41b270394d0279620cd84028e1dd4c283d0fb6207bb95e8d23054e3b5ffe001f

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0414e0a740453f83a8f6ffa8aa16860a.html
Size

83KB
MD5

0414e0a740453f83a8f6ffa8aa16860a
SHA1

946cdb891125c4d214cf493be9e671e1e4b709fb
SHA256

41b270394d0279620cd84028e1dd4c283d0fb6207bb95e8d23054e3b5ffe001f
SHA512

ef4b186ba91cf3e1201bb59642d93268a5461461e8d176ccc7ed5ade9df40cc22a23fd7ee178c786dac2fc54702d588132bdf34c0620925a441145b94ee2d577
SSDEEP

1536:2lr7uaSpcQ70NcNtxNSNeNBNYNoNJNbNPbxQ:2lHuaSpx0NcNtxNSNeNBNYNoNJNbNP2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{554F4E41-A6CC-11EE-BF28-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000aab5d1d256083811714441d31dbd7bb43669138b2cec68e2d4b22cbee78aafd8000000000e80000000020000200000006b18c3160ac8f33e1f32e3e92efdf6015f1d1f2d28d773088464b9205f8167c6200000008e7f66c5c0f80b44d9a3097d441663c1b5911f31593a31f82bad5240e01d41134000000046da9f1be695522eb335f65ca797870b995917b331ffb3275845a59a3341c126d8b7b3687b8cee665f06223387293e2af9f1c8239daa62704ff01ee59128eaa1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002691c9a66ba61f668ec2c16b4328a0f26930847dc629cb13eee7c16be34d7da9000000000e8000000002000020000000ae42bc4dee2d9ee4d8dffcae26bfcac371e1159efff1b4d29654637d7dfa9af090000000a94351bc9653fd6d64062e47aee717fb700a748b9196c0345c5de9ac23960527d5410468fdae6635f476b5f2f9f0e37fd2723e0b5387445e1f508fb108d322bfe8e89adc00d1844980c2153341e6b7f4e53360f4219dbb982d2e8589b6584aa4ab8f4b12f2d5dd0e4f671e060a129a2065e696023c4603a542df38f5e9d9b57becc70643f7d1c1f2e75600489487b8e0400000005806bf3d206ed74262144e1b474b78a6615797e40dc8320e4049731930cb74346c787020c178272e570206377e5c925ebfd3fab90be68a8cde149dbde29368f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410072574"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d7c541d93ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0414e0a740453f83a8f6ffa8aa16860a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6c078722dfa8ffce361dc5cac8b7671

SHA1
d11785db71123c175b456138ce3ca1b675316eaf

SHA256
95dc74e01295e88441c0ec99290949f035155fdf99f59f94d2502fdbc9c236a9

SHA512
b0b0c3b4f6eb3aba09d8796c208a8dd4a2b4d71582e0d8cdcb0fcbc8ff6612cbaebe5761429fc792a8d73d52e9007fb67d43a1a602befe1e742ca95326197e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
679dded9bd04dc08d052263247e6978e

SHA1
f5a0232ce9d1c21ddd65f0375a745b5600c0e677

SHA256
0951c55aadc0add38e2fba57f4114f1739a25c6ae8c6a02d748715ac66c14de1

SHA512
08b40021d7afeaf378ed847f1b08364fa3b813bf10a661f12948f0780b564606db91e42fab3ceffeeaa0105d5224f7c14df206edd1743e1f49824b001f3a278f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f755eb3ccc4724a71b1797930379c38

SHA1
aca10be52e72f71220d34a786bc6cae5504a53eb

SHA256
55b845e3d2490d2b370b0c0547aa87cbc67be1703ad78d16c7d67d35ff91cad6

SHA512
9e7a179089d7a6758e8c10cb1c8d0aa10af86a0b292c057cc2bd465f96f044abe79e183900a7ac743d5209d98cc5e9836806b3dfe2a768ed9be4af93e58101da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b909f87b28a54ef655f6474485080bf

SHA1
c8d5a50d6479b96738271a429c5a7e09bcad9f3f

SHA256
25ad70a7ac961db42f260c568dae5a0a9b45f83c29ea67b14f9b99353956a85e

SHA512
15b53548cb7aa22d7f94040ee6f9fbaa25a74c5e78c3eeccbaf0629750b4cef9598e2f4db8b6e7dcb072d77f01ead6b3a88d4b32f4f460d55a492b7455f92356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2d8dfd11071bc480b89800191182b03

SHA1
4b60fe7118949a93f4996537a30085c10c285235

SHA256
26b740f5a1f9fcc7f6a9242253e89b020d1682864c18c3aecc70ddd3f7617deb

SHA512
dda8e530602995b525436d1a24c547ec327d49885ba9e7e9a1d12c0fa314708633d43c8893ae6fcc9aa200dbdf399f26d24479612c24691c1230740a2042dd6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b678d4e741ea409cc78f0fc67e19be8b

SHA1
6023889e4cc6f49fc9ccd190ace288afee3ada49

SHA256
0e528cf84986f483eafb8e718429e7d10384df81d1f8e344b9733513eb9b08e3

SHA512
4da99d8aebf047f2f817b56ba64a374a5f11dd339e8d1c1aa11eef1919809abcf69009ff87f5266c6f44bee54bc0f9b5046dfffe77499e3059886794e647e5db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e706970c34e5b4748ae45f8ca483f901

SHA1
ec83bb89616ada745689c34703684ff98cd1cf28

SHA256
8c969054a80c2acdda276ffdf1a74878c57dd05347e501fd6cd7ef520880a0d0

SHA512
41bbec9937050e3cd4a27ca5d7acceb5d3e133d8309bcf66c55eb31c7c9fc8b8f3203d9e0e9b8a94c31287f6467734de2ebb2c39d2213ae145ad9716944024f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
0cfe18ceadfe6d9da6b93fe15688efec

SHA1
a09e93e33cb5a248e837b7f6fd050103876e0106

SHA256
ceba493ffda6c6adde9518d1529977dd489c94ee196025ecf3e57cc6925927ac

SHA512
fe5413dec43712dd00e431de38a24b21b5d2b2ceaba823e75407c24b94f8332e760b1153b5d62db8fb6cf734a24454e007864bc5d09b378a7ab6fec6c7b48a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7F7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF819.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit