7e2f240c018007cf429dc92921e90e2ea47d6a9af9f008d620400259296e1711

Analysis

max time kernel
140s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fdb8bfafea3f7a4cfa8ad69f2bdf353.html
Size

18KB
MD5

1fdb8bfafea3f7a4cfa8ad69f2bdf353
SHA1

e0158dc61472e6721b06af27dd0acc5e5b7e1b51
SHA256

7e2f240c018007cf429dc92921e90e2ea47d6a9af9f008d620400259296e1711
SHA512

fcc12c379049c04663d8a5f14baea413aec196b06d57ea600af8e1520a10d3722bce1e5303a19fb662e4344d1ae1f3cdfddb01c1115fd1499c6a3610642435ad
SSDEEP

384:GVIXnt7Jnv4Yr8CiQsJOh1H8S2NyTNmLT3DwE02sUI:pptQu3syxcgTU33DPXDI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C0E53E1-A89C-11EE-ACBB-46FAA8558A22} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4064f922a93cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000888bf2906a825ade28ab601adb2eccbea9b6db4daae3bbd63bb3079a1a8ffaf000000000e80000000020000200000000bdc2bd9abf09b83c454b1828d7afadafd678a303ccd2e9da2d2b1376812421a200000006e5e5344ac06d90b666171a32588e3c5d9e8b88c899545614ff6dbbb2cc35a2f40000000735c97d885b7a671befe7eac4ad753d4f1d7dd64a42ba913a4b32d7b9c0f626e85735b4ecc1a2ac5c475b0f34fd213083445440678d52b6fdeaf8122d2431210	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000008cc60b1ac24effb0e96705ebe723a301d7bc3dfcf11fac37eeb9fa4ec081c61000000000e80000000020000200000008176dd061575c18ebfbc43dc50f6357237d64c06d51be4262b5e67b30a363e0790000000e6e68d9a4b9da8bd5accd2da9edea62505c1790f2d9c63d90fc0cc0e8b29e73ac5e8cb3a8373bd38d7bf15a8d032aabdc9ce5932fc1e53f8a0c556706112fd142319c4d85a895252d44f3147bd3eaa11ff2b7fff1cfe09e9e7129bc66d95844e38b57d38c951bb4828b971047ee903560f65e3e4f48d3661a6a4693004bad1cd976a645b4deb8af27c9e972f14e8e591400000004f5845c91749657978ae7c57dbefa19d866c29648b2f676c25c7f0ebb34963e65d26877e5221422c822fa0840f5e049a0ad1fa4b2f43418d71fb8d40f231784f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410271868"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fdb8bfafea3f7a4cfa8ad69f2bdf353.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2260fea3838ac21d90195d7bdbbd74db

SHA1
f7a9c0216a458b3b300cbb6c3bec8f1cb95ee5dc

SHA256
f63a2b3b21b3c4999ef11e45232353833ab8553dbc6b8e76a3e4da92435692f3

SHA512
93d787c647bd1d58bffb8162247c5510b2efc99b5988f0e1ae6a6ed7418164d564537012e1a06d05a561d84acb69f80a8868eee1c3b615a390e2e6d949464880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
455e59ed8a67388f4eac90ac1efb5057

SHA1
27fb0573f4468bd50c9726a6e84da7336695cb8e

SHA256
9e97b64a95000d424e699ee1c7dd412b5dd9dae87d88660db4cb01889d62e364

SHA512
374c5ea263169f3f84bf1ad85df804fc0f6884ce8acf5fff4a76776c00a5c89e7b10c0695cafb439f47626e9728a760f46eda81e9cad7d217e50a2643f8ef66c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee2fa6acd5ae8100488b2d6a36ec6843

SHA1
0f980348291ac1522827dbb0d2b2ca9d7b20c36e

SHA256
7e88e660033222f664b8a4fab57f3605fde48d04b96005c9be1209a3d40c2e66

SHA512
5066361bbeee8c0370b9820bb8ef90d55bdc7e62f395cd940c0d24822b1bf7285e065b4da2f266629f476906a17eedc112575c0c92b91c71b15b8d8700b36543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a482cbfe5f917312a4dc09ad65703cd0

SHA1
33585b10338b78e33f2a8f03ff4a7ccd1e485760

SHA256
ff315ddf290e40b90719466a596b86a68a78d193f140026b8e6e2d96a171d8e2

SHA512
1573f354530234c5997be9d4e58c394b32365f5fe64f66af8fb21ba210f05b5385d15645aa54ae03a89c115b31571e1d1f162351630af3329fd7a2193375a3f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a09b8fe8dffe515e931f14b4ec956866

SHA1
418afe8d3d7e7fa75e036c51d2c6695337fcbd33

SHA256
44c886d1bcb89fa9e24486598adc93d43adb16c559ae88fa73a11feb6fe23396

SHA512
43e897ed1970d39c44cb08b2704e292ade80612c044326fa7a51ed578fd0a7160975f4e524cfe392c418b43c4ac880b7f283a40e7bd1133a9dbbee5effb28bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e863f2fb805b387a795e7986012c5103

SHA1
56928ef0768e8fb9aaa9c74868379b93afdabdd4

SHA256
15b734b9c91b6e12f6c66b6d5f24d652ab4ea07eff8335c7978db0d8eb50e480

SHA512
47035486d43c56dc0050bbfc620a008c926ccc58317a8389f2c7973645186832bfeedbb10f81b9b60f3b3fec95700a187ef87c19064573edbee40300ece38bd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e44e67662a600eadb54563ee7ba7fac8

SHA1
b45aa057d85dceda8cec95d76bacf6582245cde9

SHA256
f8f954f94a5b5874b2f3004a42b44f1b66a396584bdcbefae30069445b3258ea

SHA512
62d0c66e4abdad70995b2ccb1285b81b1fc109a25a004b1f59c5e52dfae64e30dfd29e002200eedf34b9ef7a2c3c59e935229609f2abb69538a3ab3ddeb8637b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3094a400df8d9406de7a5f7775ff357d

SHA1
cc5f3a91f21cb24112d1f25a31c60f952f3fd6eb

SHA256
fbf0a9f1c7101730def96e0d73d626e8bafb6491894e1f0a99833ad37003da66

SHA512
1c33e74d2f7afe382ed26a819c4c264bb675b1a9ca8775ebc891f0cb0ab73db2df28f0cfdd1269cd6217deafd44c66e9aa8f61392113f3915f8e7344b541502b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb7ea201d73828c6c5572cf1812af859

SHA1
31873586c6d475f640633fdeee47a03bc036ad6c

SHA256
b86503763e92f9fe45dfb26536f91bf628a8ac129b25f22de46bf273ca34bf9a

SHA512
a8c644b82d5c3b6ff755ea0fd56ff038702067fa772537dfcbd989fc039cca88c50a17750d82930ad7be92eb18ee61f3fb493ceb6bb288f298e6577e1131a3a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7588a4864f062f840c85b3259dfa4b1

SHA1
c2833fec62adce2a668bdef7e7db3807a86c6883

SHA256
52382795c93a915bf191d445b576b29d30ca1689f82cc1cd12559a79cd5d00ca

SHA512
cb98d677f346624bbe5a8adb873a8fdf2b9c6695dce6f39301e28b4c5eaa3f15deb1bfdcd244836987c76b255b9ecdfd7e73431f4a2cc364ed9e6008a3c3d443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d290c177521892ac141bfc272ae91d

SHA1
6a44c25b76b6a6fed2338dfb54ecae5402f7e133

SHA256
c9bab2a9a52aa96ab0ca456d0e9f370b91a973c18286088ee4f9e87c5a5b39ff

SHA512
1ab2f9a126eb66ea8f3f664db70484e214eab91e3cff01632fb5bf776856bb0797b0abf5ad6213dc66184e4c639ae549b1e4a01c87530242baa6c53e46271901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e773f985fa2d35a91a8b1997725fcfb6

SHA1
db4a8b4a707f9d04c2929fa391a00d95a81e27b0

SHA256
934c7b272d6013826551fcd6fac189ab606f3ecee812444e6b84273d5e092058

SHA512
23e502d96397d80629680521094525c6e701fe8dafa13ac7810c82204b7f03c503d9c8ba147922946df2b610d1a41195baa4aecc358cd496d8adf27191a5e4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB869.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB909.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit