7ff2218587a98643e796fbde58cbe87e84c0028115c5b6ac4758fc25b1bcf48a

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a4c1fa2cb3491eda6e0d36323b71a8f.html
Size

11KB
MD5

0a4c1fa2cb3491eda6e0d36323b71a8f
SHA1

65a6ed0267164c7a526388e2371cbbe144eecead
SHA256

7ff2218587a98643e796fbde58cbe87e84c0028115c5b6ac4758fc25b1bcf48a
SHA512

251d7bb92fbeb23f2e52560870669942d59ceb2098e4fddf742937e4b3b7854d34a32aa57a15ce5090efe2f3eae8e9a6279a55c23db8f20c92901491312169b4
SSDEEP

192:SBbFebQ0R9im9nTxyb89JfY6JLRDVLwIGO88DEHqQ1LIbX7XrA38xtLlnRPRLmwK:SDSnR5wTwIxyjXAaLlJRpHa2pJD6Dl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16B52D41-A798-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410160086"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40445005a53bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009428d8000114de5f04efc397e46c86126e31bdfa7d50e736ad036282c83f1754000000000e8000000002000020000000bed2e6448a54d508269740592cdba4c6530731fe22c2d033a75ae4e1ae5ee112900000004964cfc4d0e5feb9d2f9903b4190d7c10af1280f582d4197ff3f0d557b1b23f00374ec1c62c76ceba17aa9fbb179c19a0d6636b57317126acc6b6f8401b924b1c90f3d55a4d3481b5051cc092d446edf0e1bed2c3f8db35c799a69ca041c58e16f450a33a2e56747b6a9e9ca65299a908ab8609773d774fc3fd79792212c28612f6df39bcc671f88bcc5d150301f38ff400000003ee02c8b8146a68ad38f37e6d0e29cee5bb7959b8535e6748ce390e3c9b7fddae2073cc24d76eb3f0042b8b782d2605dbd93c4f0bdcb20ecb91d31e16f82824a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000686db149327bcbddc30055b9ff0e858ddedc44c4d94bf748326b5484e38ffcc8000000000e8000000002000020000000ecdc7bc123ab7b1583177d813842eaa81642e39216a5942d62a87d229dd702f320000000e802e34d90ea7fe3fad3669e075aca0099f32458eb799151c3b97636bbb330e140000000714bf8ebcd883ffae8b3057bfb1c62ed1594388be5fa427ad61cfd2b46feb2f16443f87ed829b4f03c08442db893cd8c00e1359702abf2df7baea53c2c14bb31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1464	2032	iexplore.exe	28
PID 2032 wrote to memory of 1464	2032	iexplore.exe	28
PID 2032 wrote to memory of 1464	2032	iexplore.exe	28
PID 2032 wrote to memory of 1464	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a4c1fa2cb3491eda6e0d36323b71a8f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52b6132d4bf155780eb54ac99d52ca2d

SHA1
c428cd73500bbd78fe9928f4a9df7374483182df

SHA256
ea997e80a48f926ef90030392a0b356d164b16e5cd43e8a3e8c465d620d4909b

SHA512
25eb12b69f938a761da9d83e9c64ca31dbc86f7381c53a114319e08d042c5353eb9133d97a24d592afac810470c7552fddefb775ed5854c0dd1785a231ff3195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8eda0c0655658a9f0e880eb80597db8

SHA1
a6b720a2ffd526e41bdc1640187f5f7874377d9b

SHA256
e2c571bc76582668f498a601d59bcf5a3e8fb6700214e2f3ef8b5bde4acdbe7d

SHA512
dc11c3a446612397b2611206e44273cd6b40e846bb9cbfadde5d793a4ba1d287c0bab19d0d2d8976229e41d1f8bb2a690bbc4ee3b5560aa843a9e978f8d71e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ff4ef58ac8e641f85b738e67183fa4

SHA1
d1ec6bceafe80c3fc1140692ba0de783befb468f

SHA256
a1e06f236c8320ed14db725391f7c2adef5563b8286dec6ce87aff27bb071269

SHA512
5a4475403571ca6bd0467c961a3ec67f409235de0224d361fa58f60ea6de21dc3371f6923dd8f77d427a59297717f15e077f7192c0ef7f80d08018e44df61594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fbf4a622edd61ae2ff494c166e39f66

SHA1
3889016986cbf10e63004a815f9f8732cefc5c57

SHA256
9dcb6b387ffcb7fec365b1de2d11cbcf1f15018c1a88d585ada2b4977eb37b36

SHA512
4e18208046dbf7d37e84fff62f41329772ab3d850fc7890575069a0a32af6517b56bf013462c5bf3c81bbf673a356a484e93bd6b568ce270a51dcd2a6f1a4aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c799b703549889873510997a42fd9c83

SHA1
db88ebf53f9a73437473f054a8ed12ec08c52e57

SHA256
dd2632f4ed7c0b19a2e87ff04cf372889826d05351971bb0214cd80715933c83

SHA512
69394a5fd02647b8f1f811fce7a4548f591d276c508ce870728c51721602d0a6b5e163c5dc9448920a7e0f61b7c2042ae0b3db0e86a59c827bac711fe87ab276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e046497dfd60364a7bec24192d83fa

SHA1
5acc9f79197ddaf76f7bd1a28b4b0b643819339b

SHA256
95b76bce739a78662c7b8bf5c767b2d472ae6b8f4e30cdbffa47d77699c7976f

SHA512
57a559ccc7c2440e29a98e7a685ca44354be5ac6e1cf8c433096c2011852c5579615e69afe2f2312239dbbfd337653963aa9cacdeb8f79c2cdd111fb3831d452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ced806f64a5fc00e2e8bf8b1f2385e49

SHA1
1b9a2b90937965fe6579a7ac8d5ade12bb9bdd26

SHA256
4e7e13144bb978e00184864a87e36a6a680ed1b5d5b851b677827026eb14dae6

SHA512
e770e612a7984ed8d05d1ca3c0898cfcc4227942e974b2c330fa06c84dfb7bfa56e2e44ccde27a4a37061c870dcf2b9ac3e52a7b0bf4a1a42a1fddfc23e09486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f36165dca05b25403c6cff1376f6af1

SHA1
48491a0416a22c0ea2b1ebc5c369316407d847c0

SHA256
6212afa94601e7ddc634aa6077cbf773240c18427c6359c2e8765cb5dff1b7fd

SHA512
12368419819e131fc2007fe38398c2babc26cd1620717210d26af4de62655efb4eaa6165b45eaa63164553349e1ad92f027b3c1746eb7e2a6d812edca63df367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0122ddee1de0540d7e420e9cb5976e04

SHA1
1d5ee6ddad02c9745ec49f4f1ffd9c6dd0fad3f5

SHA256
030aff28427012ad59e4311788e30ce5ba559085f1097c91a17d6fa773800e36

SHA512
edb86b155a19b58753a0e66bf83dadb0607382e856e6813d545454812160f6aa719b2dc8dc9fc040a46bdfa5160415ce1b2be1e846f8c518feb883538cb49e3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
443d240e9260155cc21c762fadcbb431

SHA1
1d00f4ae5a17e07d549a482bf58cc080cedf7ad2

SHA256
d2ec2d02f17faea4cb0818312a0d51911e0a6f21f232da42d1cc41d60e72b0de

SHA512
5f1ebae4c3d73c24473b61b25daf9e3369e12f13110da94ba9e3e1ece83659ba9e7b26ff1cbaa252c6347b4fa9b5d9a2c779253845684ee53010bb70477f45e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2128159cc54bcb2f9a92f22bcb14ca

SHA1
e1ee9df1902c628f0ec6712e5d6dc5b4a21e0cfc

SHA256
613866bf5641a0d4cf1467058cd98850a3d7b41183efc1a552664cb79537afcb

SHA512
991b9407379806deef4014d67bc1630668921ada31ac088ddc6bc4ade932889f7b09b3684b32a50d0967be37db413695f4f8cc38a501dc4174f519a9e1dc44eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f43a04fd67e38bb4765cc6694634111e

SHA1
793c5f31ad072ab602057e14032a7c40a79f8d84

SHA256
36257e02826b55cacef458d5bb78dc73be4fbeff6e68d6873efb1b6f8878bb01

SHA512
e5a6f44e4b103aa3d807c287e2a0847aa3f37c3569852afd9c1de6bd2678fd7812712a7d91a0791f2b77ee15d0961162b225db753ae00f447f7d515aa1a6dda8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\emailButton[1].htm

Filesize
167B

MD5
f5d40b7259645010f9a248858ad14178

SHA1
b3051d17a6ec8c9e166bf09a62b48261ab86957b

SHA256
7f5007068d2b56ea9735e2490d60cff2e72cae312024ac1f6c91158eba47d05d

SHA512
1e82bc2d067f726670b3e6054d73e57868f6e7c50eb979696bf927daeef699f2d8f8de201e8252b86b0e9f86dc69e5037fc9fa08ef6c271b033f29d4f0f4c1aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CAB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DA9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit