61bb48932363617ae41cd20ae8260d4a79994353e3ce4c54448111d4c627b8a6

Analysis

max time kernel
137s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bfc84c56816e9c6dd2d6435f90d67eb.html
Size

49KB
MD5

0bfc84c56816e9c6dd2d6435f90d67eb
SHA1

1cbe518a797e380ee50463bc5ca86c10cf92a95a
SHA256

61bb48932363617ae41cd20ae8260d4a79994353e3ce4c54448111d4c627b8a6
SHA512

fa2eeb95a0422002cb751f7dd4fca7f8a67a117a9a06d567fa6db2ea093821b465ba3d791ee0db04fce3857597872e2f84555ef689c6fc497fcea32898d2b491
SSDEEP

384:Ppz+nhbfX0QjY7wOwSnfeGxyDnUNJlmrqpa9ST/vYuMQo9ST/vYQNAzVs8fz9nIh:xuLELwSnfZyDnU3WnEKEYm6Th0D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407671bcdb3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E042F491-A7CE-11EE-A83A-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ec68d6c4258e886a7e8eff91a5dde7099c6a8cd396a2a6299d7fd5dda7393fc6000000000e800000000200002000000049e1a184c39fa2471cbb0e798570769348dba850ec22f4f51566fa7006dd25692000000085e18750043059522a63bf191b2ca1168e72673f0bf54eb7edc18a93133f7bc240000000622548777966bb7a3b9bfe3e672f63975f1b258a6017eb13685308f1662f4bc1040e34cd93d7989248d408b162b277f4a840fdad0249a9ea87fdc58a372af81d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000214b9f5792b64daacee50e0dd937f00fae9dae06885a29a8a5deb66852623e12000000000e800000000200002000000033f8dd04b5951b5b24043285e83cc37f25eaaf40f01f200cf9a9ac009a56c2c190000000a081d2a64fa949443d566092d18736e6d300c3fc74a6fe65e8a5fea0a1440f080bb26a1e9dac1cf9b4f2ba352c050961591a36f882758be13077bb36290181fe20e883b2abccc70d7bc4d1c37d56102aaee0f78f6f4ec4eaaf24ad63213d503094b1b6933a0aa61e0b494d4c4d53ecfdd7e318ce1d86ab2c8e59be33838fed38e9339c1a423f2ab392fe3ead9fae8c3f4000000084189d8c04334625ef641dd9ff8d70b63dacf2cd0c3036cc44b90c7d0b4593d79eb04c73895fc7f2b0a2591e453b1fe1822e037acfad54024cad583c1a0071a5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410183618"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2648	2116	iexplore.exe	28
PID 2116 wrote to memory of 2648	2116	iexplore.exe	28
PID 2116 wrote to memory of 2648	2116	iexplore.exe	28
PID 2116 wrote to memory of 2648	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0bfc84c56816e9c6dd2d6435f90d67eb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
013beec9af0f9f5112c1f279265ded50

SHA1
f1fbcf3c4e675d0695d4b17279698353822410c0

SHA256
8107e26128c24b8c95e7cd194f47ac5fa9c3349e570abc2f2001d1f67b9b3a38

SHA512
b1108bc0d6faae7f6b9bfc326b5221b59918464bc74ca4189ebd102326c584a74304cbba168bbded05a7188079ba050a3510ec984825d1f4f73670095f1784f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4de68df687e90bebc07987c8acf9bd8

SHA1
fa1eac5c8c5a5b374058daa85a8cdf75170e1302

SHA256
7be4e2a3cabc1cca040e2078b65377ae5002d246616632a1acaf626d33817794

SHA512
a1dce991fd23c8000cc03578cd3a404e7450525320b8375cf21a1fb3a013853f35489684891fcfba870689b0cca70fd8b2e495178eae8634b7e91c15305496cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10298db083f2eb88dcf94fbe30db0504

SHA1
dc2b762396088921cde9e8f776cd7b97e49e5847

SHA256
a2830ec8e0e186f92ff2ef567e18c91c1bf7e65a1cefc0961881032bdf800183

SHA512
b5f3840f3646c16dafb7ec34799898dd6b330fb0f1a99cbaedb8572c195aa71405a56dd9b67e2249858bb2b78a1b236bb4c9c2852453ae1ad08ceda456e01fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1220dc23055b04076be7c7b1e7bcc802

SHA1
525a9740549858669a4d4d2d1e6276467d3f48c5

SHA256
acc65e06533b40857c71adfcad14331e64ac86f8aa6ce2ebab9a9dc8fa60bc89

SHA512
5d12071e4d11fa0c5418da630ef6df6d76893edc62977675452f5607bb840e8f7b6e302860e5910f19219ef6ac456fcc5a7c5e0a6b530993621c4378c67738d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ae21e25e6840a533156c42685b5be78

SHA1
046a05c68999732e9cab8f421da6494690a00d35

SHA256
59fb811c2192c1f60d01cff92fb700af1a0ef88ec927678263d80d973e27f97d

SHA512
ad8723f334d632d7028498fd1bacccf35bc86f840e5f4cbf5dfa693111e6ae130c01d7e3d572ab70257927a848a6ff8cdbba81457f08b0ceb116501b25978434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
635eeec9d780daff0d00711acc2c8a96

SHA1
29553f9e5bf43fcfd0b7a8bd015f4dbeb852d05e

SHA256
bf06543051648f7407e826b75e2971df4ffbe49a17561a75d44ddd341b71477d

SHA512
fad653d936996cb0faf1ee49ab72bd9f610d33266a4c01f816a63dd4abba4c101635d789902e58bdf65645bd3e9e8a55025315fccebde79f5ea1aa0d219b935e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f8cabf09fc818c7bd81abf24f52340

SHA1
4d359c108349517713ef92498e76f73933c2abea

SHA256
49dc8a6af03a75d120f21e04ea37d21d973a753e4a3f86436c80d75360548349

SHA512
b5bf8e487cd40cb97a7f430d0bdcdf827f2620f9a336621fe18961e506c3c89a8ff00546d74aaa26894d3893225c9b5fd576b227f6c660eef358dab2948bbf50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cea72e06b08ae61f04ef96203158d15

SHA1
eedcefdbbd94db9e8d1b31adb193ef7ec0f00d02

SHA256
687a8e45db87f8578aa6ca19afebd1f12ca6da060364dd769028969ca6c9af63

SHA512
a4c1fda1fcccf0251c2ecf154e26e2db59b36c39ae820012302b2b95bd38b64f47f374f97ed7c46b77197bcbb489d9717f96b2d648d556b308a9816136e73ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf5bffe72819c9f1a2540fef21dc5d75

SHA1
84428776dcba1039b8fc8a13490959cf60043134

SHA256
b3433605fadc09c1beb8f24e851d10bee5b3b9f6fbd4cfe5de4e42f834c9ad6e

SHA512
aec4647d476fa5ab199fc477d75ac8634f58d3d460706eb56fdef70074553ef38ab878757dcf18364dece65726ea949b021ab9bfd3cd56ef4e02d2facbfae723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e07cdc59392af39adac5c6af44e836

SHA1
25abd0e5fd0126f160188ed1760b9327bffa5e03

SHA256
b179bfeb03d5dfa7c2bfc695020a21e4d2431811b8a2fcfae3a6917fde430a3d

SHA512
b78a9025da435c4d3552793a8d3f4fb1989c1db4c10fab4c3cb07daa04cd9bca1048c783829fc647afa1de40bd0973bd25c902195957b67d1b06edc853292379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edeb1c91b9fb4d58773393ae68186422

SHA1
cebcf49e5635940c84b345f9805230f58b41e7a3

SHA256
ba4f3ce0258a190e6d77db8ba13bc564ed52bd60cba3146327cf46f67d4ca3ec

SHA512
8c6703a6e78d9b806da4bfd0864d4bacdbd90ae88352f8afd0f66f3e5f334f023796a06bc7e27400bf75447fb164ae412461a0d0cdc4276842d67f1ff44226d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33ac0ea47e7df42214d67edf8bbf80fd

SHA1
e69d82b123103adb657111b08669ae9c58d92088

SHA256
3e34e9645f9711a6c8d520a9ac6364ee4114235f3aa9f54ddaafdd36db04da65

SHA512
8493a6b29db704111c7c1f83f85403b3895db188675dd7473bf30c32bab2b615d3f511ad0b13684f3a64fabbfbac9f6c19f1c176cafede6db78ce67069883d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD9C2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit