dc45c3f8b40d0aa36a46f6094e19f712b45038b35a231c24eb2d9b14f46baf34

Analysis

max time kernel
122s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b4b92adc65e6a260b37d3510feb152b.html
Size

9KB
MD5

0b4b92adc65e6a260b37d3510feb152b
SHA1

563abe38a112f1d95445f36b33993155caa9d4fe
SHA256

dc45c3f8b40d0aa36a46f6094e19f712b45038b35a231c24eb2d9b14f46baf34
SHA512

0feb489f39205994470966959ee7710c3eb47a1571efea14da6ca07d2dad6727d4dce88a50e7816db9ed31ff16f0e98bf31fd289104840f9f0ecb6ea67978ddc
SSDEEP

96:uzVs+ux7jYLLY1k9o84d12ef7CSTU7GT/kIIhOp0okHlVHcEZ7ru7f:csz7jYAYS/+LhUjIPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ac8cd20cf516057ee6cf7a30a03a6cad90949045d6aa9e2a1fe22b3f1cbf2435000000000e8000000002000020000000d6bab38c3b571bbb47d65507046fecee02472f5abc37e5e6b913c6a8321526102000000065e9c08203bf1354b79c0cfe72194ab025639f5dcf51ca6083a0fd7f7e15cb1240000000aeebf8514fd38668e41aa91631c2b47c280ed402a39c85b5eb39794bde94484cbd381852cec09558593f37ae9f07db85c3470fb34ca4c8e9807119ed83e1bffb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b307dcc13bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{058791D1-A7B5-11EE-BADF-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000002e5e61721c48a2a79494a87420e9358d50e5140452e26f045e4e2094d29eec16000000000e80000000020000200000008f7c783b09415c1a8fdb2b2be43b9db654b9f4f4ef0fa41227cfc056637ab008900000001a523f13e0c99166806b640f8310c630eec538fb1a9e89fcf4736fbd5019121440ef2b6f2dc7e1151ea9b4264bcd385aff107675037b5fb4f3f68000ca71424a21a774383c9666dabe2dacad06ccb2a3292a8c5cc73ca6f3a3757615959bb91949356adf7bb520701860e5b574ee882df8a43cab19e68300404e5a33b7d8324bc30d8361e71aec4126769e7f46fa3aa240000000e9a35fa639168d00077ef745eea609f1852aadb482f5052191d6257b4ebdae45b2fbcdf13e70f4ae003126889a0c45eea5ec283afdfdb6cef5e1afd0beffd0ba	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410172514"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2436	2652	iexplore.exe	28
PID 2652 wrote to memory of 2436	2652	iexplore.exe	28
PID 2652 wrote to memory of 2436	2652	iexplore.exe	28
PID 2652 wrote to memory of 2436	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b4b92adc65e6a260b37d3510feb152b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
358745c712ab22f1ce24021c50a56160

SHA1
9082d542471559dc7eb23a0b2555ac440d453411

SHA256
9188459611c1b54dc948bb8d8c2e7d2ac1ec884d0901e0e20dfce2719e0e73a5

SHA512
c7a749d8f52df434afb4e0074c2bc1cb30b9e1a0d42af66cd2d399c8360c7bc09e9a99f86e73b31c4504c505e73604829e356709afda8faa88d1568b5a6a9dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8133bb1d1a5a2bff075ab645e3ea87fa

SHA1
d1f0433eac60aaef57b2c3148fa9c27cc271283a

SHA256
9b228ed5d1791ccb640f33d11b25ba9c757a499e91a08b08dba36895be8fd771

SHA512
052c82396a46fd17c2b60410efb38d9541eb409c2de8497428ec4591d298ee078c561fd3903e758a56af71174d61fad9e95b5bffbfcb1e1dd5792812b37d9a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d1e7ac349ea69c75115dfacd6b519f0

SHA1
9522c396bf92de94287f823a423297292eb3d8ff

SHA256
ed0483ffc4000ee5916070656677707e50603b89c64dcbdd7ec39c662231efa0

SHA512
6cb86a473a5d361a56d62002ac69e148bd6d8a5ab20ceb104f63518d82b3af9a3d1007195fe34d9d932b236c1db877d333eed42454906e14947e7137971134bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e339156979268396ef73057839c25874

SHA1
31a3d62a9cee1b1058429cc651519b7d7d960f8f

SHA256
841ee7ab254666d82172d0f02d98bb4f9f8a8aa68d5f6e7f9fc9e90b98704b81

SHA512
07a43abcd3bd806d74207021df228bb68a01e540a17c92c9e0004777107cf11bffb3a6490dd951e40cb981170bab527aa1eb6288906565bcdd79861edcdb45ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7952809271768830cb7f37a5f5498b3

SHA1
42dd45825a8c1e9034f30dda79b80f61a39d5da4

SHA256
e0e90a2d418a9fddcba52c90b6e8f3262109c7d2050f5cc5d6fb842e94664088

SHA512
177909629ad0f0c6b93fd86e9cd0652f515507a4cd22f30840e8f97050263cba2662e7e3e3c828fa93ae6143d9ad011ff78c6c241fdf7f1c681a8dfb34faffc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e7d2d1b178dc5f4869743ff38a6a089

SHA1
4be82b50ff6a14a5ee0a8f3ee5c139662ab68a94

SHA256
90a69ccd2b0afee9885a29d7ad9d8fd9d7fa2592da512f5162cc02b580622eef

SHA512
952581c83af8e1f7f5d07f78dccc521cc5d39d13722eb9f47306c8524882852ab3fb7d8915497bfaf07f87dd72952c7367a607b4ff62c5af1f2a7de493ab6c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c78ec90916d7c5e630e78a419663db

SHA1
bffbb0c26e0accddf521da12180f2d199cb18934

SHA256
e95f9d352e40766cdc12efc9c61f98f58648943ae47882d21a3e7639e6349d34

SHA512
eff4f90fe0efb2686c11336cf7224ee282f02861b5e2bdb8917d997d8bc59900252bef61c812d22440169e7f449356a821788ca179bb62cb7063b09f4da87787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401afdbcddf936eac3040a4e52c13953

SHA1
10aad58597334d26928116ce4eec17b0ad42860f

SHA256
3b731801fae1a8951a2e71586c6fe4e458fbc66d247e3ee34d0b0a7ee5f18a63

SHA512
2cf8269cab606baf1f6d5ae08993cd7612eba49307bba79eeae4ac320fc7595b73fd397d7b928fad9e272286d3db9fb2186f5751c21ebd8b0f31ecab414110cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2dbde993633cdb46fffc8b2d7ebd28c

SHA1
40e614c27a134cd094245e64262e5ec868e1cea4

SHA256
8bafb2084022126f5e3f0e0885e8a925902ba1eaa3fcdfcb3857435b04eb2086

SHA512
c96d96fb0ef7895960b4455717f278cc3a743f37dfced75bc25a42e1c93ddeaa4e0627bd5d71d0fe537b9293c449615e18c3a022062048a5af71609082e11e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab94E3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95EF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit