cf3c148d406522036bee17e5b61392901fc214f26ef5e586ecc6e30d061169f9

Analysis

max time kernel
71s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0af21ea3b647626f3eb169760ca94593.html
Size

51KB
MD5

0af21ea3b647626f3eb169760ca94593
SHA1

a34667c40529d7adeef8b1ed8ed24de0fd018a04
SHA256

cf3c148d406522036bee17e5b61392901fc214f26ef5e586ecc6e30d061169f9
SHA512

484fc5f8d7a7fa3eb2ba72f651d7c969f96055157c3c35ad90cf6318ffddd8d2975f561baa90af6417b94dd8fbde0b5c52d511b5cdc74aea779677a7ea090bea
SSDEEP

1536:5co2Ru7EUAKwYiH9WEN7tfyzwwwwC7FDNWG:RocwwwwC7dNWG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c0f958d6cb83dbb6d3325999cd9de5b388d1b57107371d7948a5b84234d0d3a2000000000e80000000020000200000009ae1db7def0ba151e734bb3752c74524a8777d655119f6d39ad5287efa6a19672000000024e7a9aca55af55ecb042b5292d99c05e3419a4907fd825802770d6f554961e940000000ebe3d098d1a2a41ad1bfb4c063176b13c862eca143fe3809e063d2fe17e6a74dc58edf7adf988dcecbf2209694a2cc210179396e38ecf4f9f30cc36ba233ed80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000598b3f4086c09f1cd1f5a34fdd8a762be6fa2f891e84e527cdd72c5cc27b8446000000000e80000000020000200000000bf9b360a5e143774374129f14139c113488da304e0ba494a5b1df995bf12a3190000000029802c53ab121ac5c353c9fb0e173d08195b81284969ca9648ed25cf6f959e509835e681ec7374c7f690d7a4128ce1063e16ceddd9d065133a3d375455c7f4bf8f01ead2eba9ac5aaf49bf78dfcdb4c9b9ef08d8c714332736e0bd8397477d286ba50ff255dcedc99c8b8299d85db071a1b0fab8ee450bd0b5ed1b752b394fa57cfc10a9fba5c11a84cc0533975f5a0400000000b174deac6e4cfee4e5432b3b8f31996d32a51c509d1aeeebb7e637eaacde7613468ed2a76b18071c41a3050b457b01e1f37eb12ee6a04c08252a4017ef430a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A19E0A01-A7AA-11EE-A4F4-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f94782b73bda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2724	2012	iexplore.exe	28
PID 2012 wrote to memory of 2724	2012	iexplore.exe	28
PID 2012 wrote to memory of 2724	2012	iexplore.exe	28
PID 2012 wrote to memory of 2724	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0af21ea3b647626f3eb169760ca94593.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd62a2980f7242240a65a88b1e0b3ca

SHA1
e8d69f5ef156f692ea965593e9bf5f01a67af32d

SHA256
1fa1d19337daef6352ee468da14f3a03059858769bfe953409b1a5f7ca8ceb0e

SHA512
1c9f1ef7fa02dbaa10b234b55081d39e8e6d6d0059d84a08bb47f0cc5291fed41f4536b5ae57af5000dd4b0fca5f3795b3f568b32d2cca98048dd148d1b03cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c53be176965d867faead9b6061e6e8bb

SHA1
167b8d1af9fc0c245ab4782c9c10e3dd8844dd78

SHA256
6365a7eeb39474cf8d0ba3b4fc6f0f146d1f417299a4b55d792e02aa53877bb5

SHA512
43a1f3ed79ee9d0d788b2618a6cf299e580f7061ae75b380a3cdbd0e152ede6eab17ee998d61badb50571502fe7dc2784232cd5579ff868b92cd5aa816ce63b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77bafa562945d7b8fb5cabc5bc272963

SHA1
211e4b17da01b9df5a0ec6ce747bc180578313a5

SHA256
61c644fd3ecf74d1c49e24b7754960c26fd0cfff8350f516c65a8afb171129ab

SHA512
5f1863918eddb01acfec690119b01fc180f433b68bacfcf8e49ceee6551d427000489f3a82a3922ba8a5ea6ad9a5a228de8108f69665c1a3a743cd7cb474bd81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc81216a496ede0470a3e6439e0542c

SHA1
e201612178dba677a81aad245b1e60c4c7f6447f

SHA256
4b8c710f4cf4928d387679c96eed4803c1037fb60a7ae5591f00b443c251fe99

SHA512
273c84a0a8ff164ee8b57d4958d70d2ed9076645493170958cf642bfbdadc539b1ab560efca7935337317da1d0245317d6c7c1a306f899a1d3a149fd7f3d5eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37f55bfd6de876f64cf5729b2fa3a5b3

SHA1
f3d9483926e41850565c7ba3f567ea0c57e1cae5

SHA256
aacbb80cc13652c8635d23f54c90405b5698821a39e13ef7ff185a5198d3cdd8

SHA512
bdca6a7e4b1eace3bf36f5b36c54b5a243459d392c190341e55ef3be9851f9f152547fa3c709922a9d30ea0aad59608ae83b45c428aa6e707ebc583169c37c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d799a414fac4fbced87b72d30b616ba3

SHA1
663a28babee901f0d9a393dec99a616dd91e2180

SHA256
bc4f6e34e507a3fbc76b6625c1e7b0e484919b5272a475ecd18139c4ed020e58

SHA512
e044e8c6db84480f712545d4cdc1728c7f59de92ba8bfa2028e51d9e174b4940c03382f0eff721e9c5a5fff9cd2642f6aa30dd32164a908c0147ff260658b3a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fa79cee32c6f7804159105e71a9983b

SHA1
19cb4c3a2644bab9c1cdfbb69045e6561faf8fbd

SHA256
ccf67ae0efc955623a12e453da4d93e9d1c8181807991c2caeb0b1bb7b086c8f

SHA512
3caf7fb78ad7ccc48a0cfe1e77a8a0e78ab695110934548098db80a3e0cd20f34fb85ad81ad7ab4c64bc01d5c27d7435f563e0c1ad63b318192fd62a57476b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bb9def0333b2c63a245dfabbc7b5796

SHA1
35e12c04262adb298d371af1b6d9f3b1c8ddac0f

SHA256
caf98bea820a33a41444fdaa541569f36fb2e3d7d4dddf81344d56994fbb98ce

SHA512
628f60454ef2ba9393d4b30c089eeb5d61ce7ef138c1d84c9de2e472cf033c1831921e4beaa5d291703e0db0dee00612f4a19146cef0d7d50e8820ea6b40bcb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fa16f834482eb6ea5e1f52629c89e11

SHA1
3bd9c363488b7e11442655ae89e0625844cc3f58

SHA256
634c0770a939a70d673cc9aad06fa53cfa271529ccd3a8e6f5708b400c61038b

SHA512
74c74d185d5a2b01d4222dd0bae7f8bde45fcdd69caa33a3e19b6b683a8ab7976a5cc0c5a51b44277bd4e9d5de94d2d54f74b514a6e02d567a7ba0ccdfa84fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4384c8f2869ffe4f042e7dbf943e2cd

SHA1
1bd49ab33de8586b8c08321cff196cbcd1d58fe7

SHA256
83130f9da2a9f5f9e4ab07e4510a6b57957bfa4c236096c97ceefeb7d74e6926

SHA512
214746ffa94cd5e6e51ca5f3cc050187e756ba680d9642cf1ee15c13c87e25b0ebef532109a76f45af3e2dbf47ba79c6db8361f9437f6b7d3f615a870a6d6d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ddaf46c08bb408e6a92fedfd2031f65

SHA1
b6fc59facaa605a6023e7d1aae66a4da049d70db

SHA256
e1d169b0e10bdbda021886eba1f229d379dd2e61c50acbb013a213909d9ad23a

SHA512
2c22ff4f2c789adeea25ee64f7bef8fb0094acff7c950d810a774b3aab7146c0b980d6c301c534770972cf9b31a4c9ba13c11d151588a7629d5ddf54ea052039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIEDGG3E\bdSSboIfP[1].js

Filesize
31KB

MD5
136bc91b923c115f678c13f3740bf8fa

SHA1
d8044de6e6a8b05f087f9fb73545d5b2e9666d61

SHA256
46e2c2af87720b7ae5a86434547bd9bef9ff21fab2956b64bc48f17dc73c63a7

SHA512
2ff613aa8dc2887a5c2f9d8d40e618ef82b8ffc46392affd32a9fa2225360f1db5244a51f82d5eba8fcf3c200f179da20433761a3ebb6fce0e4ede99d129a3cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\1WBNS6L8.htm

Filesize
731B

MD5
2fbb63a948fdfba2d9e95e42c120742a

SHA1
32bf4a60508a28d27a3a4351a8929222cef25962

SHA256
f25a2fe328a24ad33c6728470335fa047099b045109650a77e2c99afefeb0669

SHA512
a0006f8cb4e3b1b9c1a28ddbebbf385245705a9457d136cc7da0f8d6153b7e71d5406f50e095312156a4d7e750f314a854e0ba4b32898bc1e54987dc7eee2f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6106.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6119.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit