a0998ccbee4c3702711a2f88afb4554fb0ee92ebf7fc319ebcdf856359bd630d

Analysis

max time kernel
122s
max time network
175s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01c248963f3208012b924454607b5c01.html
Size

5KB
MD5

01c248963f3208012b924454607b5c01
SHA1

dde5f67164db9ba5b29bfc2864e7fe9ff47dcbec
SHA256

a0998ccbee4c3702711a2f88afb4554fb0ee92ebf7fc319ebcdf856359bd630d
SHA512

79bed1d29afc5d6f3da5da62734d34590cab6709be73de579065b90d2057f9125b1fc24ac69daaff50b050009d87feeacf9a504aee3f47f67ee9d23f6fe8c796
SSDEEP

96:1fbea8h0jlIItdydddddddddddddddddddpnlIwh5hrfDPXfnsq6gToubNBwOIEs:1M0BlyXrfDXfnz6fsNBwtWppZBR6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0545b70963ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B44DD41-A689-11EE-B6E5-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000fe7efa2cb52bbf808464eba877ae8d4fcc89c8b7706d55c88a4fb25ecc2e4b2d000000000e80000000020000200000004b9de1418b51e86db9a80a0b8ef5c22105d0c01180a5e86ffe3b556f3a7e9d029000000072049fe56b5f4ab6d11f8b1509551311cce51bde7de167e54693f11f3d8b35b815a8d5ad247239803a9f66736b04a7cc0ff68341950252731e244a5aec020db4e44cbedca2cc717cf8d9d0a7777e065ac037f0b1b8fb1700bc59a697c324ee7c65c4b8221ebed6c7984be13ff58b7aabf11785f35ecea3d773ca64cc6b4436c40ca3e820793f9fbd9b6109bc575c3e3c400000004c5b27f280d17c77d3ce1fff6cc090357783ba7bae2d23a0fd380e423b752a9c54811722aac9b5ea8a8dcdc0f496565323924175bbdb0321ef8e726001ace5eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410043931"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ad2ba381920184a3f387a64bf31d5bea2e97fcf51fca47eaf7df0e84b866c0d2000000000e80000000020000200000002becf64ec57e64aafa516c6e360b1924b3c5a56d1f864d233be6900a6b05b32620000000a2df693e3ceed9129bcf5f3c9d214c5daccc8c1d1df6550ff7106dbfa80c488740000000e3af27a044c04cbb508e287955ed33b4cc3bc61ae67d1c8cce181e08fae75a3fdf408ed7cfca7765a79d015ac544a693a1d6b9835381079e98655f6223b13894	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2800	2192	iexplore.exe	28
PID 2192 wrote to memory of 2800	2192	iexplore.exe	28
PID 2192 wrote to memory of 2800	2192	iexplore.exe	28
PID 2192 wrote to memory of 2800	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01c248963f3208012b924454607b5c01.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a32962aa440687e73b8c0d4f767bc62f

SHA1
7bc59710134c860ce173d594f7d455b366521a3e

SHA256
2746d79cccfe3e6d093f37a13ee2efec1fb37d7f124b796e183b4642a858dfa5

SHA512
da710ef89887c90ddd2bfdfc2fd726fe337d694361f3aac28901bc17743d1f9dea44b621c52a7a8a4fc9aa7713c4ae296e680482f666c5cb3c56a05e01e18fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b973d26a8335a65091dbac0fd42ebd

SHA1
fef145542f980082c0ef114038802eff057cdafc

SHA256
39987db08a80e63b3c70cd2e1841738268c0576db0fda5803d253cd717b14f15

SHA512
9c5f40b5f0238409150ccd8205233bd831c0b86f3ee45207825751d1974abcb7681dd54f3729e4c6d00e6a28852c7d1a240982689748e149d7f553f6bd36f344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a2ad08ae936fc44d3ff211aa4bc2acd

SHA1
4040283235f7348a56396f9d6eb7f1c0417f6ab2

SHA256
8007b649ad21ca3b189cb32b11a075af10db96e18978e7a33507463a8a550419

SHA512
8940b28e51ad25d18b53090bfc6a2b8f6a5bc69a4bf3f064d7aa2d6c2a41e9a0fc7fecf9b8543b0b76effee0c9d1d78721fcb063702404ef4a5e25a1a7ae6dae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea45f30f5b7e0e3312464b3840a3241f

SHA1
881508ac1733a58be79416cdca72a6abdd762658

SHA256
7026f625c13745c5f7f55aa114a494486877da998f3247a1cb8c4ad6064da7ac

SHA512
7de7115fa5f052f98d60c52d9448e66037ca96cc266dd0efc05573d191bdd29f8df5054f15c61d9f8a83f8def8798e5768eeecf3bbc5b129a3549de516567423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00444b3a3874902261c08cf25e66f611

SHA1
96aaf520707222ffbc109195e0de1a6168bd7cad

SHA256
60d83605c3139df06a9b3ec8cf106e5bc18a2c8d667762b39d5088abedcfbdf7

SHA512
c3557af392a52d3038060b01e8aa41bbde516a6d2a947d8306b3a27d9d078a7c93c079fa18f79163d921e86499b26fe3d688804ae412ed4aadf382dbf1887714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c9c7e4dae2b99d80f2c72cec704cf92

SHA1
d2522aee170e6a7820732b7bf22cce49bc8bb00e

SHA256
22f37fdc7724b8d3588fe9bc95a20236767dd0c841ce1920759a9e0cf39ae76a

SHA512
413f9f06962d11ccf311b6630cf3e55d60023834d69f0ad84c9f103b820b8e7874eccdf9250d8e5210c4b696dca159569e6e138ea0c973f4a542b22f8610fe50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d02f15dc285fb361872e6244d25d57

SHA1
3929578468258bcee546b9845e68a947b155d6fa

SHA256
a6476f07e59bf883d8c3409a4d09698bbab80dca3f6e2d36a266e9fa2575ed63

SHA512
5f907bb455b782e4ad4d1041ed66662491c5873c0a45aaefc8e0e5bcd8ea515097d5f638de71c6fad9db1c6da7c35341101a185a07a429efcb36f68060d71b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28ae439a7c535974a231a16565205132

SHA1
e41d3550dacac38f85aea8a02df0f1d51d62d349

SHA256
3b7815801bab0e1531c12169d91f5df5be5bd835b39295d47e9d4c5e61f931ff

SHA512
9b0aa10ac253228d9b5b701cfde75181fe16ea057cfdf8c54e042b4a8c6814b4c3fe93d2ec54d336e790af017daf4a1dd530fc81584f086edc1d377812dee306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a2baeea2df0dc3075da22f3c149957a

SHA1
45f26e6dcfd4a3c7ab3b42c9edcaafa4fcd43663

SHA256
21aa52bfd5d2c7b9d30604e3074c4f2ceebc87a8e33cb87b5e077e57e0f77acb

SHA512
fac6a36a12c59d98abcd28a398cf2a8452766d166d6ffc10b3613c438fcd65967e272920db600e461ffc3730fac27e539884f2fbc71278d437684ee5f8e388ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4e00be09cb33d10743e2484194318cd

SHA1
ed49eac6ad63c93845910223f136fe29e38da1ba

SHA256
8efc58160a9d15e8312131a22ad5a0295b663ddbd4ccc28a1d831ebc43d7f01e

SHA512
1f7d306b93827eaefd186c538c141efc12488a68f7630c35c7bfebc3dc2c24a2fa9db4fef0ce9273cf0823473b80289b937f9716166cb2a8ddea64f49882519d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f72b86bf34f758068bf75c4c9454584e

SHA1
049340832f3f6e27202aaed91e3f4a8a74a24d92

SHA256
f8350b4e7183ea0d09490f9629f926b3b8c75fdb564a180a234b3ab778fc5480

SHA512
035f805aa7a249341b0e2f5f16650154f756910203cbf33dd15ffa433aecefddf1ad68a8a65c71c469cdf40f606c20bb7e31b2761aea9d0157aefa86b2b7fd53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04792f16595438ca7d747824331e25c9

SHA1
ffc84b235cbb9858cb93ca586fbc11b3eeb706a6

SHA256
d0c0a7d5826825a101daac38fed079001bf1ad2d6bf9587b9b6fdb8388a04944

SHA512
8cf153e4f1f8b6be9f8a19f413d32aaa0bd240cf316f5fb3bd5f7a6f726c6be0c8b2079358c4da9f26dce3d4ed8a1c0968fc26f40bcf5e1647f2e1b3227a0ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB36A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3DB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit