f45c9025bc2d44fe0b310b42a5b4cdfb7985dd28d623f3b42047bc9dbd5b65e7

Analysis

max time kernel
139s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00959ad90c025323ca911380c228a866.html
Size

45KB
MD5

00959ad90c025323ca911380c228a866
SHA1

e8154a40b47be44dfd1fb1a1fb9fdfe0d23c39e7
SHA256

f45c9025bc2d44fe0b310b42a5b4cdfb7985dd28d623f3b42047bc9dbd5b65e7
SHA512

153c75978bbe684fbb76cea486d0c9891e32eac0c07038b03071c3ea1421bdc643a0cd30a90de76c98f4bfcd2079b1e8433ca36a8330653e2c478aeb1a8ab06b
SSDEEP

768:l2IRIOITIwIgIJKZgNDPIwIGI5IyJ7SGIRIOITIwIgIiKZgNDqIwIGI5IEJ7SE1i:l2IRIOITIwIgIJKZgNDPIwIGI5IyJ7S/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f4d63a66390101f8099fff902159a66611b07539d7416d0e737e64668cef48fe000000000e8000000002000020000000fe33acbdffabd39a17193b0365be029931fbbd24c94309be383c2398bf5733af9000000010afae96732c73a7888117e0f9537e120728d40bb2401f03f7ca5a1448e6c5c716d9af53abd62f7c3da3d3e01f359b7f7b97f1d98dd08188351ea3cedd5dec01f21c60efa79a039573d67e6e80737855b3718e4f1bf78ac7a1da1cd84a8ef60da9dbf8395c70335eaef7ed17c11827ada23b4aac99d374db8566335cfa086a9092535d0b0beb14a917f12e995bc47ab6400000009e028a63fb6b4f1d2bc45d5d740ae0ea45c513525e40968b6d31ed1d849b70a961b71c9bbc4043ff5c239382e9678891f1bc1c2b2aa8e1b1ce018cf047a6e301	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410411491"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d022d147ee3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6EA0CDC1-A9E1-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002f5a07c6cd88d8564cedb1e37146f212d65bf6718a5bba7b21393dbba0d0cb25000000000e8000000002000020000000f2ceaccd38deb5788a29699e23fdc9bf469d9d98204c41a2c9647f0379312498200000001e2234d1d95583de037b91da2349e07a75c84a30411a2cde81ca05f225f8f29540000000d57f0b3a1eed4aaedce1adae7ac0b5ac7ef66a884d6969296c165a1a86401bfff4d8ab71445712a22fec21f3826bc2ca91517c0f1b71cd4b46a89f412b603327	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2436	2176	iexplore.exe	28
PID 2176 wrote to memory of 2436	2176	iexplore.exe	28
PID 2176 wrote to memory of 2436	2176	iexplore.exe	28
PID 2176 wrote to memory of 2436	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00959ad90c025323ca911380c228a866.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
752202e72f3ccf4735230122f3224693

SHA1
3816fa97097100a09e6948e94c18570eeabf66b7

SHA256
76fd521de8a14f9103c2eebebc880c42916b839d225fb6dec74cb09763b9675c

SHA512
73bb8b9400efdc898481726c47258dc202dd3c9cea60a9a252caabe1df4f9572820b69d62e6d78c2a0ec175fc1a961fc8f863761959b0946f10f8971e0bc8ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f79e336b5281b737d759f958151c08d3

SHA1
094d6170c7ce9413bbb52a0432193eb3268f0719

SHA256
5683b2c63bad6e8db61bd11640df5edd45c0ef0d86067efba24e7ac8cea9e373

SHA512
0d07d5b3c4e4d578f15e91d62fd596d6d1917d4c5578a97153403f9f63ede22e14dacb5ac93259e70892da43777b5306eef59a506a16e41cc3820224131a1a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee86e2c3c86c3ba8f17f0279e828ad9

SHA1
20085874e2b2ac35287f850d40038308c33869dc

SHA256
328cb205f4d4074754c1723e64ff16ffff4adbdf7b720b97310aa0c521ab2ed0

SHA512
deab688483d4b23d0eb875dcea50fbb97d92712f90553d8605a78ec50ae7987d06319bd88b73edad6a35bddda16c6015e1edae3063f3b252076060ee9d50c2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffa91ff7433a4f86b3a0380c9be56c45

SHA1
5af4a97a7ad5990e15d47fadcf14b7253ef1991a

SHA256
5901b02610c1f7170435bca5ac91218139ec380c8306216e2ab72c9d02d14a51

SHA512
dd374a4e42ef81cb2e33660ec2f5c5881834e7f2c1fa5a6503841099e284e1e752c05d60204cc0827f0589e2c643968b949e5e0234dd987dc53ebd3ba07bfe9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05f42c27410d8d678689b40844e5ec9c

SHA1
94d76050fdaa60f174ab305f172a618adca5abae

SHA256
84bdeff4cb9e9a2c2a456737bd80564dbda29f14c9dac2b9e9d86ccd4b832dcc

SHA512
bd2aeb47be7b6898ff80944488705a613289b01e6ad8f25f3ebd12e48c0775781d985f78622c290568df4b522e6fe43d4adc922c7980b50dec67da7fcbdcd3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
727fdc2f0d72e3999672db571a1ff6ca

SHA1
b790868381b30f8f4415f40ac4648d5e07ee2791

SHA256
041eedfa86c29891d1bc02aed166b6a1f744cc81337af4ed741e83d710bd2b2f

SHA512
2c8ace7cfbeb89720da388f9d506d09e2b46d74b82d53919f32cbfc3681205bf6dc673a1585e53c826697c76491dd16906435e3ee354dcacdf809a2851bbaec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7628c40c48b42548fbe7f22ed0394f39

SHA1
17722cfaf5ebdb189bf24a2fe5a7367ed80ecead

SHA256
a89cc299072b2bad97a2d0d65477d6cf0cf28217bf558ea348d0e0eb9b62e730

SHA512
1d6a721adfd91717bff15cf78ae5c02ffa2c7989d75f6a2115f2c54f968dc0c4cfc1bd6223fdd26d5f22d7e597c97042b26d25467e1907cfb6d364d6b54bde51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f5a1bf5d34fa5a7026f578203766d8

SHA1
b9587c1014c161b5279ef3bc72df3439f56a9ea6

SHA256
489b66616a5d33f0c4d3f52a7f4a4c5aed8b723721bc6a3f894ac31393872841

SHA512
99f5e2cfb540d1951e8308cb62824c965bc19fbcdbb286a7703a4234824d6464ca7bd52b8717e60c7ffba2af256785d74237b11823e0f27486c6ed13cedc7201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6a8512c9341d3cb6fc11e71a0d9e624

SHA1
6db2aea8aaa6913796b4811093222e99ea239e92

SHA256
333cd30e2438f8e66f454e42f630d978a677084bae5c48faf8a090b1621171d5

SHA512
6264fd96bfd73f743e6c96de5674c04659ce3329e51e27da4b69d7e61b3bd23de80e48f60815733a47adf8de4e8bf9e7863f06a9340d3c527c365e5fe1ec39fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5591e9f4f4ae9ec7231c025613a33428

SHA1
9c48e9ad04638d2ad45635a473ea046378b66360

SHA256
f3e3d01163c3dd13c63b2f52bd1f7222b75e4ac37964a93f9c9a03967aca1887

SHA512
80675ed2127fc93fd1c8e46381d9ded726c95c571389fde77007e3847dede6f48a20356edf0d71d9c0603d6d413898c364d834bb6a73d6aa45d2194f017ed3e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab848C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8644.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit