7877f307da3d6d07f62262c4631e902fb8834a0c1e9bacd97fc700b738da823b

Analysis

max time kernel
143s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09c5f747cc75d50354168cc1a46c38bb.html
Size

12KB
MD5

09c5f747cc75d50354168cc1a46c38bb
SHA1

742de70c489a6b41cfdfef6ea77b39df5aace8fe
SHA256

7877f307da3d6d07f62262c4631e902fb8834a0c1e9bacd97fc700b738da823b
SHA512

79d52269a7ff2c56f3f150be9b9b95b5882cff5357502cae0eee5e227984ab06fd37c4d949d7acde6865318587be006beacd91acaecf96fc0fb76e30d06844d0
SSDEEP

192:xNLJEiE4t9jqY3KmhDO/kHTJEmMK8aH0KcWCBs9GH90i095R6i:j9jqYPhqCTCaUKTCBs9GH90i095RL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000081ffe8412ceace10c65ec10392014a1d122daa4d105212a3460d57ea4a47d4f9000000000e8000000002000020000000c4eaa0c0732e12f36e9a04f8321084448cc8e1942fede01f6d7cea45b315408f2000000069cb42b45431e76f9eb89ab2698e6ee99418d9f52ebd94ae7dfbe33804cf82df40000000b4672ce75ac7e66d942a5b01ba40b890f6369743c91fe305961a50fbb90771eed5d5377f37541194ea272ba484a693db495de471502f2a1783c90f4bf718f831	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9083c5f3933bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410152792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AA6E991-A787-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000053222fc5759eeca24d416ff9fb7b85a4d7b35a1e52b64d25e4a56d8f6bc634fd000000000e80000000020000200000002f3b63de214ecfc2fa807d70c35680cc937fd387ad0a70dd3ce2e2dd902bfa48900000000fd2bcf2b3208db1dea86e89b0de5a07d6242fe6c2b360413322872dad6402efa529dc209c7c2dce65868f09a5eb871a1aa3e80d8c57cace94b2edc4bc48f1aad94c7ad84bed65d1043c3d6dd9f5c0f026a391c2e957eaa6a11316cc8f404457ecd200130e642dcc8ef8b3dd0652465bf049358ab3cfb054af85d650af87efa7f405d4acada8cf9099b8719c2985782f400000007180888b84bf5c404b2dfc7452725dc2a754775baf0cfe28b3bcfa040d3f5deb6be5b871417aedfeebd3a6737b686fe63e3b5cacbaca2d2739741e051c76d76f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2624	iexplore.exe
2624	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09c5f747cc75d50354168cc1a46c38bb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa0f2a134b6f017852f6b718bda0c26c

SHA1
c879c86ec1ef2b3066c1564af89f312a7a6e00cf

SHA256
61082da873e5c44a725c62bc04cdd4f234a65238324bba6b8f8f90bc861beaec

SHA512
b501fceededf38be645aad577e9bfd5a726a25634890612ad3419e63c0d1ff9d2790db771ac34fff65d6ddb4326bb12f95add74514de4672cfbd215e9538ab6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8176a9deb39ad6170025e04be9a23e76

SHA1
3e4ae56047fbc91f7c0893fcad25a5e24a205b60

SHA256
6b021cef8e52061154e63cbf5a855b63c4b1f1157b99f42be6d0188aca450529

SHA512
0a71f89b273d35f318075811cbd004b219c177fcf2545138011124f7fcb4369ac849922c5d4a01fb7e755e231d4a538e94a1d8b63f187f679259a0b9dfd4904f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d700aaf518fb2702c48d268c84145b31

SHA1
dcd58fdd6ff45336993872cfeb1a89ecc55754f9

SHA256
5321c2f30ebd60448f5760b6c2a7383630a35f90a9f05003ea951184ea2014c1

SHA512
c1ee1272baf4e92bf54c7471060751c5e9d6e98d879cdac0d9820e23269bac41bb202ba313d64f7a20ab43d075772967fc504ec42a372d278f5b8068856d0286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ccd2513baf0a34b32b2b7eea930394f

SHA1
19d1e93cb05f284a252649a3e7db01dfee887f46

SHA256
b0773039010847d71c06da3345c329fb1375f439c7c95810b7ae8e81b0b42157

SHA512
3ea924e99f93e34442ebe1a47c685a8ca0dc7088a4dcf2213c14a79dc92b0bc3ca39be07e195b9f07606c3044ce493376b9c5104b88905ec758ead41e80d0c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95822209578b7826f64c798a6aa865ef

SHA1
2d00e6f9208bffc0a9ad1c42485c08a7bd0e5edc

SHA256
48421dfcde37c59f58bac4a581e1edb534b8448c74c35479f1aea574bada6e5b

SHA512
c4db0567eab88271be611c90571e4859e05ad9c896ed4c3559faad5864e810edddd7854a4644bd85ca785f708f92fb5532e785fe78a78fb74c669cf170cdb958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8952b40cf5dd0b85d8e54de60603c767

SHA1
223450c4174cfa7e9e1b8c92889a3a2985f5c727

SHA256
84abe99a47769cbb7933edfe111b5f4b47d5ae42f675c6828ab213f21e129b61

SHA512
08d14e7eb8819ce6b280718a8e941aab7033dcfe44c60b3aeda2e1be4d85a7971d60eaa26f3df98d2d5c9e257134d002813c12c6da0241b967064856729261c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957c0bae6534d419eaf563fe823e6e43

SHA1
3dc72e4eb6c3a929301a59589ecf36f26377d92f

SHA256
b82c92c49aec20359015ecc598fc79a23973b0abd4b2a02ddd7fe65d3b476958

SHA512
ab6eb5652cafa2c75dfe96777ff9d93f78993ffb2ae0e846bca1377ccb2491b3904e6a167f1a250b152930d95f2e6b2bb7259680768d4ae83fb01baed19761ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9e0f82e8b0437aecd22c14d883e0ebe

SHA1
abdb0b889f8035c5db89cb81b7d986bd24e602d6

SHA256
fe749e32d5297e68725e75bb353c53d598993247c790afdfddd4c32e03910432

SHA512
ff4f14a09479a5268f9a21bc5743929eaa9b0d8ee9c44de5f7c246c465b1ae861bb1db47250a5a8cfa45a18b9e96414b1b59603bb3861221c95c8df20bb0c140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86162b37a5efc213559feb459bef50c1

SHA1
b6baa58a4304df7b234d0d8f2aee622ecd9b7d5d

SHA256
f470129f5b99ade51b4adc6724d9277a07ab280b3465d8378262faa6ed7c4da2

SHA512
e851beaed2656e3b5dd120aa191ec6cb88579e1fe61366bfaa528c81446cc841e3618d69b3ebfb3b1e3e2039bf061f4e26d539b289bc764bed8a866ac423018a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80438664b82cc9ac3215112f68a0da4b

SHA1
ade6eca2439f282c72d3ae5974f15dc44685253e

SHA256
980bf511a11ae2a33504bfd84aeb18bdc1eb8c36b198e4a258fbf2a33dde1b10

SHA512
6930e05e054e03ec0fdc3acfa7513733663835d3edabf93521ec537a92f353281bff18d970ca57a7b6cfde08cdd91af1dc9ea6609d94062a5b6527980231b3f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba91397f2f37348d966153761059321c

SHA1
49fb3b5dad096b749ed9549503bc9bb1336c37ce

SHA256
3e45e886d7555b9255d0e6f3530022724ab1309e048d7abacb231657f441e4f5

SHA512
9c12ab18e3c7b28178f1eeee8bcf85c053f80d32f80ae88b2b279c09cbffcf59d5db7f00c29bd3bdb98d8d6ff9826a13d0f6e369c76297892aec7e5ce147ab26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b4a27e6bd4d7cda158f64d6932289c

SHA1
c83160311c6b09f4809ee89b312ac2c83000fc15

SHA256
b5c603d560aace5f7c1351faff741ec9a7b94a5a8e68b6e3b620bb22fd3f4b97

SHA512
f583490156a9546e387e008b8bfffb9bb1a8a21c661f8029920e4e6bf3e50ead657613d87dca06d3218eff161751cb14eea9b72ed711350ae0948ae2a74d938b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB751.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB773.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit