e1bff0581f1b352b69eb95e12722784bec47ece14638649f557ddca9cb3944a1

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a09839d714644e5d7fd804bc1a170c7.html
Size

70KB
MD5

0a09839d714644e5d7fd804bc1a170c7
SHA1

58aa871e613e7f97daad26226a47c17fa39e7573
SHA256

e1bff0581f1b352b69eb95e12722784bec47ece14638649f557ddca9cb3944a1
SHA512

d66dc9c4b8dd0b828a5814bf5a3f1c485ae993aeca256264f953340de6aff8657f54bfcbb5a0d0cdf3bfd464d690c6bcb5750cf49318f7d5874f20fa4fc24a1d
SSDEEP

1536:gQZBCCOdL0IxCfzNqMt6gQoEhP2ndxg6FzMU6Cuyb8HpZclRlM7oNwxQhJoOOQDb:gk2d0IxGqMt6gQoEhP2ndxg6FzMU6lyl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{866267B1-A78F-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009d1ac45267a7a61902f4bba22127926127088e218e87f2ce9439e6a269fbb855000000000e800000000200002000000043c437a40817543fd9d3ca6de16c160e28bb6a0d33fa174b166512080b9f422290000000c41f31f88c98a959a9eda2dea004416429c6fb4ab74e41d091b523a9dcef545ec13d56221635783f6acbf02b957a3c80603748916d1231e550fe1d44a4bdabcd01d9a70e0294876d2d43d60bf5ce19ca03bda23dbaf20b490c431e77ede7ae5a173a85ff575252272e15839d66b4a0d2c2da19f8ff575b16734e27881560d845d90d8bea61a1f6ca0a2ef5abc77796064000000043d277f8d81102e62704b5b9e06b11f1cd4445f1de10d8f1b0021dc4b3b22c5d65982c559df13322bdf880745fb58500325311f07241a637e96d76ade61d4eb7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005b0a720105691661f5a58668c7aaac9c5b90c5305c2aac554274731557a54959000000000e8000000002000020000000e2280f0f960da0367839baaa3c9c2718519fd67eb23fa529a1eaadfed0381fa62000000003398905e6a9c2142efbc9b9f2d4eafd42ddb93706f03affe287c14e9b1400a6400000007fb0c6c0ed7bea731a4b7926b392654bcece012ade47da84fe3082757618909171ab29873f78bc324a00e3387114ff8b7236fee8e26ee2287aaeae63991812c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410156411"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c9bf679c3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a09839d714644e5d7fd804bc1a170c7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68416178c633c63bd733cfcf2046161d

SHA1
d11bc54995b9e7a4898b9d045b142d8549443cd2

SHA256
62affd0b8564f3802e7584825005241594ab4f8c27ef05950beb43af707fa862

SHA512
b16b088d46e7e5de5b60a4a1179f34411b8292cf4c234186ace48afcfcdcaf502291dd9f046d7f5b00e55c7dcb54a8381b2f1313d772299cbb587f52b966b114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b579e822e33e1f1ea9419a7481f574e

SHA1
7b63f6ddc1f6d356030cfe2d20474650cb35543b

SHA256
cc966b82713c7c78c546f062f3769450ea614ecdb34964482c2e9b0a2907d9f2

SHA512
e7dc2866621115631510aa792b4c1d86a1c04d834aff804458c2e9e1518ee7653c6326fdd4cbf7eea189d23fc2bd230f8405a25bae34550ecfd6dea1f08a5bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40af9b0b7ad0062f9b5eff99286de953

SHA1
f9b14f36e89c588f0e3eaa57fd05c9133914e510

SHA256
fc1692c89656de871907a843cb40a0c171d81ed52e965f63dddfb6d0413b24ee

SHA512
4603f660cb61566efce98a7a0b839ffd3fa906d74e1ecbbe2ae7b33d650a4e923acf3006afd1966a2536d70244367e210406364ebd9d832ddf341d7bc2020461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
706b04e2d5b1263dfbe97fe0ef8b8eac

SHA1
35b1e354cc31b49de86a96e96893f261e9dc442c

SHA256
bb23cdef2c63aa58f6828aa960d3e7c911d651dbf85427cb3509e38db8bdcc20

SHA512
7e7d322e67d1d34ca828849d903acf510e4a29d3ef25033080e4e8382bfcbcc8802eaec0c91b6fc87f283d49be375a3d36e2c34fd5ab685145343e1ed9925ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c56ef39af1e3cbabdf547aca231ac929

SHA1
bbcdc211bdd90eeaf418b4abe0080b3fd931f7d8

SHA256
38cde3b77a04a9742578763a2a22c168b46d30194a6abb134f85d66cbd9b3694

SHA512
0464854fcc9e1b21efd564d3a672ed74ba8f30869d8e9a58cbfdfe147a25c465090e3229bd6388425c2dfde45556bf9a28a57503e3f22dd748dcc8b2a67525ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21cd4f7440d089be528194b01bb1daa1

SHA1
4b910be886922164d74bf08dbe3caa041a6703b4

SHA256
7f1e1bae5497d5ed447f925844e1ccc0fb6ff86951909146e2f1fd23aca76076

SHA512
97118731f623168f6cc07331674b17071f34cab630e3697dceaa3cdcdd9652064b7f71e1c77daccd46ba8968f5d842912bb43c82d706ba72c06fb86cc1708593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f3237d3516bb91e39fca56ad6936cf

SHA1
52d8b4cec18bd755980df1e8c38ed4086846c3b3

SHA256
a1a878d4535117386ae5956a56e8b68a871bf1eeec1047779aff475e6dd7cb33

SHA512
b2f893ea97fdce7c81b276c9310009736dd7e044f8dc5e45961d34a78ceecca84098775f04546bd13bf7ab9a2ee5085dae63aed4840e10a1d2681b096e476aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a2fb66d95311c3dbedae4d2a4d80fb0

SHA1
b2e1c37f66037086e1f63530d9d900afa66f4213

SHA256
15581de94c7d0a98a9b0abfaa54c2d186865faa6dfe7020dff3506e1d7210949

SHA512
0fd3386549f5f523e687bef5478efd3b594cd77bb46d6827c8192e5f4adfd1841ec803f5e4da5db4e2a1523784dade40f82d3016e80d23a85261052e3702e087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9589d788576d4cfa8f29e099ced920e2

SHA1
a2ff433887d9bea89bded28226183510a16404e0

SHA256
3db7454a32fbc86bddbd700c46e1f6f6f547925fcb5919f55a1fdd8b38c56660

SHA512
8857c0f9aa785b8025ac98a5474a8c9c32fde3ae91c773b7665b7a48ecd22ae31b2208fd3127292a39fa58d7ed34bad9ac386edf46c8405324a743cf181d4c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21a4d6126f5f894bd7f613160ce94801

SHA1
e730f953e69ea26304028d1aa67cc41e44bcbb72

SHA256
fcabf70fdb2e0c29f684303fe91ef4b62e6b7a62db71b56dfeb6b3d0c0b40331

SHA512
e605c4a74e73299f78b50a9642648f89369befb7f4b95e82bd225f4a1a896b158bfccbbad7da44775577d2b6639603a1f1ef0a84b6c8419c9c7b2ab138bef6a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15e3a6301c0409f0be30501c1653c622

SHA1
fe6c40ce504c135d00a3e98d968ba33f270093d2

SHA256
8a7c37ea22ea9a75ce8056c49503ada2319158a5c642436a4df22116b98a1bff

SHA512
819a0a8f4de0ec9629b0b43d9c68d1b362dff753697c9a9f1b363ae416e49d5caee20a80d588ae904d0026ea764d305fc76aad2fad7da7507b5d87eddc90f51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db26d6bba1852ca9b02d1d4d52af0cd2

SHA1
e7e296383be22c51c0a4c377000c8471cbd42f60

SHA256
21fbfb673ed902b0fe73884b7b6a8bdf5666de4b64cf8889ee8189af0a38e3a3

SHA512
496d07ff6ad74edb3c8c27a8b1681839c32992461a308358abb64765db1cc0c06b58f70455c935456ec4debd3363db6f1b3b86cb1a537c5245377e27df64bcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8133.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81B3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit