c0e623b99baef4ad4f341cb979b369b57e0e86d39bafaae4da55f0fdde806b56

Analysis

max time kernel
140s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ff8ce54250670457b529d2e5f5a20f3.html
Size

9KB
MD5

1ff8ce54250670457b529d2e5f5a20f3
SHA1

cc9bb312645caf577e171fd77a04f8e5001d080a
SHA256

c0e623b99baef4ad4f341cb979b369b57e0e86d39bafaae4da55f0fdde806b56
SHA512

5c9bcf62e6d2fc78a357c432540f866f08286aa2516b0c0ab0789fefd841499520aec07ffcbee3fc562d58d24e493452ddb551a861072e7039d16553529707f3
SSDEEP

192:ln8uqnGDSSW0nqRUP9e8GYTCtnNJOa4PKjaF0+GrKqkS9Jo/xKxGa1GOCuXpzN:ln8uqnGDnW0qRce8GiCtnNJOaUKjarG7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004633b0f3dacd1145bd00b1b35f8bb5e56cfc9d469fa27d98bb386e2d46a41fc9000000000e800000000200002000000089656c2693dd954ce277642e1687227e9fb017ed4eda8f05161ea74b7d250ad1200000002839c54bbb5df79a738649121ab7d2c9c73c164bfe39cfc8d73991695d11fa0140000000ee3625eb556a3cd2dc91442dac7dba599f9c40b8b13be2114ccead1041c601fe354592ce053004b5c3dc62b021909b4cf892f1ebe04059ff792029ebdee55e4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A9C5741-AB3C-11EE-8CF2-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dbfb20493fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000fad67e9f6ff29153f90930674cee24223466617f6f696a5408e74288a7fd30e000000000e800000000200002000000040a297145084065e5aa69638897e1958e7c24dbc399c10c60f7d24b68d5ae46a9000000099b636fee5a306f0a4eb33e3dc4d65d18687670219ffc4a09932e1c6b9795ba5169fa631df077b9329596ff2536070c41d9b194bce518948fdd934550ad44a2bd039f5a33d0069abb59d7d53e7eec9d6ddb05ad7f5ca92b81d6deedef0e90cd253a13b531fec4882fc586b65818015adc7de35e67dc60cd42bd76bb2dc02d5d830a28e052167913270c11e208595abef40000000423ff3faac5d2dee6e896a12f699633db3b5de08e93ff9506b631f731f038c01b6575f9cec8c3d7759f86802c3032c5ed99dc1268052a9a3dc1002e41ce768fd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410560440"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 856	2504	iexplore.exe	28
PID 2504 wrote to memory of 856	2504	iexplore.exe	28
PID 2504 wrote to memory of 856	2504	iexplore.exe	28
PID 2504 wrote to memory of 856	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ff8ce54250670457b529d2e5f5a20f3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
515ffa7544cf49ceac2035961fdbcb9c

SHA1
bba6700552b4bf80e8839d47aa4e1395e5c527b1

SHA256
dc4ddbca089db000ebcba27f59836c1d54d4d72cac0852611d34ef4a73ef896f

SHA512
505a23b9e2410eb16216c6c48983400c7b7cc1f955cf7ff3995c41d8b278caa1cf39fe68d50827302960919cbfab22c409dfe5a45ca63103d7c76a573d5d1c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
695f8856b10241807431b53f5e6ba454

SHA1
688eb4016ea17add82ab1c584d88b4451bcdd998

SHA256
eeec5d16748062c5672a8ff54b9f488f45022b8f782556fed30dc6d2b6e432d7

SHA512
9ef74c0bb64e456d7983090afefa1504281c82b571e2625d62068ffe6f6cb8cdc3bc8cc0c5ff8ac22d2eb4facfed715255bcd6d54cf3d8e561fb41285f6cc55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ec810f4d47ef42878b1bc1d8059f58

SHA1
ebafb42253c0fb24c3fe979ef095461c4cc6d212

SHA256
ab5aeed95f1b1ca80f4e2693da49d2bfdda5f9afa7076f08acf228c189ab211b

SHA512
df5afaeb77b42a539bd52499a48e3e58e106cae929e0f172fefdddc68d0187302a6abc25e71596430b88ed14df3284afb70896e00f0dc4f5b2e64a84350e2602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d8af87b397734c18bd31f56040b9349

SHA1
a55e4040109fe35d3526e620b31cfcef523ac181

SHA256
839c29bf599fac099f25ab8c15f7da0e02468d8d6522613e6ea4edb0a0dbd5ad

SHA512
5a68db3d54eeb764cb02afd87ea20b7b717e3130f10b6a717a2be52010225a89e3392b5936afd95c237988f361561a154895471a5e15860ef32367e8bffb0d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7f70840f5eb9cab8d6b2881b1f18e17

SHA1
017660c3beae245240b86200aa16b6c8ca5a3213

SHA256
d50c658e557ada7c8f92223ab1617f273c78c5c13cbfcbf043148435465e6430

SHA512
a02657cae7a45306e7cae4ac02773a9751b24ec681ee24617754d574692fb1f78b7a572a21f4fa2c0ddcc198d9a5220794b4c51955f60dca14db335d7c9e881c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcab8309d47d74e815893c71caa3dd16

SHA1
9f99694853a036c9a8f1830dbfb24da56cfbd2a2

SHA256
a4774ddca9e4afece08eb87cf74471fac4b42b4c541988c20a2142418e9e024c

SHA512
5d058f988245c2f21f88086180a5d58419bd3a4c092540c39ab4fd1f6aff279a3f351a69387ffc4fb9d36b8f680b165cd313634442b8e8de0dc14a65aa5a7af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64327010eae8f8a193c405619ca46bca

SHA1
724c8ee3f079aac84b374c459593e48861b68d43

SHA256
169382db45c1893d392699e89de69cfe97e6ca02639fdb04d637320de27d2252

SHA512
7c4d41f95816c54eb8fcde171b00df8bfc925c277dc9b3bc86e63732352fa8a9b655a9c6085c2e602569ebc18be74a169d9b4a12b4f77564ecf78675a62d3cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e827c1c87ccaa24d49c90da94c8335

SHA1
5537ad2ee660ef9f68ea8c97fe875b587b7fc9f0

SHA256
654d8354cecd2f945136a1e24e745bcbde9a0b4155f9e904807917918a6adff1

SHA512
1ad43ca6513db39d1e94109690dec94993c58cea814b043f8a07b09e1e7e386849933131a5a71ab4960658886b5ea48bde9a41bfcd762ad7914b762ca9f21d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a2528ae57df830f1470c4aa935ba172

SHA1
c768c74f9c5e622e0ea18bc12b3b13aab335b297

SHA256
892d59fe4d7799fca7ce745c398b0ee237d2b6e079c4592c724c43b7b3ed1f8e

SHA512
b597d442def2fa65ed17b5dc8451f4bf4862f7185f0b995fefa67695ade29ce10b79d1fddb6665646007ac68c64ed449a1b588d6f1d92c61b12c29a0bc6611ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d8ce84d4920920a35d163716b9352c

SHA1
e8645e91b1d177b71f93ca347f60f4eeafd261fa

SHA256
d9ac13b2b54f1154aec67c5e95664dfc7e16be5c4c6cf7467af82eaf555bf0b0

SHA512
6cc31a15252d52a8a1772d9add3f183624b38b5c7d1bada2f19803d11cc1b705310044207b3427e304ae94b64e5082cf6b6de483a3a76019b8df8fa7437dc454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f31bcbb8ac8e60d7f93701c9020ca9c

SHA1
b551faebde8964418a473e6347dff6da12434edb

SHA256
d8adaa6173a166a02e23a1e8b318a6f8c06f668b820a712f8592778537de9ac7

SHA512
557286cbe16f485937ba9aec8a6980ced612568745a0f9b79a19c9fa314b135143f44f0074dddb026ce97ff160bb58c8e495b163897fa6bf5e4c0c927e34f7fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff3e65fd15489586f9b7bd019a01000

SHA1
72aa1ab84184f928b4936bf87ff5da2fefc6380b

SHA256
7926fe7ac657f872e255b38c2919c729230559ec14690f8e0858bcffcd71b921

SHA512
9ee4025ee779ddd34cf0c63cae28e6696d461dc0bf285e6fd52ea5742e349d506fc116a801169b8a0543057229e8db1c64728190cb213c22ac026b8b3488ae8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f6f50f7480db088cb5095c3aa15a599

SHA1
0a99cf14a2f78bb1972cffcbaa0bf2993619ab1b

SHA256
7ac8bbd07e7a1cebbf77832eef81a8236d0525ebbff7873f0cbc8b1f9e9c7129

SHA512
a959930fac1fe4d5fe9a1b62dec7f46efa1860513e7ac894b08cf6a77cd4da9aa41a65eab56ded830ce8018ad374e89382b5b5e8990f8ed4a3fdda4a582fdc6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B96.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BD7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit