0e706725d8649e65f162b76b7e77a6811ffe2479c9a49360a94a795d79a42d7f

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00f3603fc50d78282a25e3901d84e187.html
Size

10KB
MD5

00f3603fc50d78282a25e3901d84e187
SHA1

1b4bac5898128bd876bb58e44399c549104d347b
SHA256

0e706725d8649e65f162b76b7e77a6811ffe2479c9a49360a94a795d79a42d7f
SHA512

93a9b4f942ea75781446d48c6e2a70a60f153a6b6c3d9bdb57276f6fe0863129083fdab5c9eb7df4382ba639926a94cfbe3cb1d0a48021735ca88b138555ec31
SSDEEP

192:cjgi1XM5zStXg71DU1dAN+D7zD02/jW5wWEdqL+d/EzhG:cjgiFM5zStXgJDU1dhbDr/K5wWYqL0EQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000091bc8c4c4fc0c398bc99036083d65728f41707339decfbe0bc5110d3c6325a17000000000e80000000020000200000005b33178d8b49a92c756bcf08a8e82df05364bbf311b239afacb68126076d7d2b20000000951eb8b74237df51fc54918938c81d0b97b1dcd7a5d16ee0c40e08a150d1f96c4000000085c16d9e4c4fe5d6d74129980efe197d1022071f89fc97937430711958bc696185a46d985a03b49e453beb80d46a00186cd91c2251a6121987281b5371a44b73	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09c8ec0fc3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410197798"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3B9C101-A7EF-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007de28beca978e8e7d2a70799fadadc4f0dce2eefa74bc1ee23d440b77769e5ac000000000e80000000020000200000006652e9b1c4af2c4cb42385e20fa528c6b99de9e475b190fc6e263a839eb3decd9000000031b38743867a0738395537fe04546809a1be5bb9d0eb75737c154c4a7a6087eb1a9657ad3a4beba9d6799f21475e40b91ed0276d2ec29058b0093e3e50e3552f5325285938b3ab7c30271229b541212955b82da26812e015d798dae799f51eca1837f937a77912386eee6fb5d0aee589e35cf3e5bc7c7ae33cdecde01c488dfcb57e97f9998c662760e45d2a778c315740000000a0d0662fa9a2d857899a5d23e87adc79e016d5f9ce8818d74894090e137de33a78eecbc1f758a42aab46be64497d2d0823b5306d93436037cec3a82d9938c604	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2116	2148	iexplore.exe	28
PID 2148 wrote to memory of 2116	2148	iexplore.exe	28
PID 2148 wrote to memory of 2116	2148	iexplore.exe	28
PID 2148 wrote to memory of 2116	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00f3603fc50d78282a25e3901d84e187.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b688aed842580a0c49a37471829c6c42

SHA1
59fe51b1ec8b87de33a95d59177fe83aac8f42f1

SHA256
00baa3cac4624473bd2a85eb03cc01ea51a8bccb3641100a139038850efb36c5

SHA512
1135017f62bcdc6c0f0a97d80bbe9fe23aa009017034703bb7d2c0e87b258739e3677d6aa5877aacdc3299ae90f69e988d8161c94014e01b0739426d22d3e95d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca3fd0a731f8c7a6e2b0487a72e768b8

SHA1
9660d91c88fb762b7e0fe52a6fae34a6165b4f9d

SHA256
26125a8e89b42d119f87153e98bae2d083cf3681e383fb97abbe072a56a6d928

SHA512
871e1e307eb9a4c52b52dc785ac5a2fe1db32e5e1496875def4497a69ba196a7f89e95ccf75c5dd9d512f17f67ec5ab65fd025cad6cb699f549d1a54131ae201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b4b6ecd7b0da2ab0ea9eb6386db0a8b

SHA1
1b956534c7d8edb135b4d4c41f923b00bc2f8744

SHA256
8a4c09115d2a302ae09ae55c3e48cdde15783fc438732a16e60c9cdc9bbc7e00

SHA512
0e9ecbcecbcfdd4c24369958c800e82ab8a929a2b173b2ab87638ebca1c15221aa1c4e1edfa578803cd27394e9abcf54275d29c5a77405e2c3420334749d543a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d44404812231cbd3773c2cacdc550f46

SHA1
0cb7ed316ccc48d360fdaa5bdf0145b2dfa2610d

SHA256
85431a4600b4c6dd50d411ce684efa1d17c87ac6d46e8f4266c3cb5b34e9c1b4

SHA512
82326dea4481610152f8417cb929b8c92966c97a513750ad4902da216ab91f75cbf404c48179d7be5643077874ccd63e958d78f93d241eec8e2b7644384d8f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3748093e287fd43d443122f53eb37d13

SHA1
b1b2b695be830e0e203db7661435a1f37176c6fc

SHA256
537172e93de3b0eba3d82ba540b9e31da07e682080071e144153017512ffbf3f

SHA512
2eab439c50f0d608bd1707551bcee266dbb067d9c44d9c948d6c66417e15efae8fc8757c5c53c6eb40a245e1990cdcd92b2b47545fb1768f2d0d32cf109560e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b52266b92efb49de921c38a9ca6fe9f

SHA1
24ce875f913b3226d6ebe1be4176d887795a9b66

SHA256
cccb6743d56b907357dffe8de32a549f266b7c66e69ec54b4b2b8d7d9bb4cd73

SHA512
9c8e58afad9002f47cc80429dbd775798b1e607fe50569fa4dc6d3993e0b10b95021158522c084f5df68d5aef3c1eeef2c96dbb1aa51523bcdb2c032ebb331ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70e8ec3f1fb5c57c141df86f3a37fe35

SHA1
56478d4befa923841b50ba1f793dc9c20fd220ab

SHA256
294c945e2cc3dbc275c72981a71d23bdc2b6edda908ddbc456a39c762967316e

SHA512
ac57357f439401e471c8a5e0cbf4969cb19c019090779346e6062721c8ad385c46a0bd0834352b6f658260f8140e96bf578c024ac6e8407ba043c6f44b268307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7ca6163b5af9676ee980e74e14db8ed

SHA1
c3f724c73c52e9f73eef16b1e8ad0dc811df28ff

SHA256
7ec6b61932886a7adda580da386b6c6dee3ec3cb514ca4fea646fdda259df2f7

SHA512
404ab9aafddf901eeb0ef661124a39ae364a2597976cf65ffca96d0727a880b2bedc596faf6f0c6430b069c04784616bc0b8052719b295a780be0a61b6d99475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19d7d5a8bf849f2739322a0f5e6cc547

SHA1
0b1722e7c8d5fc23d2767ec3ce118ae84508f270

SHA256
323b9d458e583115486393b5041ba068e4d090b2a24517b9de6eaf15639ed974

SHA512
014252c497e0baa0170a326027692ba27e3c61206e9de05d3a5c71543c25216ebf7e115b85ca0e2d0894b0439c107e10f07b74aac475e3694a995b2c23a5fdc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65d8c0851bbfce5aa0ae88dfaee7d052

SHA1
fd40a835aa4f0010fab9168608e77ed33a5c84c3

SHA256
b8ac18fc56e912e860dbc643824c4caf79583ffcfcc2a1727453329cd9fcb8c1

SHA512
99e31a14079556814eeddb96113a9377b346444d44f7c7bbf39f45fd3a4559a08bba8ccc78370dd7ba8219316f172e15e19a38e75fc7065ead8f2aca8795dfac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a305691e35a3c1217de8a6f909c7c05

SHA1
f036640b4b2f8db7be1ddf5a97f9ff518ad38445

SHA256
f06ddf98bda3fc707652b8d3fa0057d864c58e07753374455c211bf576e11f92

SHA512
22c4881c9a1923f3e251ff18f57b414ff044cb09d3c211298ce05b9cd124ef60e2267a0fe7ce0ebbfc04caaafccd963100a67084568c1fe39cc878939cf22cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1e431fce995cb0d5e18a122c2c7f9d5

SHA1
bd96253383ed219b53b13b16402c24f3a15fdfc6

SHA256
cbeb4f80925cafb36a55d44aeb9ce8e66cf06a9cd971f5b5fe6b60b77e96f6f7

SHA512
414554906b90c5cf17a9a4206da0200c4b81b26ead1e723287fad8db672344479362f60f92b6a7c027dc33b23a141e1a1676be7971a03e261889117f6e1ff12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab94D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9533.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit