4efcf9cb2248c03dbbf9faa33a174dafb6046f2708668852c2069ee9fa991e8a

Analysis

max time kernel
89s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02e63012385befc1eeb19c04db59bae9.html
Size

15KB
MD5

02e63012385befc1eeb19c04db59bae9
SHA1

f242d580ae25de16be48c3ac88a3d22889d8300d
SHA256

4efcf9cb2248c03dbbf9faa33a174dafb6046f2708668852c2069ee9fa991e8a
SHA512

f11c6f7d64e16755b08cb7d5e3f910303f7beb3aabaecffcb44f96fd40df40f8f20e2652d624e58b105fe0fb73e600801f3bd080b2bb0461e8613de70f45a1bc
SSDEEP

384:Pd1FTk+XQC3BBMXSKp2ULWzunbHziKirhfG2gQX:PFTk+X9CtrT+hfG2gQX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410050683"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d59b22e0ffc1b46a81d6331690480926ce2bd4fbec634ec81cac470408f3ffe5000000000e8000000002000020000000e5d5046e9232f07023bfff90515bbe08e0f10a5b53fe928d7c5c39ef4ee1155a900000003b26aa5a876e02803b36e9a3b61adae22aaa45cbfca3cdac10bd046437b1126709da8fa27bb61975d28e353ba14b84c1c2aee39ee5432bf7c5722aa49d34e6ded3a265a0b057a8be52df55141b9098e5221ac73bb654c78486187617a8d9e47acd64c8f668e85d8d278def1e7e088e65fdfbedb4c39f2911e065fdc1e6e121b40a6f2a40f3c8b92880da30b74e0db9ae40000000545ae030a26c11337845f2cb4be3822b1c3fd68387933beb58f9c0ee934163262ac8ffa975b41a05b73022442a3fb1eace07d8ad2aa7bd496d319d16c95f479d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000032fc644e0f024c67f8c594df23b56729986efe567c3633adfd605ab3921fb828000000000e8000000002000020000000c451e5c2f1406e2e8636993fa3fe75981207555a705a0967589d22fa908f068520000000f82d5b5a9bfd48a4ff167f9517e9fb7a869e1cbd78f1ae777b5b588bb41a552b400000002075fb897bbd43906e95ae2ca60870d72f467b9fde753660909d558c3690f7d8debc0ae6ccf8e09fa5690c35ea6ac7b72fad9bab9507e73e484052558395a147	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09d0c4fa63ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CBC56B1-A699-11EE-B7E3-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2780	2428	iexplore.exe	28
PID 2428 wrote to memory of 2780	2428	iexplore.exe	28
PID 2428 wrote to memory of 2780	2428	iexplore.exe	28
PID 2428 wrote to memory of 2780	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02e63012385befc1eeb19c04db59bae9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c780d590dcfd8f0fceee2fcf37949e1

SHA1
f2aeb2fa9fa21cb429ddaa09b4fd6ba4cda61ef1

SHA256
031d42d3f0a7020a62f3b6152606c6666a1d9d4f8df488afb57f35b80652c0ad

SHA512
3feefdaadd37e1b493bd5b3cea7d0b3df55c8986cff0a5c94b306f3acc2795883c2cec5865d6ea6806291923813a457f27ef4957fc3100bbf7b83aaca364d0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d61e446d7b2ec67c36bdbf780dbc1c6

SHA1
8e1ffd1c69f76e6812310e8d6c112a38fcd0487a

SHA256
5761dc3ef8301aa5ac348d99afc56d64cfc1da9ca1af657bfa85cde8007b57f9

SHA512
14e4d509b8fa32ad16a3f2456c6ce992adfbdf06f326c5d32123139bead13979a15136d21e3c1ae5fcda7024d0728d8928f943f94ac11ce624abe2676c567fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0140bd427f53ae3e5825abfb71405be

SHA1
0b198c540058bd04cb52fd644fc7b1cdb0297829

SHA256
a4fbb82ae42b76c89039b4c9eec54334215feb3597cfa90dba6bc272921630b7

SHA512
958ef177a959bc3bdde21f156502c239217392efe63aca541260e78e4c75e38c00b982d6027c253edef3869fd5aeb596d478f55a795032d4c6c06e7cb4321212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f369e9dc069ee340c0dc05d0b0c1a06d

SHA1
cf6cf0f22d7aa48742e55e9f8ce3337b6e3462af

SHA256
00785d3c156fce41266dcbece9c31189413feeebbb73a6574b266b8715c5ab1f

SHA512
d92ad2449d7769bc3860a695c6ef1937464aa51e4436f9ccb51cbbcf2008dbb6f4833e987d9157dfc19a61b5d1d78b7b97811bf70120f260499cdc74589f6b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd40839af6192be5997ecea56b6f24a

SHA1
10a0de4a2b24ecf5f907f230657d190a5bafc845

SHA256
236e1005425c149fbcc5a3dae1b1385b6fdd1fece9e24fa11f42e038ebaec65a

SHA512
cb29786a522becdcebbb8383c4f5d7a5714f1636a9d80c38442fb4243145e2131b6fc081a4fc1f6baa626b61deb21cc5d249f02e7719fed39f6ad6dfc6b08ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72311968177db7cdaaeb63c956abb80d

SHA1
f44b7740458c6866d36c6730a73c25e79cfdc8bb

SHA256
85c7101b1d48891d2ab811e8dd8f39dc02a3e65af347dbd7afec0cfa75119f16

SHA512
d91cea02b9c7ba4f6fa9c704bb476afed8fe9e351b81050bd2ef39c50051905b68567cc9c2db7eb67958447cd94f809c0789135e7a3d8bb9ac1d57f368e5e56e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d836f1c4016de5a5500a89882fa34249

SHA1
d64ef46778f5493ce93f0bb9b8b59b5b5ef1c18a

SHA256
22a23b68695da31c36bc83521bb00b74c6c7b7faa1f2c0543d091f7105b935ae

SHA512
bfcbf9824ba132c46c9e687c48830f2ba26c663d3a4ee9f15cc2dfbeb6edf532658b7ea583219b65ece6261576e60070b4f495eb22ae75a53133446d36b27b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b334c3f0dca538d7174d3a32a43c0212

SHA1
c5e360103cae81c77fa779dad6f8923ad91d9da9

SHA256
4e0f5315acad86c2ede7e3e8aa6075704b03c32fc62fecf83849dada99d0e7ef

SHA512
9ed1b7941f3f3cce1f37d24b2e248f78cbe8ba8d954d64842d87870e4bf4e4e29b1969cef59ceaa7196a5e9aaee3c227f8ff2282030a4406f05a520dbfa07666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de2a436417adf29ffc0c0bfec8478555

SHA1
2537d9b1aee59955737ddcaf1d6c616275da67d6

SHA256
38a60c322eba80b89d067b300e61e2caa282fcd9e53f471d532903b20590a56f

SHA512
32a1120fd5a8a5d9d2e2dab58b6cf1a256eff8c6db9a00c725140bdea4712d2999fca1a7032f5ac05ad7c674c6f38bab941a34a8d5c9e2eae546370aaef25c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
920208e8ce38512e5a4e5baf617f831f

SHA1
3fc2becf5c42b5a80fbabf23fa85c2be831b1fdb

SHA256
e905e4cf6e03cfdc779e18e99b52d11ed0a701a60589e12a3be42c294e9a13dd

SHA512
58db53f3394b2600220a1b2cfa00470fa5a3507f00e47bf3205f9fdf3a3bb7581861e4502fb11de97371e36cbce23dd373993226f5b0b32d4f1c388c635ced58

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEA8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB429.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit