fab20375e5d320a19553418c9b05f83a1ec4a964599fb289f5a155955eb03884

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

020926194651d6fd7db69c676a3817b2.html
Size

8KB
MD5

020926194651d6fd7db69c676a3817b2
SHA1

5b2b7e0f0a6bfaad791ac819d644b908daeb5ff5
SHA256

fab20375e5d320a19553418c9b05f83a1ec4a964599fb289f5a155955eb03884
SHA512

c9cefc7c1d34c08bfff17a2e0b6ac81ea85bdd38a7ec11522c41e980f1b61e37afc60fdfe35d961f23c2252d9eb6f123e1bb4148dcb218d9b9aa64e027d08620
SSDEEP

192:ln8uqnGDSSW0nqImUyD+zUebsWgyRexFD/z5VCrEgPoqzCJjm/Gy7m+r0Az+MMOx:ln8uqnGDnW0qImUC+zUebsWJRQFD/z5A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000008e230ea7d879fb096368cc8ef1a8cd6dd9b8cc2eb00d911b90cb894467d77c7000000000e80000000020000200000002213acba2cb0dbda0ef3e45b11e192c102953eddf44346ef76f7443f4025ea6520000000a65d45251fd4839a1aa5f597dfe61db71726388d7e75e962ad1f907f0757a9b6400000007a6c78ec5b9c7acfb700e60698ec28192cbcd5731cfe838049de5eaaff93d5ae333780930c8158143a217fb0860501d7e9e718ac852031927e45a94779cde08f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c63f38963ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410043792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5158F1D1-A689-11EE-B1D6-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005bf32cb261d66906133509a273cd20305fe768eaa59d45be4411e79310f60084000000000e8000000002000020000000f969670a197c6027c0d5fb7923cae0e10b84c67318edf89d2df43e4b3c4aa06590000000beead1b89dda8cf26452d5146b3b66045b863e8965a4b21760ad7fe85dc90f75865ec48b9de153fdb344a9416ffefcf9b845a034ed99d5ff628e8e002bd6f7e36c1e86ec477edfd205eab2685ba0e01b73f4d4864e8380a78de21becfe81b159a8339110213941d704fa95b4e935de945d1548c2d0908c6c7507d3bef5e5d3f67f9b5b3ffe2a51d97e809bc86d8cbe5f40000000b65051fe8b8aabf51c64d8c962d0749a1efc953658ca2fdf15b228218ddd4ccdf161ba25084d72228f91841d0871c0819a5c1021d04b42314f846dbc011ed8dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2384	1728	iexplore.exe	28
PID 1728 wrote to memory of 2384	1728	iexplore.exe	28
PID 1728 wrote to memory of 2384	1728	iexplore.exe	28
PID 1728 wrote to memory of 2384	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\020926194651d6fd7db69c676a3817b2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3db83d120cde75661981d4d5c25cb73

SHA1
72709688560f50c5f68cbdfb97a40d836f049779

SHA256
bdca2bad8d98953f7f58288a8c3c0edadac4b52160bb0a446127be4e83cdba9d

SHA512
77f37e085ab1d767448fa04f4d033541c9719874ad01cc7cc682bcd02acc2a8afcc84c4ff3953e4979baf93f5bd65947a4da4b21a80a69acef273adf81cd4426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a31101f6dc684563bd7e636662d6bc0

SHA1
56107e7ce0413d529bc5461981063d8ef1d80302

SHA256
fdcdff49cb1d17d484b520ed8202d8fa10793d7ef0f3071750976726fab4cde2

SHA512
7b365f328e129d7fb5d33c17ac00e2a60ee70765cc2c0b24e0f1157790f2a466b77edab15f5560233d70a66ef92536271dfc488dd114f328c7459ee278839e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49b55d01a1a42499d5842e989a25e952

SHA1
12d2ae2ef3338cd58f9b46dec1401c25ee9b832f

SHA256
b8e51c196503e2c81cccd2e511387342db57fea249ec54e9eeb0e177ca90c7c8

SHA512
b084c0200b16ab3ddeb60f37d0f94f74a33ad4663f6461a06e56b3ad6247a1fcfc8b8b32db1e36b6404bdc3539233c9237e5d8adcd3603b0d683cb2e368cbb9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb82166e703c333fed378f29102ca5e

SHA1
985e2390423a4d4777a17400a640bc92c0a92fe1

SHA256
87e0b6cb68cd59262f477f4a24d43bc00314357519fc5e0830b5184f5ebc675f

SHA512
95be73ed30ef5d4c805715c8bffbb6c280130f567e2992f47e6a7d3330b54d1458238441c3b4f5f7041f2d58b4f44a792aa18a434a70c8ebbcec3bb2517d22a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6250c90fbf9cbf0b5a9249699de8c05d

SHA1
69b56dd58a28cd9d2b5662d5374f6234e358def3

SHA256
397940522d5362ad2e346819f4808abe490ff7b0667c7e8dfb5938d8b2269126

SHA512
5fd585248c0be8143b5d7b63f14590469a862c5bf63153e7ceba353e944fc2dda05a435d857769cde0ff51a351610d90702c4c29ead21b97622a64074a1a473d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8859cb26b6fcc23742eda73214ad6e8f

SHA1
28566b0ae0016822eb30516957c5946cfdc57413

SHA256
df7c458ff1d63566b5424a7f3cc2db1173a8c1f8cc949f0490bb37b5c894f639

SHA512
52353feb2905b8c0cef08d8235996a9d6eb287308e015c363f8b8eaf09c9f5d6ce507a4c76aa9543857970b5bf9ecce4d49f0026069a7748d346d0492804d19d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
454a17f74a70a0a952a0777ed0948455

SHA1
6ac916a1d963c3d424ac59c52e7ec9ca37e49f8d

SHA256
1dcc6e0eeda86996f99c80f252a62e0c13139ca556f8551f9276ad7bf7940c62

SHA512
81f0cb150d339d6455b5e02797c4ce80463bb66b2f8f0f61bcb04af1b8cba4c575a184ea39a5fe621314b250b696f87a1d9d0671a7fd1160c17cabc308bf32ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9da62522afbcd58f4cdaa14a17792d8

SHA1
acabd3b797b825aebb46fb49d9ef0a8de2c67b82

SHA256
2feb918b22a0601e9fd2ee665667222baaa8c1272f5ecbdc0f49987d68b05bfd

SHA512
c240d38c84ffa1171b38fb27c4694f4e7c94f35966092b7e837e06c6579b7f94d5fe326b807c00dc27f3acbf435ddf48095f7a3bcf35f9fcbe169b7c664a81fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d8120af2a47acffb82966532e1eab8b

SHA1
9beb6427c9523ff954ea7bf0c655805e3ccef627

SHA256
a465a50210e5f11c532fc588881edd37498b26194a1286782cc835fe8c10921e

SHA512
53b0697f795bfce6f80005b2d91e8364f04be09642505116c62dc04e7c16da5c94726366386112188d3f1f8072fca5478d69390ce8fb14779cb5258476716dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e410a06052bd41419a65725c0850478

SHA1
a239841dff46ac906dc21abc000107906207e40a

SHA256
e3d82110bf62d15c08f17b23eee621913e4618aa82dc29150afc34bfc82332b9

SHA512
577b076a171f6fb1af4c55e31db1644d4365a4baecd65700827f4ea9e4c03d7c44d2e3d8446e1dedc768c81b0754c26e2bf5837681b4258f7329a36ffeef3044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1233dd282e83b2be4ad86a9f95353505

SHA1
b745833082594376d77c20abc67f32c3db264261

SHA256
22c37819b543a9837845ad515dba584a3debb25a37064d26691124dfc2f1e1cf

SHA512
4948496c0ffffc28c49afcaeb8a36c4ec7c1ae5309f3afbf1c1ff3c520456d74d390d27e68d38e0928a1cbc0c3557b0793eba8064d348d87ec9e43cde4ebd234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd3541d245d7c38932721a16b73a1a65

SHA1
7e2a57d55bce5d2ac87dfaf13c30387eed0895be

SHA256
29ce4d33313fe59daf8e847f01eb563d03b6b3fedfec9f35d38ec1ed32c4128b

SHA512
ac9e6b8e118222d989e8815f873b4e176750f06afbaadb3c146923aa3aaf805b4bcd19f29fc9a45d63e6ab960d89bc3d1bb15125161a1d7f9732e7c3f348a55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e672b3e6912a7b9f3cd9418049ff3508

SHA1
5ff35ad687b435f73b7cb7be161436a7057f0b1b

SHA256
3f7d0ffdd9c21fe47f6a41cc9130a47468c8efdca7b7c15934b0985dfbbdb1cc

SHA512
4bf96ea7a21d551b814dbf8b2c5c51ca85da03f5b4818ae185a12e39b54ba0fe2c1cc41cd761f818205da1571e4fcc7e73dae32f90ed89a2e7c5bfccfdf79af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1077eebe57da68d2ab2dfbb5605d0c3

SHA1
578677c007464777ec22a8369eb410e5b42b2e0b

SHA256
398e32c713e4905c1485e08f9c2b3681583c5724a68a81250b5be0de583ce4c5

SHA512
96339528b26cb68964b2c88b2e776d3e44fd1d8c37de94de71c6ca81d22d05b76de5624d14650369a93290661138309c09cfd990f468d6850c25b80ddfb1bb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f7432f9e9dc4e8e53b531517c6872d5

SHA1
5b95eb1323c072f3637a09f3a7b6333580daf65b

SHA256
34781036855345f4f047b0f20b001eb1977ba695f8495854f45c2a6f1e021359

SHA512
07c93748adea777ffe1b2a183ac7cccd8d64441f9dfab3abfeca8d8abbbebed634af6c653fb55efa52ff5221075d77be19fc33e0222a414cc51536c25c603720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e43e3eafb510457522a6b178a4806c8

SHA1
6e92fe49bac5b727420dd3f88b5477641e892905

SHA256
830e1a05fd640380fcbe8150a1dde468c1fade0d200f93c440ed3c1ae957b8c1

SHA512
f70d1d1625e1bf3ba5ab1d7edb9799af313bbe9fc8f56fee364c86c56ab744a8158c85844dc690ae47d0422df9ce784e29369a589499d685f0e131614dd2609b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8a9940e34cd6ec6952ff9798ce04786

SHA1
257d58028216d49b8dcc2d5c2c72912099897ace

SHA256
fa47eef2dd90186c5db1a001442f593a8fb0a87e4518643cbc232a5df94812ee

SHA512
971501e23d2fb3bde37662b7ca64d1828a744feb5f1967e589dde8ce45c9fa7776b06151bbde24c9a3475a9d212baca4d2f2d3050601ad1696cd91860a0d4721

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E77.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E99.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit