164d1d2b9aef49a706a6c793677f1f41a5ab7a2cb62393dbc19281b64133a5ba

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b4d2fe7aa585a444b818d5fbb2f1758.html
Size

21KB
MD5

0b4d2fe7aa585a444b818d5fbb2f1758
SHA1

b0abba4eb2e029e64c33f56d7e0ce1a5bdc24a8d
SHA256

164d1d2b9aef49a706a6c793677f1f41a5ab7a2cb62393dbc19281b64133a5ba
SHA512

c7ff79d75d08667e0722729c0137ee733fba74a12f534c88ae04981a9f4f8ed6d0219c480cb6f6cf5a80bd522f9e0737e0c6a2065da210a97ed199d1153e0e77
SSDEEP

384:h3rjKIYCR8IbF0rMKTiICJRHN3R/C/afQaa9vu59l4pg:wIYCyIbF82ICnNh+faa9vI9l1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{296F6731-A7B5-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410172577"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b4d2fe7aa585a444b818d5fbb2f1758.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f60356a585d7352b09d461144131de9

SHA1
013c52d05dda9b06d7b48ab494d471ed1601777b

SHA256
6a10b21dd50cb3e2ee5b9dc3b59433968bb516c52aa6430da005fdf382c7b0f6

SHA512
6dd3d4093f822739fef2b54e8fab2c7ef55e5c735dbe12d32943f57675897b6ca0a899d6865a33c3d637cea25897353e6e0d3e697871bfaf3e085e9033e79c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2057522666378ebc2b5920c7fba95c4f

SHA1
4b4ef4bf2be0eeedb0e73c5e4025ce2210c18c69

SHA256
f4c2db5ad6a210274e7df9a240ce44eff64662d7ee6557d3e9cb7913026b65a3

SHA512
0b23923e4cd006394946e1ec91ebaeddbaeaef706c8337e3843dafde7804219acc939be2145db63d6e1f379c9b0eaa731664b0a8f0e3861a7e60d30019dc160f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd6fc4fa711009bcccc95f7412e4c80

SHA1
7d2b5ffbde78d34f7f43d606830e45bb0b239c43

SHA256
62655133c76fa8bf794f5cb087808fd6fcd61e7ffef41fb203f0ff4c7a3b26a4

SHA512
0b94d77a16ae97838e6c02f36829526ad9bafd06eb18426c8425f52948a2ac45d965b6c4e214518b13f7e2be1fd0b731cdc890c1c1c0390a8fac043a3e813e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78749e65d4c474a5d29dccb674bd9f7a

SHA1
08aeb831027cfec22284ea1d903d9c665cdf6492

SHA256
1f14b6029b1b504e2c01f4e9789d80bf988f154ffc0bbb2a82cd0c8a4747c1f7

SHA512
3de9b3c2d7bdce310c34fc8b3d3dbf789ecc4f10679ceffa31dbd50b982cbd14617e7b22662df75509b0c9bb4ba029b37e466aece6b2682eeb5b8e567c9f64ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f98dedaf853899d0d4293549216855c

SHA1
3194a19a7e80b48200af78d8c6b0657e903c6515

SHA256
cce254eb75e83ad5ac22724f8be75a5b863901ac7da3a6a52cdc0363e2625041

SHA512
acfdc28854e2cca8d6f95b38531d82013bbbeadbac07ed9d97ef3131cfe8482bd4357b73ac41bd3441ad8db0a741ecbf4e8dfa90e0327c58bb586b9b74322e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7807be7826075a17baa6e5b91b7666e8

SHA1
c14346812caeeb94cb5873a90b5f453c4c41a293

SHA256
904b61bf63bf5f8e12fb4a719bf86371ec3b836d15b4bf75593c56648aeed903

SHA512
b47a9d7b77374f215f012eeeb26275e361004c750a185fdf7bee561b768e6fe9c5e89d87c7cb54ccbe87129ce216c609facb785bd8dbf0d55407604a3fee039e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07b68a9251cee14e0865f460f514ec95

SHA1
fb0c5c2c63d3136dcd4cfaed89a80486d0abb71a

SHA256
858af806e57c8c40b09b09c0b6cd16721907a18cd673c953af72b8f92b2b8ee2

SHA512
c442e814887470e4f0bb8129b310e80ab435b010752af3546441d0f8b651cd11a1339db92081f624541a3caf06174c80318a7d02d955ed6dc280d0bb7f6832b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a3cf65c726e4b2a550675c5a20e11f2

SHA1
088c87e124d7ec51b8fbcd9f76b290b3d6562d0b

SHA256
7cd978970fd57d9a4c543930d31288a3b6a994138dd60731f3fbd0ac7a2a1c38

SHA512
3c310fc140cdd2e211cc3dff39a6c2ea9452a67e261f132b1fd31a34fb715f862d87b6de8b4ab037c3196a2617d81c10e9e42cfd3485aa689b24ccc77d5ade8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50c5682aea047174ce406e2d544872f1

SHA1
131d763eb5206cb3c8de04aae5135b532ccfe04d

SHA256
e8fca7d3c3f097bd2489f8de927c08d271074990c1d5d2e003040cc311312da2

SHA512
df238adcf96af7adff8c3f6e7b1c4609e1745e43e61af13fe642ea61d95c61446e0751502250b4e417b51c67f6ac67f13ef70dba5c95c872580955443db76e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76bf94a6435f91e11ff790dbe73591c2

SHA1
b95d64b3293cebdada9d84fb6c9e086ad52d72fa

SHA256
3925b9f6b5bd170037bc137236f4cd77e3f4f781a8ddb9e0af080d8181d62c40

SHA512
5f1647267c0261b6087b7f741158bb4a59dff4a98fd145c8a89be7ae198b159f27c8193f32459611f2ee0c9009f641756270c82a0b749bd18336f7c4bec1e6a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c7c0f43e7ff5db6db389fa28c772884

SHA1
c9022ac1ad15dac5869442fe349ad2e53c3cbb95

SHA256
c12914ed17f19fe09cec000f988df9c3be80de879dbc281d630feb86bbc49014

SHA512
df7e6a0708d3e8bb7478e76050c262e81318233453fc5399145eead9ca4b2383ec471439df4303401bfcbf53813bfba2fbc05c869fb1cb4f6e8447bed0e20d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
049ee19279e2772bcedff9498d88c149

SHA1
b4c1b40a23553d4801738d2be0f3e4807abed623

SHA256
91fd170c9bd499d1e3465cf3422a9fc960ee220d5b178eba5e7caaf769140180

SHA512
695da692f9653723bf280d69f63dc7e01588436b7dc8d8d7587a75e5b7dda9eb14c365b6e0e9f8bf31779c96a0a0f688b85b22449d58aa2f1639e6845cc0a74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab75DB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar76D8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit