4ad373230fb6273a108a10295860f20063c6af6aa6f8c16a73851b32605b021f

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05f9a09469089324e48fd7f26dff2468.html
Size

3.5MB
MD5

05f9a09469089324e48fd7f26dff2468
SHA1

8556e27a9eaf1368a4ecfb75e7a881f79625fdd1
SHA256

4ad373230fb6273a108a10295860f20063c6af6aa6f8c16a73851b32605b021f
SHA512

a6d8fbc81899de7bb454d5b49b7adf31c44858c1d421e80439bc3babc52bb44563812e53718bc5b28429fd9bc759925cfab0e733049c0299ff55834dcc5ab73a
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NN+:jvpjte4tT6D+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{413ABEC1-A6D2-11EE-AE8B-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f081a11edf3ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009cfb78339e72183026446bd8704617a70cac40f22efe1dd39e1f62b346323a96000000000e8000000002000020000000fa96ca816d17d0a5ac0d040c60cd5d8e3b2a85498d08da169f173a5bfa875aba90000000e5ba43057aa7df4730edc5dfd227f9cb92a236b3d9d1fda24369572a7db27ec2f8590e928da890ebca30e84c5dc9924520a05154186f3906f6ef5d6d6d71e05a7c4b62df7d4fa04acc8d7f7b20380c4f97ab563d30c42aea7b84e529dcc06fe13705ca94966311afbb429b6a1c1d58c15b6c128579b10ed67ff3360ba7bda1354f6f54d956b325e08fcc622fcc1535e5400000001f2f7c810c2971f1eb9a89eb6d6d3440f0f17c713905e7bb14a969b5ae42637a79f8ff3b4ae43f8944f60184fc8632f1e141e1e6cafdf9285943b0043c053f24	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000453073a8782a6d3ce21ef9bd82db72cdbef7a35ae5adbc6cc170833b401e4439000000000e80000000020000200000001cb4ec347427500f5bfb95002952205d28b3a6a20728ec330cf3cdbdddf5447520000000948ccd6ef329440c739163dba87d3477b484fc2c7a7a5011f9423c8604f91e99400000004676e93f944cc8d76c5123436581d40e355dca65007ceab8efb77e2770cf5ee6afbd8fc5faa7570a089ef3520710f021c7ba372241defa1c68ab19337e9f79bd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410075119"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3068	2012	iexplore.exe	28
PID 2012 wrote to memory of 3068	2012	iexplore.exe	28
PID 2012 wrote to memory of 3068	2012	iexplore.exe	28
PID 2012 wrote to memory of 3068	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05f9a09469089324e48fd7f26dff2468.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc253f0153427fe21910bee3863302c3

SHA1
5e7d9dd161a8e3ae83af4e48a4fa09c43ae4f1e6

SHA256
1245cca4f28d552f7dd630bdab70a69101b9327a7c44f9e2686f1883beaaf7da

SHA512
1c31a7e3473906b448cf7f3e62b69da882f21d2f580f834a9d8f6ba408b442edbd9581185362e68bae461775fa5d62606590dd84260181b28a46f3d12e2c5aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59cdac5ca75b6a3dcc95394cc3053127

SHA1
539b20c38c4f4e79cfdc4f52bc8c454bda2430e9

SHA256
a3fb1fbc4d871691a52a6a1fcc0f240821496861e4dc47b57ca2bd546fe20bdd

SHA512
e65d8f7ca03bf359771f2943afd1def44912eb3ce4a4bf26c28e18594bf8b27228b72237ba394178578063727ab7a0f4cfe6fbe8d2943ad8035d5e10027035bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17af072d0593867adad7f58cf4359b54

SHA1
3d6b38688550d2bc9bb31ce0fbc1050514903be8

SHA256
ae693ccfddddf39a7a1ef0e4ddb69d6d7ae53a1ecee302313f7ec697231265f4

SHA512
b79d9bdd9481b01c3ddb0d294df11882358e42ebb83ad6754a58d1abc88df28a65c0a489fa4767f4d9ed2c9485936301a667ddb7cd3194813cf1c63712bdd37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18202f3e1f1808897425d4019fd43e4f

SHA1
eb7554dfbb34a1a55597d2367da3eb8d1993d7f2

SHA256
be922746613f2f28cb6ee96bfd09b963aaa4cd06e2a3f27dde113fbea56c53f8

SHA512
636682317751b8b202dd1390523c3d9913e5f701db608b58452a0ea661b9c4ccc4f78ef702d6e2a477381ad308a51d006955962a7aab5d04cd7ef1a5ff14c3c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e06f52fa85045b64cb9d9aee3e289c5

SHA1
f6b0c9b737b6c77ddd29a79d740a34d4e9583d3d

SHA256
8a418fb83ed4f5da0458e1717c10298b9bab571f81c9aada30001d3cf04e4702

SHA512
9d4d7defcf84095e857d552fcdd4a8d87a8ff658e75e46f3cb366597b528b51987025f03c03df23ef01c8d72e70bfa5763bda22be4526b3dedee397c8af441a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c156d906662cdf1b1dd94bc68fa2d499

SHA1
af12157c1dffe12ad031f18e8a2e9d0578c39956

SHA256
b4400bab01c32d01acdbcbf45a06ced2b9e45222bc3bb9a7cb6fe1caa6dbb3f9

SHA512
1577f843f0900c9b89f52416c7e287d4db15162dcfd9eb0cf22e23b681d5359d71e0b671d3439cc649f7ef7eabff4cb9d6e65d3e4210c936107d4d90e06b87f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79971478e273d0bec86d38012a09001d

SHA1
9b2427557f4e8f950930e03fc89a83cb3e95a577

SHA256
71068c90479c0ef8c0c67e5128cf05efcad13916176f3c7eb6b9bdcce600976f

SHA512
49d030e9961ebacab0761f41b14e733e980bc43685da05fbb856514c4deb634c62c24a155732f26d9450c43a19d0d56732be267d0a4893ec8186a27327de43e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2001.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit