a862fafcef16329facb69822c4ba22b898247b5dc433861c8427c09ba0b81e12

Analysis

max time kernel
141s
max time network
135s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0bd9e1d7752327ad192bed9a1715ae2a.html
Size

194KB
MD5

0bd9e1d7752327ad192bed9a1715ae2a
SHA1

240067e3dbf2317b49c7c202a8c2600b1236c14c
SHA256

a862fafcef16329facb69822c4ba22b898247b5dc433861c8427c09ba0b81e12
SHA512

5adf1b057639b18592ce75aa4bb07cc61b272cb12500142373269dfbe4fc1ca947e9640921349a8086a90eacefb519ee108e31655bf6b35391b34615b8395017
SSDEEP

3072:koylL66qUVus/oMr8zr9WVbD2zuX9yrHs8fAlcfj73q4HSs:koylL67Mr8zr9WVH2rHlfAlcfj73f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{914675A1-A734-11EE-8456-F62A48C4CCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000279aea2e74c593e7d571b620820bb37c3eec7b168e649ec503f3c7a001773b7c000000000e8000000002000020000000df1e12f37854bdd7d739a41d2aac6d5ec92544be3b726be44db9c528ceb41b4220000000d9b00ea4f5b1508151fc94352006d28da10778b004d491f5203305b38bd60c1040000000a74816f1e8f0f88699449c6cf0d084841c5799986b89b9a91050e207ed6a3c38a4293c0a60ea3edd7417c5aa3c8ca195f970a71d0af8b75d843ebdea839d090f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5022fa67413bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410117346"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000768c17e164e11db60b8ef1b224147c63408f7a9b5348ab41c0b54e79a38e4237000000000e8000000002000020000000cc523562047a0cf2feab2af65b2e78531a9fa4607ee1af28f69afaebed0020139000000037613352f1d95b217bcf1371269d8d4c210f47e595d8ec253f5b52e2a6654b8d1f5309541e3ee29f3a7214b75a9e318215da2ad47fbf8a2d1d168c17f4cd219208da4c9dfcd4e38f897111f113dd9d3d43bde26591e422617490770ce531b9a1035e888d4743855691ed5c18bda00e2e77bf7f38d69f44f644aa0d4276a004bbb5b6edd7b45d8026d8f46ebb9b9f7c04400000009f7be64f1d25e78e19c248d1a507cb3d69a9f6f99b5b73c6596f2dac89ed298bce6e4f9c57d6aab549a0e93a336f658b315570c8b54b7c9dc659c8fb85b105c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1216	1700	iexplore.exe	17
PID 1700 wrote to memory of 1216	1700	iexplore.exe	17
PID 1700 wrote to memory of 1216	1700	iexplore.exe	17
PID 1700 wrote to memory of 1216	1700	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0bd9e1d7752327ad192bed9a1715ae2a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

Filesize
889B

MD5
3e455215095192e1b75d379fb187298a

SHA1
b1bc968bd4f49d622aa89a81f2150152a41d829c

SHA256
ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

SHA512
54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bec675636156107c00d32ec20674891b

SHA1
3ffda47e223191aa2c588e60eeeb305760836ce9

SHA256
6161198249d37ebebaf937402c8e4117730eabf7537196e13c85fb330d0a76b1

SHA512
988ee0cea778733a50c1fbfd99183ca42289532b86b209baacb0473412286a6e5c038c96ed7c11e62f4808324c8bedbe37848e58290048f3b7850af4bce02dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24

Filesize
176B

MD5
575ee17ac4e1b470aeb18861559cc23e

SHA1
5fd91b3c45b34aeb0b54b89278a63f9246fd5853

SHA256
1bd8d385cd519c24d2acd8f90203712a1ee37e3d1c5a035648c731779ff2fa76

SHA512
9e393e715599d83ac6abb3948fa8ed949d53d8a5c1dceda8918f48d3a3a057bdfff3e65fe473ec015b824fe924798600a70cf5d21f00e6cd6952f6a05a88c363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f6f5fefee4e944618cc228a78fdb0db

SHA1
859cdd8a93d46e20d690671221dc5e9765ce6152

SHA256
226397b3573cab7d885e62136af9e811edcc0e4aa9e88b726cdb85a8e09a3b7b

SHA512
6bac2e81a8b61755a4e49b4b00b7bd96ef5913c7e51c801f474a6a9113affff4236d4d456df01f10f6b3c59fd492b9b64e7d8c2f94046fe57ae4942162bb450b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1da799fe2167993ec4bb604fcab6eb9

SHA1
ac88b592c60200dfd42d04c5664635a4daa0f30c

SHA256
c2cc42def2fd6e437b13a3faa366825ac44e42a74469810b57f36ef3a1b24af2

SHA512
6e705fd98ac2e7f95c5cf9be3dab1d41dfe7803c1cfaf91b7e1b57b546c0a7892644355e8c4af37d380fe99d2cf082ba215f54b5cee6d1e6ddf8fcd725a8ae49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b107b68e9e334230e628b192e004aa88

SHA1
d341e2aab4994086ceae61a12e8a87936970db35

SHA256
1e002d8eabcb849c975e3c19346f72d18f4b7f314f4d6c65a28588cd70b4df9c

SHA512
5ff5eafa8540210acce74313491deca5d778ad40bf044858563529a1aca2fd3d11bcabe440579217df5aa52f9cb06738c2e9f784ff25c550db050425eed325ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f72915d8d7be82cfa548cb339ab1acc

SHA1
b36f7f2c68611ce581bebd4b9f4219f6bab26ab7

SHA256
1c0686902c8bd6c33575f85c36ff01e8cf80d93bac069f6cfc5ebf9bb9a0e5e5

SHA512
afb57adf5d8db660cd7638b210322de0478e8717409a9f67e07c1c1c7ddb0d20dbe6f90405fdaf0e19bc3af6bb7834838a8b03ea2c77bfff27da952d61f16f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb18ede40a440ad3ba665657978d2c4

SHA1
a8757009df4ee78f8524b9ff76c82ba9657e4fe8

SHA256
d7201b46a766e079468e260be2714bb873449fec6b005ee3b9ad6fc58057ad4c

SHA512
6d25255e4359d12c88a624d96872664ab870702ac18d4e2236bae8e6dbfa9a0945223db0c79e33b4f3d68a255f1e70ef65e24176a12ecbcb24f98f7c165bd843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc7589a541fdedce5b5715a03ee2aa3

SHA1
dae489f5ae97e59612f0971c2446ecb6ee57efde

SHA256
1fa5ab8850fe6346e164e03eb628fb901a1e693a423ded61fdf50cad93d35d11

SHA512
2a3b5b851f5695bb3e0c4e599ff43c9ab161413511a96baff181fe941056c2d54845eb5984858af3ef987343f669f1932784666719b077a7b5c8e593da695472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
454207dc84466bcdccf968f4387ba0d9

SHA1
0d5d98a36adbcc87e6d3b7ec1f06ac50a14dddbe

SHA256
211b6deba175ee2818936e45b69d1f324761f0277b4b55544699a4280d0ad9ad

SHA512
4e7888f54f1532e73d09ef23d628a9a7b75a8e6a087fd2d3b52f319830e3548df641efcf2bb955c8f164a463ac32df0e564a438bdafadc6dcdb9f5b98d0337b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35E1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit