c19954f1263a886a97ecde355c68fe83c0ac17489bf104d996fa3d487e4de3c5

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0893bcbc3bcbc2f2fa1a4bf109f77e69.html
Size

24KB
MD5

0893bcbc3bcbc2f2fa1a4bf109f77e69
SHA1

16f494ce282808d095902a1ef15e8978f7cb908c
SHA256

c19954f1263a886a97ecde355c68fe83c0ac17489bf104d996fa3d487e4de3c5
SHA512

7e4c04107d462e6920797c90186539e3542245d197475a8e7ea83ee7fdd316fa948f1b56c28731e887ede605558af677625664ce4f618545838a93c1485bacbd
SSDEEP

384:0CRG9gZKCKPBr7Lolg3prDjx3byoXldnRTKgz+ZH2mEJH1uY:zGTIGNbym71

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA64BF91-A6FF-11EE-9E06-5628A0CAC84B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000990f8971a7b3e44414d01248f38869b3c8205e15026ffc5a4e3d74b7ba7a437c000000000e800000000200002000000022d3ead37b911fc6eaa09c038457d1aa2129bc9c9e107ad94efb48a60182a1352000000092a1858872f5d210f19b05bedd7b3115ad3c7bde53711223b1c3bdb4d3292de04000000011b8ae4d67e6ceb2095e7a39ab65311f0497f2a5e896257b58e048714aea490f60709ae96e27ff32c41c86e2a4b319ba29baf68b66f3a54efc68bc2db1ba9612	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410094761"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000021471c710471c3c4b51ffa671c8be29771778a63238d9ed4bb7b761d86077d1000000000e80000000020000200000005f8ac673bb772e743d7fd469ea174f24557cdb4a2f54e00adad590e6117ec9a290000000158071080c07916ee204e20ff7f4ea10334c7688669efa1f56c34e9e962acd578e1475ea5c2d1230ef3c90eb6251712ed34376271e4178800387f1de241edb2d169b17980b878207bd8d5490add03cd9da82bf4f4fbad1a99c3fc6976e80f37562e628ce797ad32083f7b192c8063c7f65dd42223be1b8fd64a667d5a2f0a9f4f1fb36fb67b7cabe39daed8d52bdd2e440000000065abde6493461841bcddbd158284cc5c4350d4cb7e94f84aa8f6beee53fcb76a534018a70e2416bfe3971179b432b560af48d3bd886a6c4fef4ebc2fc12c124	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03afbd10c3bda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2212	2364	iexplore.exe	16
PID 2364 wrote to memory of 2212	2364	iexplore.exe	16
PID 2364 wrote to memory of 2212	2364	iexplore.exe	16
PID 2364 wrote to memory of 2212	2364	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0893bcbc3bcbc2f2fa1a4bf109f77e69.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
da2623305ab1771a3362fd9cee743163

SHA1
43e388356cd8ccf79e096af5b64d69f8000a00e6

SHA256
5af43a86659d0a4e50e6df7cd93f4d941608074f75b6179730df4bbb7ab6c2f5

SHA512
69efaad017e66b40a2a98c0795b9c6ecc95a9d3aef438a1003edb295996bde229f55e3b9228b3da8140d70c8f637e4d78260ce06d6298c6234d802cba4d0cc4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e24d6fc041d985517f596466b40cd19

SHA1
faaeb782980a4b92cc0bd09a05ae451ce4cc93f2

SHA256
46c20fc75fcffbddddb6c3dad8897ced878998ca2a86df1736100e9cdb9157b2

SHA512
f34ded5ca3866c7df12400939d10761e9862ca48919a28bc654848330dd3ea3c95936f4b9086c0c1fdce529060ad6416addde31b586098710b061a8197d1efa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb290f6ba3b1f9ab0b9d78b7f99ffb97

SHA1
203deaff83dfb82558ea6fc51b00af1e401fd1de

SHA256
acd2a567ffa7fff33a4a991e1378e80dc32593a61925caca3fdf7629ff6aed64

SHA512
0e56d7a9782d56a5260061cbdad7d637095817fe70065ea9933687b085477d6ed79b12865c627e052055ffb674b487e8b4c012584877e67eb294ec7354f6ba14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e811d4e3bd5ac9d2999ba416563c8c5

SHA1
56ad32f66a850a667427f84063f098f2067bb775

SHA256
341b57312b553b6ac8dc1d61584978018027ef253a57c51dcf8363bfad031541

SHA512
f7ed91eb9c167e4ed5bb614495702b4aed7760189f4e3063296cbd473a92057d3c7fd46868f3418d1624995963bb2346eca3fce7eb545428d8d17cac187bfef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb69dc5c9fdfb6b51900d323f6225ced

SHA1
4916ac94c9e54de146767da242583b93c15d8010

SHA256
3366a0363ca0586cbcb922872cf053b9b64c36ef1778b221c7faaa5519247bfd

SHA512
41421194147492efb240fcc4488a66b660ea9c85bef6f620d140e235e3eed387add6d3b52771db3cd2d82769b0fc534028ea7e07395fbdf6fac56bad566f68fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4426d5bbb0b9a921bfac551fe9b2e98

SHA1
6061b810a5d0e95b9908fb7929c7031fa4e4cb00

SHA256
7b5dd16cdaf9423d6075e0ea87e9814672f97fecb0b7fb67c4d9ff58a0131463

SHA512
124452f6d2f356c7d8160b83537442ad12dbbb5406b3d0f4ddca37960da9abb553b7cb1b3ca71f88d64ae3a82e4a990f01357453b7faa40364a686ccebabed32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4610015729e3ae34d98081fa3575dd54

SHA1
dfd85326658997588c7c5875009e50697976f48b

SHA256
359963f57fc7d5570c41cd9bb16fabcc8590c5af5bd7bf7bcaa79d8027e22ec4

SHA512
01cc5449af79b25c9eb0599c8ff0a7f9e431c4476117ee79b6943af72594d1e235937ce830d8ddc44cefc6a2a9d241f83db04ffea14b59cb4b550604e23e6c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d7bd22c61cfffe464b200d83a1b5448

SHA1
4368cf1e8969c25d0fd580509cfcda9584b1e738

SHA256
cb2b7970986943be61b171d837f159bc35691f97983b586096d70c52bef6bb18

SHA512
5282492f7f41062b9ac65ced9ab0941ad17771f471438db8cabc1480faf5723c2fd930ce18bf64199aeebd946c10c87274ae65e1729c2432395a46fa36dc5daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a0ca2b051e22fe7e61fe4fa90ebb8b0

SHA1
ca90a2c3e33e36cfcb66a01822a4d33cba761f6a

SHA256
9e2519c9c2ad58021b0eefbd635f3ddfbe40876ae830e5b1823f29da34ce40fc

SHA512
4a895d66ba3d0f61ca58741a2d1aab43d3b384f53ee8958d85ad1c226279d5c899f63a1f18cf0bcbb6331ff9312837e4d162df123383e85daaa9a5e40854fe59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit