f18df150615f1a1fa73240b6076ff43814c900551e8044bc1bb8c456500b0b62

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

002f892f7b4d756db573867cce4e2147.html
Size

43KB
MD5

002f892f7b4d756db573867cce4e2147
SHA1

aab7ae3f4a6a0ac2df10bd1bf1229979319b8239
SHA256

f18df150615f1a1fa73240b6076ff43814c900551e8044bc1bb8c456500b0b62
SHA512

fca91c8d05596f03b91b6053642ecbad4fd221dd48a161abaa2798352b642236a9ab5ad6f86693fcc25b3fabde52fc5c74641a8f92cf2466b5ad244a4f88bdd7
SSDEEP

768:WEijZeqLNlEijZeqL+3toYtX9+MlY/V8dYpwRWJ1qoKelx2Shdr:WEijZeqLbEijZeqLydtXnlYN8dYMwKep

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b701afa05696a1f42f2fb5d4c34fd3467f480dbd17a55435fe211b859e466348000000000e800000000200002000000082916ee86d0dd501b6312522e7e06ed06c95717f30be2fbabf7b7b00a5173fb82000000091d069d7bb700d6074326edbd4c937e0290cbbbf393abda36832d17ea45846024000000020d7213e533536805956f9bb29930f77e4da80983bb8b08df8216963fca3adfee22e3f201bf32950e4ebeab834fdba849ba8b75f720e9e007005015d158302cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410404997"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{506E1511-A9D2-11EE-83C2-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e000426bdf3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000035b785e16686daf00a5247f7c97c9cc818a2cad274a096eb6457f61bd3f2851000000000e8000000002000020000000d3c6f85ae2897ed25f1dc11033a2736ef291b009a13a2471599180a014ba256590000000ed4c44a34ff0789d76326b7c60bf8a6042c982d44fd5d29691500c74086b0bd5f6724532731329a8177c0727cc6a5365643d46ea8e02a580a7e5ec5b9cf54e2677cc6275485fc2b81bffe2782928df59f691c0fc4613d45837b00b5d142142ef2bba8caa0b30d247be02d74424187fc65aa7774a735ffb897f218c336b20234a055adb7b7f4b503a582ccb642d82e5bb40000000523c4e60c9ee607b1a15a6d24c314811f193c9eab76ea93a06d63359d6cfda61fc42e30dadd0dbc46c2c897f5e6b1dcd28ffcde9d65cdeed212970fa353bb0cb	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2812	1968	iexplore.exe	28
PID 1968 wrote to memory of 2812	1968	iexplore.exe	28
PID 1968 wrote to memory of 2812	1968	iexplore.exe	28
PID 1968 wrote to memory of 2812	1968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\002f892f7b4d756db573867cce4e2147.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f32985b0173b27852f403d17b13ed31

SHA1
f0e4ec477a5f72c918d471b8eb754ebd225bcaf4

SHA256
e1345387768b3475e1323da2e24411a9d4953f52d11e20298e93184115e6b1f6

SHA512
585d129f3c2964ca1435c061f00ba348b88189e9469878c448a7b529a6a08296fba59364368c717b3c8ecc6d694a294d3d5e88e9639245edb98c7a41ab1b6cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd4a1b2cdefedac0df677b8a3af1a1e0

SHA1
4a0ae220f70ec19e19bbb27b3ed0b50bacf1fa99

SHA256
1a986bef02e5069065fa2146344e4a64ed891f1451a25159ff7a91bd7e84c4eb

SHA512
4dcc77d5afb89890e19f00fc1dadba9d4e8e9a379b3871f46ffd7f8a7ac9e71f7355eb1b357ba696789ca732dc3aad32e4b2c5f83c00c053c609a74b0c32ee78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d65fa1e75e9ea4bbfcef030c1628e34

SHA1
ce9b95b41a7cf94a731b34ebf3bc051dc1c74a9d

SHA256
e26ad2e3f530959a4844e85d764434259424db2356089d5d7f69d8a86acb747a

SHA512
abfdb9c2686c63da01e6190b4b89fd5ade403e21e6bc80bf8cdb644630532b33495beb8a429fba313fb93124368b36b3ad1532da225fc4b19cceaff0448ba113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a14cee8a8522198862daf241eed003be

SHA1
13d65bbce5ee3dfc3cd1fc0031fdd70806c42cc0

SHA256
0311ba7fd3fd89bf6d7665a7c00ceea63edd6f53349c3daab0067a4249ca77f7

SHA512
328a1832710b22e84c7eb1815488a471a7fb4fef17be750420f8c162ba8b340544d66fd7ee553ab23ae5cbc17e76246717679a19740ca20d11b70d58d832add1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a43ad2b5820b1fa4d94ae38d4fae0b

SHA1
8d2faf7011a888726cbc22db56a19f292c8572c5

SHA256
46434fa8ae324d478a15b1fa8dd0bed0c8f72f189d796a94243cbfc642ca1375

SHA512
55c5318538dafe61277a09b9dea1d2df94fd2bd69b3d4b08f5e6afc2a717b23079aa56e5fc19a55d0a2936e8afd88bd008dd70abb4ee7dbe30946025fc8cad88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeb467dff9bc56f488780fd76354575b

SHA1
50783cda6a026197f5cc841ca3dff160b8f059ce

SHA256
5f8bf9f775949b14c75b7a1ed2918b89705c89cabde9d42dd915d8db70528154

SHA512
bc83a61889916261b83d75b37ca987f6a3709a56654a3b2b9a60b958671d993107544651864901c17814bd77b15db64036ebfa00834d12b92c05f500d66187e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf3cd5d43d7e1a15d812538af37e37d6

SHA1
97aac2992e7d5bb1d5b99e8e85d9e63b859dfd34

SHA256
1837c3362fca52ee4d700c95b394f2ae3a3fc708c56e542f7b06820e6f110a89

SHA512
edb308f686db1a60a291739d5911c09eb1a5c479e52c594c6f97251f3926d7240bd2d3443189f6cfeec1737f9d29a389806e400071d54e56f886ebd4b2f6ba65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65894124032addd0ccb5c1702458b768

SHA1
531f4f6ada41839ae1d64e37a4a5ff17010f8d9b

SHA256
1841d6c4fc8a99cc8549d786a7ee99133ebce73f3e4605054e13ca943f1849a1

SHA512
4d34003386a0f3df0a8ab7f6fddeb876af87efdeb22df77595b8a7e96d8eb71038d276d7725aef788d37e46b3719319205c656d4275e0f9eec2df57a40fd9611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faca015a98d6baf7221788b597ccda21

SHA1
2e9ddac51f3a033864cd344962a5d84951c60ee1

SHA256
d759a36f882f3e19388af72b0b8d8e80ed184b2953401ac72e45c03af09ed0b7

SHA512
07b5beca2bcc16eb2e36033a3b471dbc3c2e2f03f9348fd0bef12ebd9adee9baefc838d0c2d1d17bc1e37a7c7892fa0b5f28e5dcc29e9134f08e15aed1371529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fed73cd3561aa21aea3e76ba92035c24

SHA1
eb434e5e4c12967230eccd306994471e267d9ab8

SHA256
6b8fa5fabcb99ceb4036a52c2a1ff68190dca1e7b44ee0701c9af9a927944aa8

SHA512
0ce974f235b8ef29fba9d432642be3a69ffb4220f272d948a669c332fb67933e622a148cb512fe6e15e68fce87522fa6ed6d33cb71e0a1939f6b21629fbf86d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
530e3a2090b2f60b95c301f0bec71385

SHA1
e708da0959de6f39d762984ec14e7b16b41f1fda

SHA256
fc3803b4152612a9f51e701d669d666028ba08e49e59a8ab4a88edd29d08d263

SHA512
e007353bcc1b020ef2688977e07e0062c6e7d795588bbf2c47103228cd12f4a8b1fb234a4779ad15781bfcbec225fc6afe47962eed143b3b7b4600b11b6a80bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9666.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFAA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit