2db1cb692d348cacf1d9650bf019fa03d0b40bd5ea8b55ffd79f60ea60a28070

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a26e56179aab21c63f18df5cc789259.html
Size

25KB
MD5

0a26e56179aab21c63f18df5cc789259
SHA1

c09f8d34ca6cb2a8925dd3356017c9bd677c317c
SHA256

2db1cb692d348cacf1d9650bf019fa03d0b40bd5ea8b55ffd79f60ea60a28070
SHA512

cde8a869236220e30f7c176c3d29e7692b657e533781c5586e13a9089fb84a3f592caa71700493d3aca0529fbbcd91b6a7f42aa36411be64a492f59b2a1bd5ae
SSDEEP

384:4okUB4UCD3z89cQVjOrU9gdX5/1XIEpGTtXGTtHGTtnGTtMHd2hRaOjwizcVT+Fz:4J7b02

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410157932"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09E667F1-A793-11EE-834F-6AA5205CD920} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d412f29f3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000007856f4186d42424c00e994bd90220253925c20c94bb61c3ae6b10f8e6de3583d000000000e8000000002000020000000f3f5ddf3e41e5e09c9fe1667acef2d1f3ebcd43f43bef97afc1c1071c072b39390000000f91b4fecdef409c1dcba98d0c42a717a61f55823d3db103e14564dca9a30c01c6febfeb6a0c7acd4ccba01b7ac351be05230befd69b6653899039cca28a6ab13c6765eb6125defb0f544072a3991bbc421f8a1978d47f895a161b44b134e99f04a0d432cda9075b6a36522f2e5f5856dd8124f8949625d23f26018a406466f5d7851906b60f0f34748f291ee857c209c40000000f92e417accfeec988bb765d0f787e75818f2f0249375f6991c3bb2691afe0291c5fc757de3a8e2d18f4f2fda11bd33f444e2d7a938f805ef07bea88388478be8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000b44f776597b4c3fceca69f76131a1feabd389346b4f285adb32b5d29988f8e63000000000e8000000002000020000000283250f12f608eef269653c0ac9310b9a650ad8bc1848bef2be472391dadebf320000000443f96d10cea54b183d64a826d14ec78d97c8aa76f6798a02c657fb036f7ffe840000000e11f7f08dc068a73fa6069f8022560444956063d97ce102f856f3c05e406dd348086c1038b2d1aedb9f85e55f22c0cba18ec21b4fdd3dbb76661b07026ec6955	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2920	iexplore.exe
2920	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3012	2920	iexplore.exe	28
PID 2920 wrote to memory of 3012	2920	iexplore.exe	28
PID 2920 wrote to memory of 3012	2920	iexplore.exe	28
PID 2920 wrote to memory of 3012	2920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a26e56179aab21c63f18df5cc789259.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0fd120721e6a4696870a9a77a3b529ee

SHA1
716c77c9982ba8c3ccb0d9d259af55df97fbf0bc

SHA256
8febe7e4e1c3857e6850bb6d8fdc016a829c796015821835ca1aae07212d7142

SHA512
b23bebcd6618703c4f023d0502d80d8a49c4e0f50aa5366c079ae3f93f695a3020e1ec2b2b16629c9a6b1e9ffdc8ec22ce91cfcb7b6a37765b22a9d091463509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2e5ab5e97e664b05ba4fa04b6b1da45

SHA1
952321c73556498de545e084d860984b8c35c27a

SHA256
f4e49245a1a9b7dd5ea1e7767e9313ad3cec3c2265e296127ed1b27105f56b51

SHA512
f0b16fe94008af2a7416be8ef5f4b15fae6a01088f487dc03fd400575d7172048fcb78d21c8fd487eca28e6c2e3353774fa0935e47b875e8df88f4dad9952ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1330d17dc2d694111405189ea15dd185

SHA1
2c4f56f28e58bc204b9b29d009be05513d1b4419

SHA256
4124814a14cffa878a24863b30a7c94dc7604a1a7f4d9825de66792e97d3dd9f

SHA512
f10be0ea57caec940737caa714d61269f58cdb68c47d4c0af2e2cbe85b18d6f5e9d7c899e2d1dfd5d28251035e9d4fdef2a2876b56ac86a1480e83f62fb92e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2388d81e4af5ae190db9a57ab0a141ed

SHA1
ccd4befcdd81aaa5d3671900698cf6f327d631a6

SHA256
5badc171c34398f9802951e37a50fb3d4bee8c704ded48b866c217cfa738d950

SHA512
524ae1d6306260f29592836b4eca0117008b2c49b74ddb867a15b980e92c8c46bf18aeb9b0976cf885fa194655acc4ccc722e9835e11be5d377ad8ae894712f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e567446a5ad1434cdb0a3edce6ca39

SHA1
4f1fd97203b2bd605d6b1de69ef091db08b04d07

SHA256
5bb3e2f5492cfa753470762221d660a76475e34523c1507a6575a3d17f8a0137

SHA512
d3ad0f270f934c9f7b2498e8bffe11c26d6dff2a1df8c188737b253ccfd5a89fae2561b1acfd28368c34b5225f817c69efb9bb18ff420f3ea48dc30500f05754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db605b39d43e1b5df2a9b7aefe0be41c

SHA1
918189d649872f56e640b604ae468fa14780b64c

SHA256
7e8e39389d1b2e7af2c90e002b5b9d69870b11c13d3c93d2f6ed93a5ffea515c

SHA512
fa322c41957598420473741de1fd404e34f7e4b4158126dac3c0e1c936d300852593527209872e1faf946c8923d75a97bceb1f8c93f5bfc16bfbd00983cb1d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91c5a9b452e7e1f894e05aed35ce9285

SHA1
051cf3f7e9d4b348504e84a3377c07b5c1913632

SHA256
c55000c94b764b243ab6fd12c1e47fbef1a3a89c13b55ca0c65717200c6d4d92

SHA512
579c9803cfe65e5c48bed07b2d99d93a0f0e77b3746adc5f439f0f1e1342064e309af6f10966a38eb321c1740f039eb02bcd52a58d8cff900646e41d079b01a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
040cdb8d48aa65cd49cb7a8d501209d0

SHA1
2055251857ad7dfeb5ffa56592abd321104d3757

SHA256
ac767cfcc81e9fd52f8e3592b5600aa948227bdfc522780a63dde99c76f4e8a7

SHA512
6f3980ff8e02235adfb577c0323971331d42440a7337de5205a1b43511a3f1d52edc7bc5ac7c57710be1d4ba2a5f051cd6b8983b7ac2ab7bae44328f45ddccba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12e16878487a4db92e2dc39107c24e29

SHA1
33a59fd21ce20775ed8f55cbf757ef2689fa5197

SHA256
ba01417d26b25f7bd28f966e6cd5ffeef9f004c8378b2e941c1747097ca70c52

SHA512
c32271ebbf4a90cf4803b2651802690d9fce7280602be234f5a109548788578937e100b37b64b70e35395e4cf075e46e6c57315a2380ad25da411395a45f5df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf69dd1eecb5832127ca205b167c27ea

SHA1
6b997571256789a365c144783bcc3770e2268ae6

SHA256
a8190e8931fec1cea4e8cffae885e9b1e53ecaedb3bb3503ad1bd2632b98a931

SHA512
f83af0bf7cda74626beeb99466fa6564bb101f2cf3d317d3ef1b678e9b4ed8a7ca76196dac0f2a552ff5b44086ce89bf02a54165e3d7275722f23b8d5a160b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFB6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit