e46ba5f99add1c7b5fa05f706228a6870acc5a76051c27e39c5eb9566bef8c8c

Analysis

max time kernel
133s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7b09f895f972966a7a278055c4180e3.html
Size

15KB
MD5

f7b09f895f972966a7a278055c4180e3
SHA1

c215f84e920dd8090203b5407a2f1395b0837e9f
SHA256

e46ba5f99add1c7b5fa05f706228a6870acc5a76051c27e39c5eb9566bef8c8c
SHA512

f74b207cb8b417660a45d0b06a2c3a15802d6a782a60b52e25a9d5b976516b980536bf7d761b208278c844879a9d439462491d71030df6c984ba87b951f6d959
SSDEEP

192:k3E0qrP/QhFq+uAmC/pJ3z2pPtlcNzVz32iq4A5aZKe3nXnyeOD+VMlrgvw2:sE0qbOvxHrzaQRj2+AkZKSn3ye2rgvw2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004708a58d8aaf77bb71510dd5603733bb05c50195143cabed322b1488c39b0aff000000000e80000000020000200000008f8235394d346e20eadefcfe930cf0dd41612cf887b774f9478a8fa9ce58bab2900000009734380eac84900c989b7a4d57e8abecf43f6db5ee67a2b59e49dc2bec47ded9b33542daf54ab49856c57811903646798f4abab1e44e860d9c22eb701dec0928d77a6e4895219affc2af6b2bda7d7d48ec9c1f2a91a289a43c44c235778b2ea0485de07e70529e6699201a33b50e0dc87bdb5f712658ce9f746fe203d204caf3ad3234bebbf74f13928044d9e763799740000000a56c1f7f8c42874322a78db365ff2c5c18af85bb9416e8141a40f9f07c3cce82e73dc220d325cec9803a483b0dba753468acd5d2ebb8ad591d254b293da68e47	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0EA699F1-AF2B-11EE-AF44-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000079c6ae6756cf38422d2ac542eb031d115a7272f9adfc7b1bef2e805d4951298f000000000e800000000200002000000084b1bd74c9111d8dccf333108c301d3de83a9477e97e6213906e7b7bf5c5916820000000f35bc8a0fb3558e957f3d930088aae41e0d173b0e541813129b7d35a5e61d1c24000000020dcc062589a5ca0b81309e8d688794725bfef4112d84afcfc37be13a015a85f85aaa4e860e7034a0b336776ab8b68ad08d9e73bc5e2fad4703bd5cffb7fba33	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410992888"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206d4dd33743da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
1180	IEXPLORE.EXE
1180	IEXPLORE.EXE
1180	IEXPLORE.EXE
1180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1180	3016	iexplore.exe	23
PID 3016 wrote to memory of 1180	3016	iexplore.exe	23
PID 3016 wrote to memory of 1180	3016	iexplore.exe	23
PID 3016 wrote to memory of 1180	3016	iexplore.exe	23

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f7b09f895f972966a7a278055c4180e3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae72c61a2864d7dfe91187f318a20e08

SHA1
528f7df03439298d0134cb0e0a38db2d2f8287f0

SHA256
27ffa3a5d216d6130a9e3464524f667895074850e7165ec11093c89e7c00751f

SHA512
e576a605eb1b59922e4643f0cb1257b2a1e5e5cf5b1415d2361a21ad0c8df6e1a0321828d55be3f6059c5b3e53623f3b85f4038c7d2d7c180ce15d277c2964fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b33cd2951ae8108d188f20c37a3f857

SHA1
fc4d32fa6df3ee975e79d1d252e1a13fbcff3514

SHA256
55e01c43f49cd02ea61e6f035c8da3fa6fe06b525829f37b3d286010710b158b

SHA512
cccb7def5d88162e838f7cfd3780f20ce5eb80531a924d7006c071b9d99e36d0e377b3e90e26dc0d4beed94b73cec7f54460b126f703226b45db7d72ec6125df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a7269bcd39db10f5ab7670984fb6fe6

SHA1
cbd568e028e7052fe6497b11a18397f371a83599

SHA256
7953e213d6975bc10d6e3d0bd03468a9272e22993483a37c1f29b0e3df8655d6

SHA512
72c764702018a818e436f9ef397ba1bee3ba0583a7e933908d6e87e03de6c6ff2e415c7af33e9f218dc66e4d445244a9ac0839e83bc608c87701ecb0caf5ef14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5224c580fc221bfb8aa959a03f6bf362

SHA1
aa867bdc2393fb2e84086653acff9e7ebed9d8c7

SHA256
da155207cb9efb93a8dfc8e71afe66ffce876839c0a7ff3f5739356e405f10bd

SHA512
a9b8dbba5472456a24f968a6b074d0099540e15435cdec8e1afbac334f5c887c06f100f5502630e76dee71a1dba41c69e80608b8843acf790d2b60c26885a9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad7d96448b06d281ea463b7b1d0d2916

SHA1
2246d949060f9d4645e9aea97c165c63e9dd4e49

SHA256
3569a3fa463123139b7e48aaddc8d2decab90ee96e06a1bbde9b27ec96f5e7a4

SHA512
ead483a6c45a0d42d7f7c136cc02b6a04c055ff39b71d6ba9d805b0762e2770920a4a054b587147b566813c36afb3e0327af5d8598696a466a4a208bd0de2d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
675a94e70ee181d01de11196e52d8ecf

SHA1
b22d9bb59c661b7100d0b82ec563bf4917be7ab1

SHA256
143a3f14559e8555615ba8ade7f92b60cdc8d77f7f2419fa27e0125cff8575e3

SHA512
885e1590cd6507d238a999048b040521f33e060c047f89a8b3426292be8b133af2919a2dd7cc7ac26ad15eac5fff3f539c1357ac653da747b2ddd7b860c6feb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d2a424e188e51b9d03f60adc2da25e

SHA1
3e5917d8292073a4d6c4070a04431c544e1ec014

SHA256
30307f6f3bbdea56c0a25fe4083a1b8c7654519128a4b09341629387a1f9c540

SHA512
5e3113dfe8effb55ccc18641f3604e1a710c1688cd9ff924e49b8d332fc7b28c2dcd300580efa459bb1c9d17822d01603cde4601533e25f73deaff8d134f0dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7800a4a9baa37ff42e6d56bf8a7dc15a

SHA1
3abc3dc744b0283f09d8e5e26f57316dbe1f3678

SHA256
17ec07ff521058bca75ce43abaac0058f08f7f451d4fc677e8ecdc62ec25c191

SHA512
9081aec3afee9a6dc5472fa6af425895adf2be73e67001a1bd7a9b04b17e0a36b15852f8ecd394027446fe6bb9b6766f48e4ed4f1e1c01539c70b66c02a56cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4255ab544bb20f39a9a1f2eb8b2de402

SHA1
5cc9c3d9539986e067e61a24395f5aa0cde3d4ce

SHA256
14f01d4955ebd1e917d5ed150051f823330fa86b3fdd2380c0a4c8a217ef3bad

SHA512
c834e5ef879625c749e1ab872df431e46c5294515d1fd1a4d83815c24c13b862b7d099aa58782ac7aabe0cea0b7afa6d6e2e35d1a34e7752f5da0002ffc12369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f84272c6c2eacdcab65d87bea65a8c4

SHA1
01e079a106d6dbacb2a077442a8e429e75e8a9ce

SHA256
f4023613afef2dbefadb86296c28ea177899a28d2f452c3e3e8d8e8aed7f8e4d

SHA512
b5f83b44a873da25f87fd2e21d56ba051515b19eacd158c95efcf5b321c14dedebe2b46c104be826488d5e3b2d33bd1931782234887784c4aa7e3f3aa2a6c8b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6614.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72C6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit