dbd94081ccc4fd829a1025ff2fbf40311e32f46053ee0f03e7cb108b41e77f3a

Analysis

max time kernel
120s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d0f424c02cef9faa23cb92bb3238433.html
Size

14KB
MD5

1d0f424c02cef9faa23cb92bb3238433
SHA1

871f22999310523a1e3229bc39dcf507c186dc59
SHA256

dbd94081ccc4fd829a1025ff2fbf40311e32f46053ee0f03e7cb108b41e77f3a
SHA512

5aabb1b968f85dee21bca0a972ef652889cc22c445f042098163e270dd457012e5f8210ff5961cabdd40725522f310b5edc9b81b5b5506b63de78030e133ade6
SSDEEP

192:eren8VwgJLiGAZpLwlLuuH8YyzgGBv3dp3JEVVwxMPEQd0lLXalc0DI:YiGA3guo8dUOvNp5sWod0lDaZ0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000001d3bcd815615644fee73719effc05f1033eba4d3be5569dfa4966c9cf06ab9f0000000000e800000000200002000000071e9d9454db01ad0c12f10540187f94579f7aa7ee2fd0d1f6464d6190e29b8dd20000000c554a7d2138ed829b0f71f8eb57418dbcb121de9274949d4ffb8fcd554c60cb140000000337d318fdf519bfac32a60c153a6b2f2966b102bb67dda7247582a9394d6f6150533518d922de9163ab36ca2c535e63d74c3c60ff8d870f708bf0571903f9088	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F1DE421-A86E-11EE-88BA-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000071fe912fca68f76465fbeb2b840f67eb72da8f7a2aaa934e8e219e44d1f703f7000000000e8000000002000020000000e68d4428995f213485b87a127d8bf9fb9a7982a2ecd09e3283672e224af217c69000000016ec0785d934b4185628a30f8812f8438a48b13eca6fa2172ebb99927173a533f60b0a55a914f29729613a6080869a68b33df5a4fbcf8330a1e7a78e587ad498cd6bae2762969d00e303b4fb6f6c447edecb15ce6c12bbb1cfe0f64e87a0aa8164ac897c4646f25b76dc741c5b383c5149e07efc1978755f44d7ecb34e237bebb6bf35fe7ae662fb2c65ba21e714778940000000d5ed2eede7aecd7647248cb2b56b6c63f8a2f463d90fabf0931234dd833689aeaa8c2cca332696f68691392aba6ae0b5ef30edd73bae48e67e5f1eb2597374a1	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410252095"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90928d257b3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2324	2512	iexplore.exe	28
PID 2512 wrote to memory of 2324	2512	iexplore.exe	28
PID 2512 wrote to memory of 2324	2512	iexplore.exe	28
PID 2512 wrote to memory of 2324	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d0f424c02cef9faa23cb92bb3238433.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d226f2f3f987bef5556950d4df73b59

SHA1
aaf80c7b652028fd69c0b0ea6b0bee0cd5f6121a

SHA256
9ec38c568b47fd75d9d9f6c4cdb016f2de44b6fbc16d1b28e1c6c69ead5307ed

SHA512
ed232bb9a6dc5aed9711f1a2600d3252abf45adc42a04635cf05cace925e0d901b3af39f58410ce60b9e7666cfb6251cce111bf5546040f099c419db703b0015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be43c2a41e67b704a1830161070b91e4

SHA1
fb0e258d4a0aaea26bcac28fbe1ebbd910eafff2

SHA256
c4a2ff488cb3f6c83ab583aa7850e34906a5e91f1c1df93c92207f59ec294a1e

SHA512
ce040b3b2d3c288eef9e796ae6a91f9061f0f449abeb21c69d0456adf1687b3e29e37347a828b8106c7b5116c292074fef32371c341165b16f71b1b6cbf2916b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0113ad0f16438dab1e3e03dc765e3036

SHA1
35283d3e289465ad0c4c4bbdd4d79516453637b0

SHA256
d0e4eeac0768aacf1e0d0e36e0064852bc1d2dc850d35790186fab9604e61d5a

SHA512
7420310a0cc48e0187aee7c38a4b9a1af11676245af0e6ae854c27992b2aa750b8a3695e32ca4cb2be84c040b334aa3d8905f3179a47b0d8b5fe3b35f709cf41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d1ce5334cf2660ae12835184a2d55e4

SHA1
ccb72b7c9e9a984635f087b87bdb4e8fc77d786c

SHA256
a68ea150e05174ed860a920226976bedbd951f74a92c4c72adfd21257d7cfc26

SHA512
7270ccc0c1003366ea6d63c186b0299ae59df222abd462910b484a6352cf18cb36137d0df62b398f857fa4d927d07f345f6b0f5a7c78c98664a06019b8a8c01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
459c907188ed2c969594d57c5a25a50e

SHA1
0177f04385011203f855344ca207bf184f48aaaa

SHA256
7874c55befca866f9c31181f15a1ae347dae87f150d71f9e01dd67d7bfc6e892

SHA512
62386e3253422e926727f78219ecf03d65e20d1bdd6c330596c1469eab3a582b1937807447ccdf00ee3dfcc5c2d55b6ec3e59fd3937b24271b2b289310d8a54f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95c3f3e06b575b37b111b19dfcaafcae

SHA1
b1dc0b0f81937d804487c8880438df48e2aeac71

SHA256
b88ae8e013c42af945483ef9e53d0f67227d8846b2aa4c4f7ced24382f824602

SHA512
189028f960ab5f0f152b24911a1354c273cf38111627fdf4cd08c624802df6366045e3d4bdf8be2645fd3fede121ae25d449f74e6266850a7448dd511f499841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81162157254530639b9284f596e0ad98

SHA1
89711606f371b0e4e844991a3cf9006b1a5fc54f

SHA256
8e2e5fff9c84fc784641d72037588c54db24872bf33d366a0e5559ffc50b86f5

SHA512
501651fbdae350297c9b93a3eb768b2790aa50f457bceb6408d333c401a165231dba3add1d37b876ee8c71d9a461f4e8d1a2b09d125f7ee180f544af36893dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b4b53b1bc8cacb3aff2ad2f848f3b11

SHA1
1b01ecfcb1120b6fd195a2f308a5a2937caa5fa7

SHA256
c6f85e9610207c315f3c7afdc81bfe7319142ab64f4b7e63f11210e0609d84cd

SHA512
2dc9b3ba182f7a5d1a4c204163900389db128181c12a837f84b7c2613d041f5ebb9250bc5d5e093d3bb77fa1336dbeab9b5ab1c84b62f8219fb2de1d7b5328f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c5938607e81e829b79c9018ea44757

SHA1
53f70a6fcd33ec2b209c046720d7c311b6790131

SHA256
38eefb6059797a4989cd9bde4b0430af398873c917a9dcbfa1e6a86d2d6bda89

SHA512
a52e60570d94320ac837148f16a4c6d90e89769f8949da1902ff1be7efac46e666f896d66828e185dc041367ee10e09215f07812acc67acdf6250a92ffca9e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
870e6ddaf3f82878038ccc4ae22a5ffb

SHA1
8eb4b6cc63fa5c4179571c46187fc41bea78eacb

SHA256
cb03a4bfeb03912badbcc369c86a06fdc84551aeeb8797606a105127204e683d

SHA512
20b8edcdfa7602fe60ac8eef258a95f19cc9f78bdd18e3e9bdb8177e56953c28aab93ff198d86ef29a85e0f4f5792ca7771c77561fb1b8bb9157eb5d65035485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da43b370ba015abf1e28b3f89982d2b9

SHA1
ab71e1eb79f1d9c060d019a170fb09c4ef526912

SHA256
9eb7f100cea9cd8c4469d9fd457a140d4f95d803242edee98ab8ca5dd782817a

SHA512
227cbfbcfe44d44e82af9fd9f92f69df88a5794b61920ef5179694e6da839abd810f7402ea698ea5fc69e00cba9e322dfea592e1c69ecfd7f01d3d7130a5445e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FEF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4021.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit