dccd4a230e687325d05637b504dc84c117582c34ceb36f72ddee3e04cc81b6f9

Analysis

max time kernel
118s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff612c4e82ffedad7d39390f4dfa9e26.html
Size

9KB
MD5

ff612c4e82ffedad7d39390f4dfa9e26
SHA1

1fa5c6a068734ad905d9fe1f59cc23e5fb040cfd
SHA256

dccd4a230e687325d05637b504dc84c117582c34ceb36f72ddee3e04cc81b6f9
SHA512

8656f78563ccbfe3e3c0dcd208e0e49f4f8fb6930957bb1900154d89cfc618a4d61143848ac611dcfc97a842c018b113671fae8dcc68204d21d980070887ee90
SSDEEP

96:uzVs+ux7OVKLLY1k9o84d12ef7CSTUSGT/kPs8bpUlVHcEZ7ru7f:csz7SKAYS/vhUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4060b0004e43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000067cc99f31f30c0d3e09b04422a594d9ae152594aa3ea9d6eaa55ec014f875554000000000e8000000002000020000000f992406da1f0a4413a539f24a6559852a8bf190972acdd85dbd62bfef38c7a9c900000006b1900b339ec3e4eedb52434ae2f0fddeca222ff0f8b91806b0e254e8fa2a49435cedce97a0d2d7d68ae2078e73d2468c51095c5a3af64eabf649cf0e0f24e815048d0b43b2ede60ab2b24e25b187c70a30e951f5b87283e6c645db81f91c99abe2e74505cd9f1163f71421346a013b3d103eede071cd2fb09437c04c22f54035f56d25f1e8d9aa435441ecfe8a2813440000000fc60630db164bc41681d35036189d927ee0e71f982a37eba25b2d2e824f9ecd53188ced9d1446db282f93e67f05a295786a3694d1cc2cace99495e486c26720f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411002364"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{299A6781-AF41-11EE-9853-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000508edebe28a2d948e60cab6e46dd924b51d5f8b375ab171a98aa69383504274000000000e80000000020000200000008a32c23f99ff9faf9f16468887215b4966ce4a8027731e5cc71cad2ec489371020000000138d4a3a4a34122ea82864851c86bcbf976998792732324d7587d4a41611f12b40000000ea67635b6de41cf97831c69e6efabba4b85e69b490d5807369bf3e4dd9182a960f78669bd03047b6c9b79b8786a4bd8af7327b867632bda559d50f1067e22661	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff612c4e82ffedad7d39390f4dfa9e26.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2763c0b3ea0d08daee79ad0229603746

SHA1
4a30646f1413d7fe074eda81fc5e26d3ef62c2d9

SHA256
771c19d452d8345eb9061145f4c050eb5d8ff63d4692ec2e009aa4cfc120c55c

SHA512
bc9ec99080cfa2dff756b28217c81b025a6bbf20e346eb37308177c572319efa0ddc49b44dae4b17ec8e2de996c4d0a6f830883c10bf89e23dd3847cabecaa4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3183fb96cc1e542e0e2b6c7b15ca455

SHA1
8193c6d806532b833f354a54eb5e2996634cde7c

SHA256
8393af26156401bc5afc23f428be03a4e66f802e7e530176321145a2c55d1f2a

SHA512
01936453c15427ac68e1a66b6c78bdd95e58de4abf20f19d4400074cb62cb9612253fa7e9db8e46a12480f3a13ffd0209a97fa6461b8afd3fb8753da60486009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b24c8fd1c09f24e25e01f855e801aea4

SHA1
8ac9b75eefaab0027dc99347aad45df6472f95e8

SHA256
26127fd7f34fc5e2a70bb5457f1fdc60442e4c644d0bc7d73f9e211b04b6e5a4

SHA512
7068b65fc915024aee0c77dd14871dbd660042e405f73439875c0eb69f4f49421a28207a8a034332c0daf5bc3b2db4487872a9fdfcf8b9b2541139a36c35d3c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d586f8c27608ce8f2ae355c3486d1bb

SHA1
e4781c0745512e54291fe583c151e65af3c41d31

SHA256
c129faff31506391dd27a22315277bbfebc0e2fae868865677b2c9fb186b8243

SHA512
8e6d24a1df5e8144aa669eb26ec9830b40b86f92f55a53327d483bab5b184229277838c1b727e79f4ac4964109361b76cb02d9c01e6eb2baf4b2e34e8c53c309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e458beb691c588646c67ec860f8de6e

SHA1
8fd2334aed12b05f7fc194f3531f33f5474d8032

SHA256
3d0bd243c7f2c8a0d90af16d4782a880c4f88ce09e63ace2ca47d99982272e71

SHA512
ea12ddd15e083c0ebb1ad1fdc4b542dc749810df435baf64832f2dcaf8cdd08f1ee86604aa55dbd77c4d2faf200f0f98418e39d914d37bdc9bc5eb770f02f70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f50e2e935589ed1396f120a0951bceb

SHA1
cacc284cd84a05ea99fa121e54ed2e4363048d85

SHA256
c90b172f9b9344587a8e4d1f62fe7a05e69bd3d0b034c938bf41c8d2883e2efa

SHA512
55dbae17e6d5feaa6b4139c88c59198fb8a9a329de0b95ecf8313f9f33b6ab076647a5e40d9afb46fb677ba66c014425c1a51830e82cc7adbd3ad7bf760d5a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6197a209a9efbe6a4f32334bf710a31

SHA1
72339d2c101d3fdaa60b4d3e62875224838901e5

SHA256
56eb706c81c24934701d2d58b991f68eeb953ce211c484d57dbf8f02f85e83f8

SHA512
f68402ddfaf9f89412c4b0aa6788c4f816e6fa3ea5478cda98cbc2c22b2e0ca9b8a5dc1db623025ef8abe1091c484e333506c7da7ed4064b05d14c599e2bacfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b27830f0f1015cea5b0ee80be2de6f24

SHA1
b11fcb2eacf13b8800a27fe4fdf57e11cbe1eba7

SHA256
74645a698345d3f380cb8d799183a48cb6f5e27e9d26a61266f762e2aecdd1d4

SHA512
e3cfd1d3f1e50d50fb0738346978ff5c5357d00edc2f6eb3a9dba013ec50d115dc56aaf103f7b9ae754aa8be2614d48c9a77227dfb957e640941f05ceba3446f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9971a9aa87dd83d87ec35c9e109f62ec

SHA1
ef0a3c2be465b6230f4f417311efa57281f0f328

SHA256
de488586710b034035731f3f1c4aefea60541b67b7ff7213047fea15e401b0f0

SHA512
46f861915b4919d75fb0a3045a1f93b8f9d6510c594200bc568649e3a9669c225b0aea6b069127cc22384b4baf4d450d05b780aa31828b398e670bfb5d7b581c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef005be0eff6ce8c5514ce17a449055d

SHA1
46fed0f8b9ca59369c3152d9da59bcfcc679236d

SHA256
fc0e908c5cda69ee998593bb27a79d084951a056fa5160822514e66a623b7351

SHA512
28ca37f5ad94baf484b53d099b3ea7b0a9802fbb9afb2afcb7a0a1be060d9d97505c7f7be2626173e243dc303a707ecf833974e0b5a93a9d097ca8cc155701f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79fcce73fc2e58236caebdfa0dd80112

SHA1
941daa951d5b47958d3c6e6bf5ebdb448c6e145a

SHA256
9074b56dbc46590c17bfd573a8d4d1f5f02ba751464c7eab526b91be81961d63

SHA512
692d50656842ff2013408893563ce13e978910ec6153e9f5961472db9f2a873970d97e9dec649686f731ef51814e8807210c6b7dbd1b52a957a99931ddc66452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faeafad4736528919acfb65fd7d9afcd

SHA1
c6ea963c3dc381358b28f2ea5069b46791c78660

SHA256
bdec9aceb6380d36cb77fbe23963a9d4c2247f0ab7db93822d4577ae61d10a5e

SHA512
868b4cda2b61f711757e7cbee4b92482ee1302cc33cbb49910443215069037dea4d9ed60c9097d41616e6e9d8538af5734a12408ee28c03f4ea8266c271bce24

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB770.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB80F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit