dbcfbc9816fdd974264fa4bdf4a1fff8c70a4abce62aa1e9fe46b832dfc55d47

Analysis

max time kernel
146s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

201a557b74d0b22ccbc4459662d7fa89.html
Size

57KB
MD5

201a557b74d0b22ccbc4459662d7fa89
SHA1

62079e9b2ec3800349bd8b9b0e8e5d57c64ff3e2
SHA256

dbcfbc9816fdd974264fa4bdf4a1fff8c70a4abce62aa1e9fe46b832dfc55d47
SHA512

0cbc17301d8d781d233fdae3b9b59858b2836f404d38c93e785f1f848fc3cb5c18d4d46abb02bfeb7018dff2f5f3a3a63400b3ed9a1e7e4f19c84753680c0db2
SSDEEP

1536:ijEQvK8OPHdVAgo2vgyHJv0owbd6zKD6CDK2RVroXnwpDK2RVy:ijnOPHdVo2vgyHJutDK2RVroXnwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000046a788d3a2dbc1c68104b2d1db1e0fefe323c56f840614cf89475c28103f3d2a000000000e800000000200002000000041deebff96c2bfb9a76b407e4df4dfd9dcbaf0f6a9968ff86c644790c4d48e2920000000e4facf0dbb85ab2c595123156091e11133d2a8faf2ab1227af04b63ec6563075400000000f4f0026cf0ed3f043829064e87ac8bde9e59a7150c4aa7cca142ee348851f0d0ea892cf4907ec449cbfd130db50f35aece7307b13dcd772b34a87b46445f5ae	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000008d93dbe9e8e9790efdff70f3c9461916929438e4d22db55c73728cd60027b5cb000000000e80000000020000200000003a1be4e1ddfb5d0a91e7e7a6c80c11246683140d12a551507e0dd9536eba59719000000053f936ce20f75d1d467895f9cd7f3a9fab02c16437a0bb40f0484bb6fd1a33c8c8d8c425f97b7f0e50caea7eb8e9c2581a92e07e4ceeb8c03e904ce03ce4a797333c1474877d33ec0b038fb3fb09800d12d3e9553a42d503cd144f17afe357598d83e35f5b824a4113a804a8e040d0b4296f9093fe10dcea5171730401b26b06f698c249c86bd25dc1fd824fafe6dbe940000000206894864a8395cefd50fb712fe3c8810a6b82fc6b1629c8d793fb2c8281ea730bb86bde63c5aacb7639777fd2f6f7cfbe9583ac47d04dcc4a3198cf363aa0d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92253D11-AB41-11EE-9695-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410562738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702e17814e3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
308	iexplore.exe
308	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2708	308	iexplore.exe	28
PID 308 wrote to memory of 2708	308	iexplore.exe	28
PID 308 wrote to memory of 2708	308	iexplore.exe	28
PID 308 wrote to memory of 2708	308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\201a557b74d0b22ccbc4459662d7fa89.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfe921694f45dd3d234c435da27fba18

SHA1
aa885160a24a0d2968eb211bdbc9fe99d504b757

SHA256
9b052148953b96120bf441b7394e294bb77d48c4cb9f6886b6158b99606530b4

SHA512
02d1f6cccfe06822e49853da81337afa5da2b0e55523837a2d82b98d9d206207dcb3e49bd7b29b9670c9d9c63c397a286c960ac8578acfe1549ee7fffafa38e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a74d676372f972b19fe40f72f7cf77e

SHA1
9f79db26925493ce547df6d1a12cc65af0c8dc61

SHA256
1efd3edaf9cb809f64a7db08616a1002a3e8b69b2fe78228e7389b6a15e6534d

SHA512
b9e9642cba4bb757182f8c9204865f0164eb746830bc7642a879b4dbf2d840605e5963f8caa3b137da34556a7cee9b240adf5e04f1873e8a4f6fe753b5e8227c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6cc91762c07effaa50733a4213e0b2

SHA1
f1f29c5feb95f485abf01b29f55a2e6725c84a90

SHA256
68372ac5a77f71e653f5a934edfa450f7627f0256e8af3a1adf33ec4e62d7b03

SHA512
e6691e00b0d733f909b3b5062a8a02184782ca321d832b8255780f58eb4efab63c5b8d03641f3aa6e8116f03e8e1a989b243a1e6bd204219740a24f9fb561edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
554fcfbe90a2b3c53fb3b57f3eabe143

SHA1
887c080d742c74cdb6ac55135b90b48879b499f0

SHA256
ce18bf8023003b06ecd781797552937f5b8f63c6b6bac59fed8709626381960f

SHA512
55b29c5b823abd2b63e79c928ed087e4e4740b1a0f6ee5147fb0a95f3b968ec7cc49aab2e9a6829792626fcb327e9fb0c8b2dba0f1fe5bcde2c0af6b1b6fafef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12bf665883bb8a0ac78d4d8566785a99

SHA1
2adbccc895535f13307b90b5cab2e3ea43ff910f

SHA256
e618b81c8dc37331f714f9fccf1b54a86955aa1cd184c1c7d85a810472f408b6

SHA512
864bbc69478ff4caa0fc4d084d12069609980c24dbdaf22341dc0fe4791313cabf79224f83e4a9183cbe14392ed86028e187c70ac6e05e44ab12da8bdbfd9ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b30d6e985ac8c902e1626cc3dd78053

SHA1
1e77d9ee7d86b4f0a93412ab90e6865164e9f4ca

SHA256
bb23411472a47d3bcc853507d0fabb86c7111857c65b09619a46c95d170011db

SHA512
366df1b224efc1cf0d9db78d045441f0c972b1bbd3b8a65cb9ca86d234c5a05347e245fdaef8ee5c6e74861f92751f8c4fca229eafa15ed75c52baa756fac91b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b44c411eb90346ccae47a3eee43829

SHA1
fe00723853ae1396d45534786d8d73b6d027eef1

SHA256
686026c8dc15fdcf54d2f5b64eb2d0afcde403ecc5c9e61c727dc004fdf6e595

SHA512
ae57a814a10a8a0132017d5b53499b499053de6d85fcf8d4c04b231cf37275e6181ab1711f378f4c54f45c155321293e08966fa4c6fab27aa3c2cf1eb043474b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e806669e4eb4b98df6245019e3d83a79

SHA1
92a1c3887cc0ef681528ba53e438c2143447607f

SHA256
7e5dfaa6304fe17b76a8b429860177b5718b0fec68c3572983b1bac0cfdd1990

SHA512
fd6bb942fafe8f6ad6043f0c6af4e144b1a5299b5771eb9c71480af3ee338d65f6bcfecefde010724e0557fada588fafbdfc737ba156b926837976e264e08fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
713d736f2e8e3906b54ac5ff2d8b3d94

SHA1
e0ddb5e5d544d2dfc416316de1270e552554caf0

SHA256
be2cdcab5b96d5b8879d84aa3f905e5e9ff7b76751111f8006e17bafd7bfe71c

SHA512
9542e2fe10602d9e0d491653fe2ff39ea3cbc575886bde1cd078b477fe75e90b45c725bc7247fcac825739e17415e89a0d1850e66c72c215c92b602932d845db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5b531af70e0a36fe1e3d47036d6ba75

SHA1
b17f8997d2ea45295a20fd93d8ebb5d3ec91ac36

SHA256
1ce53c53596ba8eae9be1b4411f188774134502fd15b8d1cc0e3564b80b9102c

SHA512
f10e63482c0071b9b3867881f9da33bacd7709d363f72260d85b4e3c020db0d1b86ef3161c72772f6556e1b80994ec171fcd44be9a447f751526dd455da5f187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0ce7dc5a8c8a7aad691a38374c03ab0

SHA1
d0f04230db61d712d5e1f8c76cc39c2cf19654cf

SHA256
d89d8b5ce0e41b7f1237de2593bcc2bd764bd01ddabc7436d0d2464d481e2120

SHA512
844c1f152a9fae7c864f66d4daeb3390ed7d5a851809e08c279e2fd085e9f41a730a6475f8cb383a88c11208f1cd3641f59fe4ac0ef6bc3cc9615567fb548ffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4facaa36e14df1eb4b69be1f364cf53c

SHA1
cb3df6505923c2ea4cd1ea815d2bfa3d86c59631

SHA256
01479c85e4ea0bca6864b09c5c3c9dd1c8963a18a63c0aab76636e2bf11bcf44

SHA512
80c919e341a98c417a79794fbf3e6b5f80a033296d0b72e73fc9010a91bcd476f7c8a4ea1613838eb70853ec338d5d31f7a8266dd3b90c4bd300730d96d6e729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\f[1].txt

Filesize
34KB

MD5
08f81e0f5793400ac53517a2e6bc4f5d

SHA1
18e43ccac704fa47eb4944767f985ab26dedddca

SHA256
0c9ae553d8fd5669aab83820e8a693d46a094e2c8825e8f0575e303d7dfbac89

SHA512
7861049b1bb52dcd503d73d3d13e2ce5c01ac160ebb3f14264072c96b82c387eeb231c516316ec8b9369abc93b082f70eb4d7985f3056116c9669ee708918899

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab51E9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51EC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit