485a1bf542c6c7b67be69a8403a583c8a62ba998222d556759c260b71f5d8745

Analysis

max time kernel
121s
max time network
174s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a1730353cf93b8c2cd13d80b8d8ac43.html
Size

5KB
MD5

0a1730353cf93b8c2cd13d80b8d8ac43
SHA1

4ff914ea1377f75ec341c52cbd8fc688f84002d6
SHA256

485a1bf542c6c7b67be69a8403a583c8a62ba998222d556759c260b71f5d8745
SHA512

9e4d6058bc33148d875c47b5abb014a03bdcbe3ce706aefdc1a027df05545406f94ca81dc39d8617fc327ed17f35a5703b5ae0aa85b1cae0de5c6ab9bc52eeea
SSDEEP

96:1IPyCQ6oISUKzvehCZGaXbrI/zvXdc+ioAaKLah3xVFBcD:1Ie6XS47aXb4zUa1q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410105319"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89085B41-A718-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f003935f253bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a0cd3d5e6ea7bc6684304cf27b762131c9fc96a37d900b6ba1ed2b248136ba57000000000e8000000002000020000000d2d3ed3808d0860704c5856844022d9ebfb8890cb8e962879bca982aff6903e5200000008ac476e91e7a64e9e2bc3f5ffb3c6197dafb236c2a719a814d9f667ae6a627f4400000001001d3f7cab2857edf48d68a8930e5e116d9746564302dbce4c701401683ddc22e1f95c66742a679324e705bf9813af64b539b04c60a3bb24c5e73ad377c4b05	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008cf5a8fb4ce50c0922d35d88275a362c75856239ee952961b3dc18d8f7194013000000000e80000000020000200000008686e9a7cb25f58afd9762b26ad9b73fe37b6311cf25b1ade9b6a9c3c2a738ce90000000a1d729737f4fd49880a6752cd6568217d5566c6af34804ea0452d586736e03ea0dc6ff31c02ef380563bb28707fac8e435eea284f61ea846cda4c1b98969502aa6d8e02da835e17e40051d6cd107da850b571e27cecb4614c0057ca9f9574469f6f29bbaa2836ef8938675d9795c926235f30dfffa50b088e9b20827c9f58316d11effaebef59f9c0a6e9a541fc945a54000000024223d8c5a35447f3c27eeadbfd7573f181218c5396e856c99b426331021612c5626510f3ee722c64d18edcebf4b3be4b4e64cbc21519fd78255f42e48ab174f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2656	1752	iexplore.exe	28
PID 1752 wrote to memory of 2656	1752	iexplore.exe	28
PID 1752 wrote to memory of 2656	1752	iexplore.exe	28
PID 1752 wrote to memory of 2656	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a1730353cf93b8c2cd13d80b8d8ac43.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56cce5a0b79e858a06181f1270f7e512

SHA1
33997348db244c81340eeb17c86db2e7d8eac999

SHA256
b3286c569f5c9da881220ecf57151c2a36bd96b2bf44c5e3c9d9797d28e5be19

SHA512
91319f282da6dedc9b9e4af7877172a75ccc2d71b2a67330757dd5214c369e2eaa35f41ef08b4809c838e4ffd7c968cb6f1b42f24796cd58ab98ce960fb8f80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d649494d451e01a1975c7a44d9997bf

SHA1
f81b064c4c7fe3163b4b057f72e2cbfd769c07f2

SHA256
60e34ef04271d159d40477ae45f48f41a573ea3143318e03556d19949b652b28

SHA512
1bb297c7d9d2bbde58ea9a52f81c70af9c761b9838ed0028850a2de78ccfe8985927a57696357a08d9b1cb96b278c869dbf072d8193430d4719fd4837473ba1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b184ce3c386f6effc1c5bace2401d280

SHA1
4a977c19494c1370f138f6d1c43ed4c715a652cb

SHA256
318c6ff3135664fcef97c9cdbf740289df803938869f115228f56c12ba5a8643

SHA512
c4bd9996ae976616bf3f4bb400dc7906077e507789d2b1b9ecdd12adb08e489f5f0197e211e373d1e654b37b63476f1025762da1e9bb4b7e5a10aee568c948c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4831b268b41cfa246636b8ace6845415

SHA1
8ba2fbb3acbcc31e9f48174d44204e0c072486c4

SHA256
d6d85f2bb19e7487aa4b3c51dfe39dce33760c13569a40decd33b147426094ce

SHA512
a93b656389a37e4ad9b079e67eda665659e87310e66fd0457f8fda9c6afbdaabf37ae74816cb49667a4332d4f6a7cc555006b77b1893611f38a8a52d275e777d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7e5e3c2ea3d34b37a5bd13ef6eb591

SHA1
acca79fca3d4fd5ba8b315aded08d2d3204e6396

SHA256
b181114965bf87ade04048c0193a1eb33ec60ca083dce747c8cfe860cd915ace

SHA512
8f03c6ae82271a2de1bd11bf683ab120325810719a726eacbfc2c31e8d0be35c459230b58ad443c7cb3dacbb9f62f80b4e52d045ef904e8c0b0cdba1b95f8644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c1e926ed24bcffd36f6cc60174147a7

SHA1
9001f9f95ab01b6ab2d708b32c66789b2ef06581

SHA256
44504e0c87a0a165f3d3a97dc31d3e66243d3103d3988fe7fb23a3e3ffd67d42

SHA512
8ea189d1a74fb70399bc98cfff6b0f2a87518bb6de11b527c93826e3b3641f0a187b8b99c9d257ccdcfb826750a62ecd0b061621558ddb7eb8da31bc0877dc4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c68222862b40e09989b0554227f6a6a7

SHA1
da69016e16f5800a1d239109cde2819162b66d02

SHA256
f3d6cbe97ce54955d79f87d81be1499419337d17cb6b80a53add6857da6ee642

SHA512
8b52d7909cca555c74583a48c56a8905f1c5890d2d4246012c913ed07298ead3eae272c5feefd39873ce972fdb391cbf843e983610c5d18f97058940ef759a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d4db03a4392a0ff3386f2b2cebc616d

SHA1
704d55301f7af863570091437021c62c0c1494af

SHA256
edff32d423684886bc0e951bb098c7c0ef54cdf43793d6fee4e7125db6df9ae5

SHA512
a913741a3ceb4f4b8dfa27732a672baaf337c2577d4f8f1c327f275c61c21fcb06ed08dbca2f89f8355a2817d878d8371930c6dababeacc114d9e462e71ca8d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4C8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC519.tmp

Filesize
146KB

MD5
7d167675ee4ddafc965924fed9f93f33

SHA1
8294fe27e4ef702eda87332cfbde9eae36cc6856

SHA256
6543fc0951c7a12a88a7420ffc8da8fe40bd6799ecded109b2ad15393a0620a8

SHA512
120d84bd2c0a6a05f5d41c36556d3b3a7fff4113c2767c30a1f3021ffe0f7ac647b010b1d3c4d51395c1a94a7d723d0d46329d5ac6020be4b797bca6f570cc88

Download Submit