5b7b3315d2421429a395be36cef7eb8d138e99967c3163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\J47HM31C

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA305.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA337.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit