bc74c94158070cd991fc677a5f65596bb2ee8ec5b48cdd8834a5ed2d50670a83

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

012a8a210badcbdc98c3c954c561af1e.html
Size

91KB
MD5

012a8a210badcbdc98c3c954c561af1e
SHA1

cb102b4c27ee57f5e78c50085009576e8c521684
SHA256

bc74c94158070cd991fc677a5f65596bb2ee8ec5b48cdd8834a5ed2d50670a83
SHA512

6a5215557a1d544767e17353a3e7a8359cd54acfb9961c5ac97efc860f6a9bb363472fc529b3bf87488dd625569cb3bc91c333a4e3d66e7494d92ab859722901
SSDEEP

1536:L4PMLicZO1oLorW4tXFr2E1X2L6VbC9Q9JgX8pJQhYX9fheaPf79vR4XF4NPJvDK:ZOI6VMNy4XF2N2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA6FB791-A7F4-11EE-BD99-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d6cbbc013cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000050b66ff3389042fa69e5f1d80517de882da979d81190a9f445c54df5624e04ce000000000e80000000020000200000002cb1c727ce273b004124359f3fb0586e9c51901956a4c8aa12e343f07096799f900000009d15e4a445ab7e9ac909121be8576279ecee88254972fedcf8552cc69bce615e654920f316e8c7b25b71f0a21fcf7aa1381781f0587c4c5028d9a5370718017b39e88ca0666362438a0bd0571b4a1ac53ce2aad7f1e166e9aebed258583dd8646cdd0aec251537b01b5ede6657bb666cd001b6e28d38b027ac48dc5ee6d08e30e33653c3d38ac6b47a022c8b2b60bf5f400000008d1dec4f8c2eed73068f8e11d5e05447c6ecb4bf5e0db69f3a433ad81c3a39e987c3d336bdea0cde90a5ffcb27e402aea699675b236248563ca4f2f6a612baa7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005e77aa8b9db51e7e264a57cc69a6d7c1fe2e541ba3bbc1fcad481f1fc36ae49c000000000e800000000200002000000049cd442ef416774f1fb1317454da25f7dc751b137c15433ef4bc4c5875079e9f20000000a46826e955e56684d3509a47300acb764d51862a4145a595e9f5f67c4a224322400000001bcdadbe19610be2fc58285b1749cabf2449b0123394693540005741079c9d58da8f516101c328b067cf3b6cd42d8ad31f1ef26175c2c2ae0dd734990caf5cde	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410199916"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28
PID 2428 wrote to memory of 2272	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\012a8a210badcbdc98c3c954c561af1e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d3081b3b5fdcdd5049921dbebe167a

SHA1
3fc11eb091fb6411c6997c56d17e6c5e45c62a36

SHA256
f58d83b288145a7447ac2f3de98d5f8c7aabf0f8af6b9689f50ac56d6166fe99

SHA512
8a0e7cb697bd298e2e730ad64e4a23557927ae6e0e113ab4203d08a0af026d22829465827e3bb65af71a2ec4dd26f580ef2d9b97bfce6e1f8219c9487388e7ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
097377ae0ac2c229e66d7c77988d7e2e

SHA1
acb1ebdfe75ee455a87fe91c1399252cfc72c982

SHA256
a0203a4c927b18cd1fe5b035615abfa336eb09080b618227be2333e41dc74a2e

SHA512
00c59673ee90e9c1436883ed2c4383444567e2749372c88a275ab73e39dddf119f3b9bac67b8eae6f44d3a9f599525ce5db7ddb5ec57b2b98fe9cfb3a448a025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd09bb99f8b2e2e805ab20ca69396d70

SHA1
640851bb8b28b24ddb87f9bf6fa3e50d7aa4abb8

SHA256
71081c5f85efda79ced81b36cbd8905697766a69262750f4e122ea22956ce5e0

SHA512
232172357e69bb27e041e742dd77260a08f08b732d2c0048758f1339881e7ecc376c29813428a2773530628ba829171183cd1a45411e11388694119772651290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d878820a3ca89516ce1660f5ebe927a

SHA1
867f8a60239a85259bb5f0e050cab1acff3c2438

SHA256
c67db71d5b422f97c490b8dc9c08d7db5d432db7961ef1ea419aaae1447b3052

SHA512
0243a593853793c74692d6baf5a8ee34cd92ef2bb53e957306dfb5c344e13a33d1ff7ef54edc9040eb9c74b766aaa698edb09b4dfc5d6f55f2af99d59b082f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614206c06b0ec9a73a570992be09c4f0

SHA1
79e1e0ef4d3793aec638a9c19209a3ba41f9de5b

SHA256
5ff3696d69f2f7eed3389c7831daf126dd4723c56b9416a32737f9745d70d062

SHA512
8256212277da01cc6ec83391d4f11b60de3c297995a0a6fe791566e98e7e40ca937b2808bfc898dfbeb55264a2f56b9cb62403515f58a87a82a26e3360baa2be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10542a52f24bb314c2a228ce1295a36d

SHA1
67b9ea10399a3a60f68767b2ffeea03dc77578a0

SHA256
9d73e16919210ae500a46a8fc6e0ce8c0e7f729b67439768ca0c081114890a44

SHA512
cde208d32b17a8adcdfc0d18f12a8cae83138a940bdc09ac6a2c6cebc6e6e0976b1f485cbf1001e66d86495743053aa1f72334ef0265b1826d5c4d7ec1eaf32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52b2ccaf9ea96ed7e1be07de18a041c7

SHA1
b656c3ab84b10ed4e4e5e8d4cc2377fba11623a9

SHA256
20cd1f5c55d0f3aa7c38836e4c6fd3eb857e79936ab1888b6ea7683d3ccfbc04

SHA512
c481b4b7fb76920eafa372ad657ead52083eac0209fc464b0104e0281b8863ba8ffe863e04ec72cd9f0fcec75fea2bcdb050797456c8bf595df8592ee833c6e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c08bcbf56f3c27da59d1cdac38e5a4dc

SHA1
a7ee07ad552c8241fa3f948dfdda089de8a8d44b

SHA256
9ef950dbcec7449bf971a10e96833871552e0a00dbcd6d4392e4b8435cc78ecd

SHA512
59ea115f71b41769feed0e023ba43d221317e8207821f7fd0c63dc5f8cb65a134e3421386bb1b1f50c5cdf0c30fb511bca692aadbbfa089c7f84d67a034569a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcc5741570b68f49eab312a7bb285464

SHA1
7e5d47b653591d07fd5b4bd51ae5f5cabbb69a4d

SHA256
4a017629d05279a7c9f6d3104cbe510cd17264afbcd9141882f6754be169bb59

SHA512
2fb35761926eb42f0e91d675cdcdb5cf340260f79d5e4519fed1b7839c69ae2c7a3003977b6198af57d860f2a363fb0f2dfc2aa0894f4fb2964c8a2974dfbaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
146777fd89e67c3ef07c0031b18edefa

SHA1
0666c712ebeeb2b59f269be9f40e21987c795f47

SHA256
174539c3b99a3c1dbcdf4c965bb198f0b30dce3f0c45d09d71583f476ac5a191

SHA512
a9aeac5196fd0eb4203582a2eccc8f3a506ebe2533123efc49d67cce3f63ddf4123b00ecff7a7b57e478a441d557c20820cdf58724052e59c0e3574b3b7c9447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87d86f9147dd773e2aa6ab7984fc9717

SHA1
95065fce760b44278eb0d0d7027340ddaacb924c

SHA256
a245666bfa466a83a45ba4ce90628f0cbbfb42d558387bb56e3f6035d9803871

SHA512
9ac6835e9630923ba05387e88173b41a5b0a2a1346c1e75fff30552bf929b1f9f77e5dcb6a7ec5af7fb836eb81f396c152dcd280c3f27fa0b040d7af0379a96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\wp-emoji-release.min[1].htm

Filesize
175B

MD5
5255b05e221a2ee9e73b8d9ca6eaa4ad

SHA1
28d5fbabcdcc49246e71721c45d49a0dd025cb0b

SHA256
ed2ae741d3478834f11bdecc1f4a8e179bc295a99e489936befac5ee4eaf4cc5

SHA512
59941bf156a18037f99367a8455137ffaad3ca0d2da6b3b604e6d17caa4299789b463908cf812e07477aee07e7a6fd4b7fcbad598ffb48d57a76a018da368e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AA0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C39.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit