55ee8c6565a23603754c9c0c098674b52fff68293b3f7323476aefd43662725a

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00fe593ec54565a0a03f5bf8d7e2c36c.html
Size

5KB
MD5

00fe593ec54565a0a03f5bf8d7e2c36c
SHA1

d74e2a8fbf2323ae661c46f0ac73c108d0e6c9a1
SHA256

55ee8c6565a23603754c9c0c098674b52fff68293b3f7323476aefd43662725a
SHA512

18d1f2a93ed228000888f862a5614f630f3a841f5c8839d24667d0b9242841d9e0871375208899da2c80ba1eb3ffd4362050fedcbb3e34491449a0fea318eb42
SSDEEP

96:1CQL7w0/M+svrgmfPYdKUKcY8FXvR3Mxi3Cy5NPlTUjrXRl2AlMSrFXLyLFN+xI:t/w0/7szgmYdKUKcY8RRcxi3Cy5BZKre

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f4a1b7fd3bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000929b5adae81dfcb6e33ac7950876ac40482eab059879d8325f6f0792a9a05966000000000e8000000002000020000000889c1ebb4819474621592e1f92d1f95e6153d04a6a8364dc061d425126aa3c0d90000000434da3f43a8ccf0451f04adc03c637b7c7c78c617139fdc6b8bf6e6bec2574be1403f7bb60448bd5cf4defe7c96a18d391eb707d4348896d5cdc9d4bd0639983530b8969c2da06842deb29643ff0657c32968e86ff8727dacb6dd502ae0a23dfaaad06690e8c520f89f9925201602944556dd018fbc5ba2d7590eaaa6b0607104a47da1c368d6fdfae4351a6ef283acd4000000039f4aa7afe37456f3fa3105b991786110674f8f870b8878e00fe551b79c5ab596bf6e91216994c961c9edd4d6437b315512a5c4c467b30211cacf7365857d398	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000005008bccbb2b46a0db08c9e841520e56746d0b84df8fa12c44c2c6c6e6ce95644000000000e8000000002000020000000ee98a4455520711e871ddaba25ef6cdc892d72e392a45b529e002106f90366c7200000009a8ef13bde55ad659e3a397e5a06ae815373c716e72b79a19e916a9f6f810ba0400000009b0da94e139e58f4a31424ab8cf23e5486c51b8a472de7b820b56084682fa02f6ca97f8f24efb9097246951b9db990ae2393e5407814b39ef9df10f852f6402f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410198223"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E26E86E1-A7F0-11EE-9BDC-FA7D6BB1EAA3} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2288	3064	iexplore.exe	28
PID 3064 wrote to memory of 2288	3064	iexplore.exe	28
PID 3064 wrote to memory of 2288	3064	iexplore.exe	28
PID 3064 wrote to memory of 2288	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00fe593ec54565a0a03f5bf8d7e2c36c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8cf276fa87902766b2d19bba2b3e904

SHA1
895073d0e4b41a4877a229de6ca370661dbc503d

SHA256
42935174d604afb52a6d930c24f60c17f04f10cf24b252402b45277e0491983f

SHA512
904f72e27fd8379dd9fa8c218921a78d462d6ef3c692e5b7a5569eeccc24f96bbcc70dd447692e92f991518512862cb7db4e1808edd8ee5d78dbec02d90b6723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3b9034d8e0c7f981439870db770c9c0

SHA1
8ac410edf7a8b0d42516b3afe54696da86c10a8d

SHA256
39a3bfe4bdec9e62b45c665a06929287ce710d3fb464ffe53342730b57b2ab15

SHA512
abd1fa2edc80524d2e70e4fcc05e45eae2fe3d919d404e320738d709625a580c16c1e5f4b2c6a894cf3152b34e3f2c29667d3932f8ae9c77f61c9fd74d16aa8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c85a17a40a543f15def847303e43252

SHA1
60165e4dbe6875c834f395281ce2ea8e06e1a4c9

SHA256
157662648d00b6aefa43c18f1e7d93483b36fe123c97b061c896ef0f67cbfc0e

SHA512
fa464e70d5542264f82516362074d99db7038397a8434400b795d3e85a2a5612ff8e7b8f321d35ccf86a7f69226dc6ab2c24297af4814634ba015ccc100574fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7165d5202b962ad3afac9a7235ddafa3

SHA1
7d27c2bd43df0b5a6393d2540860ee78d4b44aed

SHA256
507bf97851cc6ad060c3061a16a299ae3dc0e854cd55073c6163c5f1adb16eef

SHA512
1e2af36cae4dba1b9f28f8377006b2e480c8e59d43d641fe1b35c1716e488c6a3f195b3d1ec0e0f76f511e025618d78a0b04a306af00760d713e9202dd047b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e54197974a2931aef268b4f12ff638d

SHA1
35abdc9064c5223bdda2d755f6f11e5cb1dc542c

SHA256
9fd395bbb568d443cf80cd8217bc9ea1fd10ba02aae4b12ac634d96b96be5e33

SHA512
87083fa77498df6992c83e2159d8b5bb46967987b2d7cf46e73e48d9b41fc3cf0081b242a3f9509dd10c0ee40618deb784e1d5511dff1985ff5b4c39cb2c4d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19259aae8f228ebd33e6af59fc8ce04f

SHA1
44b1b9535e0939170800b29856a7a802ec80d414

SHA256
d754c7773f0dbe4d8c567595252f0e2e4004d97236e7bbbe5a53793e11b2c702

SHA512
e8b3e85a7d03472374ea91326e215cb43a9709f40fc1b2fa551d3bb4d850822cb35c1100aed2e795cf319b12f3d93ae6516c4d0e3516750dabe44e609a45a689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da36348bfa06481a0f128b0096ba494a

SHA1
aa4d16b74aaa47a9af67974d2f34be0c2f24a03b

SHA256
43e6c97a6bf8662801a25e5826b04812a621f0d789f688445c3f485892c40ff2

SHA512
835ae1f1451af5d64a5e6d4ce679ea5d781e7e5d0edf761c56d8addd3739152dfcb8ed8fc39475dab1687917ce98e0b8c20db3a7de97df90ddbbcaa0fceafdf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a14031d7b097128895aeefddaf92c287

SHA1
b407ed100b966421ff297c471eb91378ae5a6b82

SHA256
43fc9f89311b05bdcf750a3c3a6df0f4ee220d26607bc2eeed6d8bfb5a476afc

SHA512
eb32d4db06a090409c62ce06e62ba76e250cb84938404b5e738e23800f38fb0ec4660952093c74939c9bbe2390c1b28516bbb1b1e92632fa67d214a5e7000fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35dcc2e29f9d47dd2f6bbaf7b72d4d56

SHA1
5a77c2b2fed6abbeb5180505f7988135eb4f967c

SHA256
79962d9fcc7ea516de0a0ce83c646207a6d66d9e16213bdf12c4209f4a75b801

SHA512
b3c66cd43fb8fb71cc10db29238531083c59c35a4e30b228e43d08e01e5e3a31d31379b9950e24551ec5d71b7b95ab63bc84263df06d252508ab552ca92b35ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86ac42b8396a132b8692ed472910564c

SHA1
da0ac86616f7238dfb6e2886c2c16733620318a4

SHA256
24dc91d8571f8627a02c447604b96ba3cab9fbe56f707cf01aed311fe9907e2a

SHA512
574acceaab41330e59ee536d4ea75f014648c142f9bb767ad5ca146e00f3f6898682977feb65126f8848a6dbda179f2d2d0ecdf3b93fde54693b38e1d323107b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29bda703c7b9a184e96410e3c75c1554

SHA1
f138a58ddd69c3be12434b13072f86a8624be983

SHA256
b5709c172c87a66cc57d7de714b56553bbcc1a57d4edb5c89a2941f7f57e6263

SHA512
4b5b1e036b37a7a92bb69d38482b4fb2dc735e86eaa9da4c1a7856052f01f5de3fe901d913a913bcc0a36ebf224d5711afc06f7ba875d4d886f5ce5ed2b9fbc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0fe2658cfc4e2f641fa6f839e24fbe

SHA1
7c3a9e1601ab61a83fc12049fea36ef1e1a552c3

SHA256
a11dd20e045730062f29c212fb20bf807d3a585ffdf86be3279663e171ff3298

SHA512
56e04d94c1514cd7985173bbc710e54d06908d692bd039af0c1943ec1fe44eac07a3059bce15fac39097612a93aa7d32b2549ea7c8f21d77bbdecaea42924259

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB731.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB918.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit