ddf2abedcd4eb5b14f04c90818cf2b1ea002394e071f6d6cbe1c9cd0bfed2e1f

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff2c1d99cd24ab58e7eee332f0a9518b.html
Size

42KB
MD5

ff2c1d99cd24ab58e7eee332f0a9518b
SHA1

dfbffcd126db8272c234d9ae00812c0715b74458
SHA256

ddf2abedcd4eb5b14f04c90818cf2b1ea002394e071f6d6cbe1c9cd0bfed2e1f
SHA512

6a718557a9f7793def2d5ee465fc76bb1ad715cbf1bd9a4a9c2513018bcf3efcd8ac29c3cc658dc8c6656560b402b41d6f02aa7890dffcc4fc98482bfaf04289
SSDEEP

768:JgTdcqpX/pJdgvX+5pt4Y7FZeMRk9+ZMzyWUVaNtH:JgTdcqpvNgvX+5pt4Y7FZeMBMGF+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E0D8591-AA5A-11EE-B0F5-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000fb7c91399c196e23add40e491387482823ca64fbd371d8c0317f9d1170e913ea000000000e80000000020000200000003a0eb2a3a54de4656129c9bd1a36e14b1bdec65535f65391967560b410d640a820000000f1db649a82c0f739ab424ad5f87a7431041d8ecf8805c315ee764c15693088e540000000fa89054220f08132a4fab3f87f47fe91d652c8d9ff1eb0b3bdd211632295c0d012403267120d1bc528cd6d94f0d3fe78f2198fbc416ac7ee7e0906202137fe9b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105be16d673eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410463496"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000be5de1d2363a4c29976d1777226a6b98f7b7195bc50b9a2977eba1c1d03295dc000000000e800000000200002000000048a872e1fa09b15a958af1879daacdd6de88d126b8e6d61f2215f00b19a9846190000000a87708a0f82e6b2cfed1a6b0eee7334c5353cad79168779ec34d0ca4df4915ab1e2122665198ab292a22284d09ac26bdb1b5ddf6a679de794383f29c8943e49a9c89e91cb175b72c7b5c1cf0dba5ae393dc9a05cadc0a06698e4b19d229d2c2f65dea04ca769496acbf4e126901cca94bf6442eff997f351c1c9e79ee2916ffb65b58f6e5462b10cb16681a9955a3de040000000f7f294a00a6fee51678d7874f116b5d18f78c68c1d3cb8d1800de2932feb4f5beb1731ccf08c846c62fbb155e58eb63cd524391bac6a8258f8e52991276aec52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff2c1d99cd24ab58e7eee332f0a9518b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0bf2524c9f49f4bd504eb58efe9f4a6

SHA1
229090a9cb3e7d97834bb1a3f81e218840d80d1e

SHA256
f358df3f1147cd7b90077635d42636af1d0e3b13e17783831f0bcc2a5919a778

SHA512
29de6f10c279f87018d788c7e7948d3bde76ed85099ddd64d77fbae82c37e36e4acdd9643a804cbafa9a85448d5241f8d22b61732e3605da6d407a7bbecd980e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d5c6f6806ecc744f0dd3b045cd8eefa

SHA1
509c4764a69d91e3c6b7a1c88ba61bcf94ff20b7

SHA256
3b89db5735907e9c56062563904a46339232ba9b46f1505737ecfd7b98c673d7

SHA512
20fd01f0b569f9eab96a9822f0d7c4c824a430103e80d39cefb34c2a8ec9f834d37b01918a6888a5c3674b9a6367264ed54a60c3145437dfea64f650d6e1789b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3bcd7b32337b349c65b2a981f529dd

SHA1
7a81ba107888bf232f97ec3f2b7a9688635ef0cf

SHA256
ec2529b0a9b35c5d6cb99df2ae4a2837c48b005a8977e7847dbe340c98cf3a34

SHA512
319e5723f3d40a2168727f4734746e8a432aac7f534203bd6831aadc8ce15be0f8aa808d27623c70b40814280e396896a40ae37e02e7938570e45cff87c4a617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614dd6f7a6e81dc8c756d1c95a04eb06

SHA1
5ab90eab9984005b022278060def3006a9be54de

SHA256
bffb44e3834a2e5adfea84a9400277f3b1b74c3377fc3a6ac4f4a283a033eea5

SHA512
6922a644ec5cb16c8c50d7064384485757f1354fbeef455b16faa7cdaeee2cd71d676c6d074c7d840971413bda8a4f2a107949f0697383e4aa3a888f940bfd0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc07a57e8a117769913505d2280525f

SHA1
82151a2fc9bd0e7eb53bc25bbc6c66c4add66d2d

SHA256
71be230fd84833117ab8ea18e2c52261bc699fae79e3cbce08409e2847fcc932

SHA512
f2151962b110c751c16c3660b5ab6857023d0ec43b6164227b8fc3b388ba3df9ec8c52f345bbe58cef44cebd201c6a2b2fa0045c1179189d32119c015cf7e245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0c1aa2582432d41c77ae554d1ad2d7

SHA1
a3f401059f98644a5870d63d85f3672407361961

SHA256
168d993f7a12519eb6b13611dca0e7ea2a8717a90379f8982ab799868eb3b721

SHA512
f2faab5f6ccbe6e5d66e879dccc8857d8f3e46b0535ce34dd72af5d7933575b52e5cdd5570d4a6cc9e2206ed6f93e6bc9db65f909da080720ef89331b64e8e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeed268f715cf7cc5fb358899bb24869

SHA1
d0810efb3d20eef760b09a8167b85eaad171e303

SHA256
1f2da93759591427713aa3ea9e9ee223c13a375154fcd97c2ee6ba2b6f442818

SHA512
5f1c1819a52ae64576fd17a96fcbac78f2e0f5075032f2efbd6fbe4cea8776c094b2589cda4d0e256144e8dd142e927aadb8e7738f1b0cbea30aa8f92eacbdc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dff36985af292603803c2771d6aad1d

SHA1
cc658d5414da732b2d32a2debc3d2651645ecd4e

SHA256
52c17962e616f88e28ca612c4c3cbf1e67835b1ce191794ceb6ead621463e473

SHA512
e63b841377622c986ca42910603b4f29be9029e9c00449b905b490ffe7e472033244cfa28a0cacabf1079f9147cb5a4040d5e46495fe29ed29624e8c4a2ea41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
927d293835150dc3d02b89277201c75e

SHA1
fb2d18efb03717de82718f0a47247f90964f0086

SHA256
d7e242ef0f8ca14149ca133f0cb65f30d36452849a3ce9c7e34a0b759a5b5cf0

SHA512
19ccd112d1eaa74797326f2fc2fdcaed125e935ef3a23bf069f1085347e0995985a87cabca2ff07b2c613f4988e96b49cc029f565be7ba49da1f8445693f2c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd8f768a881b9f40fea50d8c1c1bd889

SHA1
5fba99429ff0d1368398a73c763b86c9505db5b2

SHA256
5fa5e9272418d3b3b002b8ab037a0aa5599532ffd36bca6d5fc2632e60409fa8

SHA512
20825e0831f950b6744acddb2213e7170b0680981b0a8a4268d7540c0d5745901f8734fecb73a68d6acef0c3602f1c08dc19d97a647ec1fe93f0385e75061a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ce34dfd16a9bc393b66100355f9a6fd

SHA1
a63dec589b0de7118dd9e80b7e19eb6ae4f2500a

SHA256
b3cd2a4821d6b47296434d3d574e2d894a5147d80e0d77001b0ed429a9c123b2

SHA512
fd0943853c931ba523e47d6f9c070001bf262e8a8106973d60de800d8e6b563bd03c30daf4aa0ae00fce1ce1bd8f7e84b08237dd681275891db89c6a4206b913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd14ee119095d2b0312fa250335d53fc

SHA1
4c260ac26dbb6c1a58a3683848c8e564530b977e

SHA256
cb8d35edde00aabff304ccaee6cf71988264a77bed95011a8be3df3e497b36d1

SHA512
934ae624422b9a935f94a50dc1bf8eea1875208ec87bf8e0d14f2f11dfbc6014bde717d18a6544b6fe699447d4809bbfdceeecc3b47d68f6a5da478e456cb5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDFE7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE17F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit