b3530625884fb4f5120e8641d59aadbf5ad2e8c93346519d688565686e2a5ece

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f895d55b8e4e84d619ff9d614b1fb92c.html
Size

49KB
MD5

f895d55b8e4e84d619ff9d614b1fb92c
SHA1

8c692c2b02ddb5ef6df323e502cb210fbc44a316
SHA256

b3530625884fb4f5120e8641d59aadbf5ad2e8c93346519d688565686e2a5ece
SHA512

657b6772495383868770320c7bd41cba3a0f713099c8157b7e0046982a9dcb5f3590cd7bcdf4488a731367ad52aa2c26765138f6c8533a9cd869274004f14a1d
SSDEEP

1536:fVCjjORlVy3SjUmFN72jxkj/kusQGGnDAzqOiIudBJL:tY6Rl8UFN72qBsQGGDAzqOiIudBJL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000063cea905c9eb94b6dccd0708aa2db9393557a87085a1af71b92c6f8fb3dbecbb000000000e8000000002000020000000636c6a61a96d294cb0e6a2cf0fbc7c8b37189951af5a0e3b1215d677bafb02bf900000001a8e6b69ee12353fec547b0a1b559c59cc1bb8b75b428ee528f72452d97fd815be72f1cf8c7e457b1b89cdf8087d3eaeb51ed2d762a0ac3b72047d67c536ec517784ebff043fd770306450cdc8ecd41f7b60cf32bffdc631f70bc0481e5da888bf144e796143ceb1f37f9b5ccbdb19f47cc17c07f7e777f6d207bf2b76261e2770b9f32196cb6524b547765f09435e6240000000fb817f5c697447e8af52884a4cfcc030a40b09bc10c0f9d05248ce45a709feb68cea164e18472a9ca67bddb1ab5880751a6dc9ffcd415438efd266e0f94b4e4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0638CBF1-AF2E-11EE-8DA8-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30637ae83a43da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000fde9a57a840b001dbaf663efc4fa81906919beac0d82bcdcb76d43c40899197f000000000e8000000002000020000000dca93ed5d659a68c11e102e53c28dc0feb315ec97ad0fad8d1029a39d0aa296920000000134a325e7e7aaf35af0a9037af06664ee0e44ea997ae3ac52ec653fa183ae81740000000800f2460d344d486bb293e3b03c2d9604cc67d0e41c4a08edac1101ae2be42a193232fe588bdb1f784c0790636614f433a5065c071e0bfd9fc3270d7afc5fb4e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410994157"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2876	2512	iexplore.exe	14
PID 2512 wrote to memory of 2876	2512	iexplore.exe	14
PID 2512 wrote to memory of 2876	2512	iexplore.exe	14
PID 2512 wrote to memory of 2876	2512	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2876

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f895d55b8e4e84d619ff9d614b1fb92c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\87541F86930226C99C98E91DD01FCE53_6F1B719A87AA5912054FAE3E8A330D47

Filesize
472B

MD5
466f6fc25884a095e93fc8135f1375fb

SHA1
c00a4e9bae68cb27415adb6febbdf54fe902dbeb

SHA256
d71167d6c8513d0ff22774c194e5c456e4380f7faac054b008001af66dee1ad5

SHA512
c1afa04037e2d1fae0f32f79b522310ab761c650cc3ae5a76fbef335ed4c2b4a8acf780241558114f2d2bad826ed19bb04e540660de744cab7973e80de6697ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8158f2eeeb47016be4c6a8cad43a623b

SHA1
8f81a7745dc22412b0ea7dbe01b6d8bfb252af52

SHA256
8097114b0f6fb0819510f004710ea5a80aafc70d1c7bec89612f2115ec73e04e

SHA512
ba71ed335addad846d71cb4cecec44dcdb282d31fb99fc0a9fa51f79ed19c839c57fa7bfe154b2a64a0c6db5afa26494cb7d76a5e702ea8a474e0675f4f48690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b973fe9a4a32a30da43dda461600ded

SHA1
695f3baae70549a3847e726d65f0e7a2b8ad6c65

SHA256
5addd86c6b99bbf489a46757fb3a9206e6681d7cfd977c4078ef34b658638149

SHA512
143d45498abd173782f77e92739a61228420c0ce18fdeb9d3943e02801c5d4cb1762b2990ce4bfeb6718d85ae3273ac560d8752197a2adfadc2ab4dddf862b2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6890bd3fe5ef45da90bcde0bb5f8576c

SHA1
c3965d5ec811c9eff09894ddf03dbce0788c6506

SHA256
1b1eef6ade856a018cd552d7f9eaed85d08aa5f5f82603b51782f70ea36c27c1

SHA512
f4d58cb2172b2f057ead9f570831c3741bab7ecf96789be6b616ddfb074b4dfc3a8390e1f064092f4ee63e55dcfe69151bbdbf7c7f3515f67faaac0338768afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b3db9d4b8ef70fb22f2dfe1585cb307

SHA1
2bbd1a67de1184f7904d44563bf77527ee230ccc

SHA256
90106a29b7953304dd5664981c04a0dc8265ff4f233167edec5e6d50ccfe9c4c

SHA512
3cec8db51911599dea75cb93b93e18d9259badaf9a4ab5f46ab34b38e5e2eaec5006168dcbf284e79b2a5b703a4cd53dc6960dd2116a44a7174a7d3760f6366a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beb3feaa6e16412b458e958294557542

SHA1
98e82edfdb5347728474ab169aad4891db2d41f0

SHA256
62ba58293c9c5eee0c82e1c9ada57b65b326277ac1d9e8cdd4ab8d1b341f7c4d

SHA512
db222b2f53ad3cc56f6d1c1ba06a67963da106a1d654db73c1b17ca09868e3f23acb6fa281501723206c2c8a5358ad53c082b0827c56d14fd01c7e2ccd727536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0ec34023ed466c5a774fafa76fac35f

SHA1
a3cd80df27cd7c5cba4fb47340e8bbaaefdb6d79

SHA256
bd5dfc4474023d0c329731ac1110b7ec7370d7dd0b97c4bd8655ef9f5795df1d

SHA512
27867c1ab3b3dc90d34dc07cc5aaede6e89d673cea050cb7a67bfaa286563c8aadf04fc1131b51dfebdf2d3591296d51d3f7edf06a2401737514be734fac2fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921f2e5ed89d147d7ffea04905310468

SHA1
4d32c6ef1b8cbc05531c282d2c243672013b29af

SHA256
aa6bdbf83c3d8de27659e1e2aedc32ccd95bd2b2a2462c7fb77f270f73567b51

SHA512
74ce9069d14bf2db099f756c9d3545e12e66ae031d7319d46824b38857f9c671af40c93825d4e293edd62e469f983fde1cf61dbb5ee84da87c534f19e7c08dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b83374bc025c69043a069ddd8d8ab53c

SHA1
d9f4be949813f04457b158957b465b0d35e48ade

SHA256
865afd76b362d55443821d27e256c981bb824e749f0138d0c458801f60c14459

SHA512
06d28f09f5799a38c476c4aa5219f5446f80a666ff25ba84601e0a621662dc84d4d8184108edfd768b121a96e9ab2185a054ab9b3b6313d12acb4e79d04fa813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0000e729d2bf42d15fa29dc0b5b11445

SHA1
51363b4e3818e5d4380614792625ebab403d3178

SHA256
edb9f3ef45b383f7d4c8a736279a505f6d038311053ea3337d2632cdbb4ee08c

SHA512
09bbab1b3c8d5d7ae6fcf0fb3c60e0369b8ae100a79ebddcfef82baf895d09771f125329f18e7c0315a79ffa139cbec408c1e75dedb67167f464b857b6a007c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e28d7051f194a58c30eebc9f189c5c79

SHA1
b3621579480d85f52ce6d848502f94682504a73e

SHA256
3f94e0848dad19b4e9a5936f8f6bca85da890652f2b66c2256c85d8419bc9038

SHA512
57937e2d3f749444a0bc1556963bfb3c6ff1a362fa2ed15fd58e0d521fa8752125399dac216ef798c02783928faed0814dab17a2c67f94a6eec709824a2203cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d33770656be665d1b4f5e5001e960ec6

SHA1
d0aa36ca9e95058a96561a7f98adedb5d308c1e0

SHA256
3d4da7c8842bde07de7fb31074332ebe501083e005192c556701f35603679773

SHA512
b4880bfd19284be931983974d71aabdfff5d5ba341b18230a84d56622eb17b4cd545e6e9a3b715f3e4418b80fc5048cdacc885372e26b91361a0153754e6d1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072f1337adf6b2395b156838fb5214a1

SHA1
550b0fb0f151578502157729dce74361a6a51007

SHA256
bb23d777cc75bed3d67d5ff57e784e1f5ac7fcb2893a2de596e1a78188b31929

SHA512
841734c2e99072588a10194fa1298a93dd8529879487846ea8718d8b98aeee96b4c9c10f4b365e625b49738a97828fd963a82b92c3decdcbd99d47ecb9774aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
691acc44d1c1d5831247ac689ecd7c94

SHA1
7cbb4bf96d501f1f0b187a4df3232a6235047b6e

SHA256
814b3b526d711d9770f8b274a12268ab2b02c34a0f0767ebe37c74326f33427f

SHA512
afa26485f2376a5c761732d48fede4180d47bfca43986fb41eebacb4196e7269c95ab074782da8293d52344815a04843988349b00f0d7bf98f1fe22c8be1d9e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1889e1922c62e2d0a6e14be023b06a88

SHA1
841d1bceeea39331091dd5850729b102e16d2228

SHA256
54c9abf02b43906a6d509fbb314a8964c43c44ae822332e04c53f54af7574769

SHA512
1b237719511ec64d6a13956dc6ef9ed07b92a2dd9380be6617cc2f0dfb4a8b8dcddf727d4e858b5842df409dac3892560ec34157ecc93ea02b776354069ace97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2973.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit