dd84909adc1db8d768128e6c8736d7f94673255a2407c4fb9a9a1c45cfe91344

Analysis

max time kernel
164s
max time network
185s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20294e4035371fff100af4cb29ac6651.html
Size

148KB
MD5

20294e4035371fff100af4cb29ac6651
SHA1

89b62cb9f3d3cda40f65450bbcfc5b2c62f9e64e
SHA256

dd84909adc1db8d768128e6c8736d7f94673255a2407c4fb9a9a1c45cfe91344
SHA512

d00d5c0d850227157ef31be040155641cc0d1b0c3929f6188d7e255c75fffea74c13cb2ffb092336b78b8da6236a012540ab3b1dc3a9e648bb9feb2d136d915b
SSDEEP

1536:SYld1eyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SYwyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410274346"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002589ade2fa2fbc86d11595ea5e90c908c423384c259384c7aaaadf4563bd59ff000000000e80000000020000200000005233c5d32a9b4b945cc243a4552c5e6663c2aa9aece7365f619789ac73692e24900000007407453a1ecf3af834cebf55bb4f0729735243534b1481e977d7796312a3ec165e0d4c84cbe103891e0ea418d0b920b4bbcddc9468654948faf40514c97a6229534af86f4c69940e84d4cc720854fd76a9729ffdd1677d0e13ce9e41a663e235f6429e40d8f15ee2746f7628d761b466acea5d2b21756b0036f5e1fcd868d47709849305ea4d85500b7c9e23bfab68ce40000000e3b585519a76ce3d89ca9308eabbb72597d58f251894a544bbdb6559822d336e58786fbee20e1700cab7a4e188a60e2902b6b46d9b9aa1495932bd762e915323	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80396f1eaf3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B2CCFD1-A8A2-11EE-966D-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000095b09a71169d9c9cc0adfdf6905c34b210aeb2921ddb541e69308081fd14bf58000000000e80000000020000200000002bf52c797362d5b2910b8174a69fbe4d1a0fe474022a41bcf4d3a970299ce66e200000000bb27ee94f5dc696d5350f115de7fed0c0147bcd0e6573b2c05633f31edcb57340000000754fdeaa002627cb93433f6a4968e37fe21e064f06963fe57022f203be054d6e1d6771d532589b575603116de0fd7194df1214eb4a4f6a0884d0927af5536769	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2884	2360	iexplore.exe	28
PID 2360 wrote to memory of 2884	2360	iexplore.exe	28
PID 2360 wrote to memory of 2884	2360	iexplore.exe	28
PID 2360 wrote to memory of 2884	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20294e4035371fff100af4cb29ac6651.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0002c9d373be0d542417a770bc145fb9

SHA1
05dd166d55ba3feb50b274e55a487081a30cda82

SHA256
a2d7e4201a8da5b4cfb7d7dcb9e3ca4e36039c5ee7a6074e1a60b14a0ec2f731

SHA512
5302fa24560f796c9619d7ba308956ce2fbfec37352722975f4dce036b4013ebd54d237add293f3dd0c1e6c1930b64850c380ac1d5e68f7abe99134f416cbcb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a8690dc57ccbbd37484f1ed78d994ec

SHA1
c4352fb3a4d88c4100f1c75804cfb9a7120649c2

SHA256
982fec75620ef0496bd4de782e955e17e4d2aa7c84b277c24c0afdc6576a535f

SHA512
7e5f6141deefa11d2e96d3e13bec34d0e560e62e39840885b065a91328365976a57a708517a3f104c0be7ca713d4fe1980fa7fdbe16e04e9ee15b171ffcea847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c1f079b63d1d5e5446569898c78211

SHA1
e4670f61f7149bff426fb65d01413d2eb946091c

SHA256
1a91f9b7c09fdb7657347831f39de9ddae1aceaa331d67c79ecc9d9af0acd0ac

SHA512
35564e84c14089309d3dce69be65ffabe176fc7c1e70150eddc025e88217a8500c1b201eabd91d3318e8b873a9013ecd69eb211d640084a264e305171bfb0fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cb81655ce0a39749bee4a48f555bc9b

SHA1
1fb76644f636d27de693d5e018789038d7f819cd

SHA256
f22927342ed9c306a8e481fa05b2b63f0252069788fa8f85d0ef98ad0e317e72

SHA512
ecafd0ae525024c30b4278fb26b836c5877ceba0e0fdef61cb8895a667a32a7f95d88ea0084af53c6db2b6f9df257d0141721549a74fe32f19ccc2a135088fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c42514bed1db68d6840a0920a845d4f9

SHA1
310bd59e18cc3b1d5acb39ee53586458f2b83922

SHA256
9bb8832b3e1283e5c2309f69f418cb74134437d95b88e5957f9a2e3f3bd2381a

SHA512
74600179a451315e3c0a8f2ab36752f7dbe9829d0c50f42457bcda0987107f61ef8135df09e6bf2e40f9ee8a5b98dfb372e746b75f25019e0f166f364db4204a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2074cfa67fee133939253348044fcf38

SHA1
01b4956d7817bb3fa1fac319d0741a5c28dc95b1

SHA256
d91533d371e6d81b26b28cd363faee698d7a6aa389b1568c8d9ad9c1f01640c8

SHA512
b0b22783184a78527d584878233350ed77e755e04fa31b60eaa690dcd85efca59c5e70cc87c0741e1c70805f9df63cb659d7d34117074c36fc5e489f1908cd32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175648c5c70f81a8c86db884b509cd73

SHA1
46de55818afe0a67de01b8d47b9dd09542a4f804

SHA256
69084928ec1d01e2c0b09b6ea01c18b5f2d8505c486cb6c4727a08deb4fca062

SHA512
3ae3f00f8c02696419d036b769ca9673a1ff25f459e8075ed79617dc49556a25d08e179b66a182ff6293daff421d631ea264e70a3bc63c6c80e3c2324017e017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b7779c830e2210fb21c5caf9cc1934b

SHA1
d9924f1f9904f942a735fc6cc0707925932a5442

SHA256
70359fdedc42a921e5bbf2287af8c32298aa507d6466cdce35707b9d36f2784e

SHA512
beab9947222e72ee6071ab4765b329f4cb83b686a1666bd36618f6b10841502a2674f62b8ff1d86f1dbf6311b3218be7197d9dee6d4e7970ca31fa9af27dd949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ec5418d89b03184933910a5377fd76c

SHA1
3350cab3761feaeaf4d706db7c4f5343c7e53219

SHA256
fd87e1c7b68cd4f4f4873ba5de85d8cea3f1890234f5fe19a1f52b4eaff594a4

SHA512
5c1922d7dcfb39245530568d7739c9ec1beb4874e9fffc766bc5da55bb7a4dc48280438b76bd764d1e0a0ae5bd2e8042008f3b048077b21f32f3d131f10d41a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD9C1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit