70acb54a2e1b8e0b5c7a3659f226f69dfd0bb0bd8019b9bacd709ecf0b5b9f68

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

016204c3cab4cdbf02be304c3eed5484.html
Size

7KB
MD5

016204c3cab4cdbf02be304c3eed5484
SHA1

43b362e675dc00e6d9cf87a5e0249a6114110de8
SHA256

70acb54a2e1b8e0b5c7a3659f226f69dfd0bb0bd8019b9bacd709ecf0b5b9f68
SHA512

7fc983d96e1aefddef26f44238503374224ee64cb7c08af737fa475a8712bb7c78046f5d4ecdc88732cec5c6dabd5f859bb5303a67a17846581c9b910d0bbe4b
SSDEEP

192:SI7QWZKhz7Gz7g7CaJMA5hn3YAyaEOOsH:SI7QdC0n3YAROsH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000adbb5d5c9b6f1b377707eeabb02e1a475ef3d1adc3353bd7dd2009c666ee4afc000000000e800000000200002000000084ed143f51820b8fd772c5ad1d7a47d309189bc8375d128cc210deb385c58a3b900000002d4a01e77dac34c789e8b2699110bf7f48a881b0875cf4576f90eea0dd41aae99dcf885a14d1899212775fcfb47a0f3ae838ae400df92f7b3166c44b7d509cfa1ce80e3fb00774e9466e031fd524305f78701ca7a372fd873650113b506e322359fbcea4e16cfc0fdc29cc02b923cbeb96f110209c8fba8a2adf88ba8d759363bca604ae6c1eb3c620994a63d492df9d400000003849498049cbf73f12e6d789b4bf77abe78ae0e8f24a15a4681382850db60b7863dc8621737ac948c292643d3bdc3c8a4097a631a089a05443df8ef56f35a06e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410421617"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000048a773021cc824d1efcbe3c1ae368b4cc459cb6a88f9dc33e141081dad4188be000000000e80000000020000200000003acd547d01fec7f3b29dae67ac3e68ef767862b668e9f62e8ab13324f9844e652000000073be1f503b0fedcfe034e85db08d76dd7c6ba63abd8a85c28c3dc8f3d5d2e86a4000000080d2edf22a5813363939cab8fc6c26fb850e55e37e999a44b1a747b28e20c3c17965d2daa6bf9b9ca4272bca13484350407f5331b83fe97b8acd7bf0334081ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFC8FE51-A9F8-11EE-BE60-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f85d1b063eda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\016204c3cab4cdbf02be304c3eed5484.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a2aa71c6033a34a37f026d86752e3ed

SHA1
f4f39d5739805b53a2d2bf0fb3ea0b149ec72c48

SHA256
f792e2d3f3c39420c9ea00851a1b0bdd52b3711a1a6655af93f6a52a63a79d3a

SHA512
e2a68c2856a39c32872791b4282229cfbd28fb54d7f3ad8236c8dd8438d28952448810973b70cf00760534122982850c9766e137c6eaca07c38a5fe7d236f76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fb2cf6a82a5395963d292c01c36c4ba

SHA1
549b09026ab3691d625105ffa98fba6dbaa31c54

SHA256
46ec26c30a62624cc8099da818bfe45cb58d466697214c36b59521c778b25c7b

SHA512
064931424616a365bd254b1f1c8cb42521df4765fec5d9b3467accabed7e23a8a099944ba9f51a582d74318c4d9f8879f2e91dabc1ec68b977765ea796a2e69a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e0bb48ffa073b483eb46284d708ca1b

SHA1
1eb514d6c4dce91e19369e16118f82617c5355f5

SHA256
fe2365b94d10a66579ecd1d03df7fce6b7e467827758d31f8dcc4d569d899e29

SHA512
644d71e6a5e65095657897e2a9d94893082fba7dc39f1c6592fce58cf99390cbcd68ac8874aa08d0c5346bf62116281b77b6e93ae2219e691bbf3538532fe950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af1d8fd1d815c4da77701c762d451e8

SHA1
b2e2081e37efcfb3a8302186d8b0bad11625129b

SHA256
2e5449715523da2ef1e4b95c018f4ec83bbcb8533de93989329980b41ce310db

SHA512
79b5483cb7f52bc271e74290227d71969d7aee3e78b3b305a5d7da12458325b96333fdf13891c4dad9584852eba459530b99be1122ed44635f37ee2937e2be0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af472afcc75b33ab50d33f68ba9849e

SHA1
9de876536de143e87e54d74036cbbf3a30973468

SHA256
029fbbfcb1cf31719529bab00aadf116f278ef61a6c9f7002fbec0bb354c1e3a

SHA512
5a94f8e59e6dfe5fba6cc9b43527766960f8f51cb24216467543feb94a213fc9f102c681a798ae631e76d14c04239e72a82395bdbad14c42dca0017f8f883e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8769ab78ad0986b590798cdfddf4979b

SHA1
f1d5f7789d481d7c8166fa3e205540e3e72063a0

SHA256
ff1d83ce573b8befa9829f2aff758158e7755268ee8add1c1f1517db33f5900e

SHA512
bd943c412fbeb5183a75d40e068c6f99617f6c37328c3eab53f06e97030db0ce3ced4e874461c56abaa327a9dd491edd4ad84aadeccd5eeb76541ef893a58207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0a6ce1cd99c9c352bfff898dc242990

SHA1
3ece9bc776d10791a4c4483b63e054be6715d6ec

SHA256
48e381a7ede1972b86544f6b561491a68482276d3da2366de45f526835fbf7f7

SHA512
3e3c662873fe8181b1aed39990de79ac647b9b89174b60895ad4325afef3e764e701df4f2911683476d74a1a25624df119589cded2d7f01868160441d927d3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2b2f75ca88b438240fbb8d1dde9f077

SHA1
8560bac1f3f4e42ed07be538548e4ee53647241b

SHA256
0bd250a10843cdd626d0c0867c4ee2064567c39a34e955ef9d6db4d2b3923568

SHA512
c2eed0bd2a09211ee5bac412c0a5e50d6bc7f21a25457c4467f951c74519eb89ca6aed6ed04d5436ee028b618c2a107468c57d57ef777e659eeb1e2a7bcec3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1015866f83bb94218b5f15f5e40ab6ef

SHA1
0db3699e585d988643df80f209c772f2edd5fd67

SHA256
81bb6ca77a830c4bbcccecb9ea10153eac99f6300089139c47ef5d1dbd144885

SHA512
9b6cff73f704271ee28dbf8e8bab3ee99379f32500a3f8479975e8be108e040e14cfae54b0133c5369e7b9c24b3daa3ae429ec88b57ee394fcef66b457dad2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0602beb0e8bb9564d0ef0c1d98bf4f1b

SHA1
d153df42baf617a572ba99c10965c1abaf73585e

SHA256
6444846b6e29ac15bbe58cfbd3b64f6ead54ff7954725e0ee534a1b4fa1512c0

SHA512
cadcec858f46c22fafbf43eb16f8351819545cd3421bb4e26984e3867e693a8a9275fcf14dd7e3e08bb6c45bea07c6162f51bdbe3d78742b3d622b29e7bea5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aed0c102e3a34a6b6ab5b84ff295295

SHA1
f3d4dfb538ecd3860cdb16dae91aeb246ad927a9

SHA256
014e83e33a4f6dafddba19240bbc4b9e5b8e5f45a65176d66fdee22ab9d39271

SHA512
c0931001c2f34fe02f17e106c4eda085c201012fadf24a3b39af3c2f2250a8543838c51f5cae7c6ccbdeea54d92c26a05873cab488aaac2b3ee3e94084aa7a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C1E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C20.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit