5b02007883b57aced979a6693143384eafb18ca89a89804a3ef98e9ed83915cb

Analysis

max time kernel
118s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

205da70b41c3932b481ce4aaadd6e586.html
Size

8KB
MD5

205da70b41c3932b481ce4aaadd6e586
SHA1

b343fcab11447fb2616a5b7b794c179f45040165
SHA256

5b02007883b57aced979a6693143384eafb18ca89a89804a3ef98e9ed83915cb
SHA512

979ac824776b330b70122555a07d975e293eb3f28c78eaf7ed6c7e6896cb0035052952e92a1963b8c78be4c87b73f67480f5d3fec6dc1d49698a7e617f493539
SSDEEP

96:RxSDdCRn990H1uNaqU4yDIT4mb446vGC9XcohpH1uPTHRot:a69k4/EuC9sop

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000049c6e4ac093b35f5fe0922b443511e6ed650a6755930d76ddac9cfcac041afeb000000000e8000000002000020000000d75bc121416ed99f8c99c05b1b0a339600d4c9d42c91ad4fec27c8f83d7b1a39200000009c32e2587ec42de46ce6b72658277b29da8a7dcc8de3eb1085f1bf270b87abe840000000fc510facc62df9cdcd2d60142358ab59e59e7052c348099bac0e190ad4187e260d0d0ab1594e127651ada55669efb43a7eaf02fa60067848e851cba03177625e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701b886f523fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A6910B1-AB45-11EE-B279-56B3956C75C7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410564477"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007076df878e1c7ae87c5ca0ecceedbb6ae33eab501c162ddda713699d437d84da000000000e8000000002000020000000eb254dae9f126a2b3d0546a46770b10e1a172e6af05b36522f650414c57e3824900000000439e15e470815e8c7282d39a78453ff113b1da79eb8a5957be568bf29cb3faf2b0f8d480abcd42ef135397a0b25b3f3caef3de37b3d0565dd3b6f2dc7bdc2a13bf31dca092991cc19b6f8c4c9ba713bb9495768a54a6663771574df5ff8902a789dbaa2067d1ce69e44615ab36120cbcbdc878ec3c42be8f53c24d755274326d2939c8f617e136f2d1f0b3b86ade2e64000000054eb2fd36b34d78b7189c77ef42d790607eb93ff188a37e29d4d8db753bde455d84370bbf4d02aa4cb0bba382be2202ee34f1d3600286d7484cba58c24e76faa	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2516	1740	iexplore.exe	28
PID 1740 wrote to memory of 2516	1740	iexplore.exe	28
PID 1740 wrote to memory of 2516	1740	iexplore.exe	28
PID 1740 wrote to memory of 2516	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\205da70b41c3932b481ce4aaadd6e586.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53f77c2d4355a1c23ad4b78612125d46

SHA1
a2312ea91c1932fa019c5b3416972f8749db6bbd

SHA256
f61cffdc811eb22e82f2f1b3413863518eb70d7479687c67798f0451f8caf39d

SHA512
c2dc106437a9b6e0fb85eb704d54bcb6ed95a54fc1656cf79d9860e2c6afe33b08becd6d7f4457c76f738c00b34df9c943e11826dcae41f170518674abae425d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8968cc274eb30395f6b6df0a09f8f6cc

SHA1
1fa8df1c6b73276bc5b81ff5b94302d51398d95f

SHA256
8016bd2094120bb099d84765ef3dc52ce6867db5b6e82f4c0b4772c67d2b93ac

SHA512
32b6b88b9e767c742b647a5d0d04a5a511712c1df1afe585cae6166e25ad7a034578635590c59f1c05b94966266010268abaf8a5b157b891dccd068ab7d8972f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
813f8ff044c1d89dba2f21dc7448b120

SHA1
a69d24a8004166c6eb99d37c907e830377c7e766

SHA256
7b99db3b1db238f08062fddffa2fbecc7833f93e847feea7b96a2700ca4ec543

SHA512
953f07d88dd1b650d6e367f39d96d44ade93812c5d36cde456671f2bb0414e95dc568e056dd06499b5a6a1daa7943f85bbef983bc513c18b4417c95e82cf10d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94c63fd057133984f36540b2109276c3

SHA1
f88f96788b79bd9729ad2b766b60d8ce7874a6dc

SHA256
c07826b05950f082665913854f307a01153178224ffc4400439e9f2cd86550d2

SHA512
3c91c0c766da95f34c5b397211d36512e176e3f7b87c6d6fbab7e2258efafa4bebbfde845843d00499edf70ceb4f0d9dc5698dfaf98c742fca908f9174230ba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
415775bc2e70eca2c31981a5b2af0d93

SHA1
0d28a96da8219f85476c6b4e706d6c85cb335ec6

SHA256
af1d15b08f64cdb343c9df34f8bf1540cd919c871afb1757cbee622251028f68

SHA512
cea7ad73b9ac711e8154a35a550ad261c9af50e37d63ff17c5a95d57bc7e9b5f9ecf9011a5caa7c2489dc03b356c5f4e5f218035451ea438a2ba5f8609941722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de802be5c82d889b796d22c17eacb121

SHA1
60fc397f86a6b3e0726220e61bf317304e0af31c

SHA256
9706fb2d2392a96174138aa58032a8d858b0d3c46a3d784df97da374eaa4d75d

SHA512
f7b43e89eed000462e9201e33ade8986d445d940762218c408c7d171107e152be081814d2170065c9a5c715b3f2366bc0483946daf98cbbbcdf37d0b61251980

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab804A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar85D9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit