262ff9bdd56f23919229bdbd7bdc92e6eb837ae88311657fb2f95251217ec141

Analysis

max time kernel
161s
max time network
246s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b7dd676e688b36cd0041e0cd4d96b90.html
Size

2KB
MD5

0b7dd676e688b36cd0041e0cd4d96b90
SHA1

313bb515ce38a59933b6cc2dd5493abe2ac22c5e
SHA256

262ff9bdd56f23919229bdbd7bdc92e6eb837ae88311657fb2f95251217ec141
SHA512

a761d512073f4a8aec7a4d1d39065128dcad87508aa70085dd7c8d00f4cb346929e1a9fd1aecc4d8f404eb70db87d89f4ee64203a5f4622e39ad2438e986fff8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b42fcccc64fd0ae08c8c1fe258db1464af60e57f6038def4587d463389cfc190000000000e8000000002000020000000230a37d1cde2e89ada81088841e53847c767ca039d01cca526ac58e9a2e741bc200000008d41e39a2f80ad2a2e38773734ef0149e64ba0e27a6348cfafc64e69c7a6504f40000000d41ddd6cadec4559438658dd367fbe697cbd821d90f71933525eb7071ccf44738ee66e4edade8deab0b1915773773317a88d99da65269e3eba52fa9f3eb4c65d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4597231-A72E-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410114890"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c9fdca3b3bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006b254ee179b2cfb73a113d992211eb97c1a6da1ec7f7909efa2148842c71e82b000000000e8000000002000020000000dd61ebab062400999a5a5cc49249dabfff8ffbc1b22610dd8b67c5569ab49063900000000391f53fb8d519d393226f53acb325f6afff61659318ea91d566900d96e38f772d8d6bb76c00abba71b35328855513a9e1995345b73bf91a525030df56d2fb4a95e848e89eb1f26d746bdb2eb14a80a06f1b073483dfe90f4a8163b904e1b273735ec5a74aa5dfaa7fd56aedc5ca174525479c89888200984f56afa8e0ed2762a2a38db8ffedea2aabc28b65f33202e54000000055b2edcdf9cc876e65cd8dee648b91eb2462db69c8f79a3fbe9c0ea7d3c7f28caedceb7152b2d74c0f13ef6a342127b37c215c0edfc53ac079fcba1a70276bb2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2596	iexplore.exe
2596	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2888	2596	iexplore.exe	30
PID 2596 wrote to memory of 2888	2596	iexplore.exe	30
PID 2596 wrote to memory of 2888	2596	iexplore.exe	30
PID 2596 wrote to memory of 2888	2596	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b7dd676e688b36cd0041e0cd4d96b90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca5a00f13938da661dd3ec196d359620

SHA1
5027197a032323bc7625c5bb973880d49923148e

SHA256
ce282d916558d13f788f4ccb09aa9f13d8125bae10165b31825f8c72ab6416ca

SHA512
765e993cdee9d248f4250abce6cae3496b60e5d1b28d1fd2d18a1eb56c20ddcc6521b577d2a02a020d7b4e22f228859eb48b33afaf1af673549ac85534ad3ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d793f50187c5dd3f86a607ff167c0f0

SHA1
a5d2ff4904191ff842f517b008898a540adfffcb

SHA256
f9b879f8d058a39d6e03ff8a2aea0cc9eba0efacdefbbcb1b4b7561f1618f547

SHA512
844d2b28e610078dfb927a6bc81fe384db2e1a199d981aa31c8177045f2fc6b5cda8c03943ca6c1a7547965d547e6ace1af0a4068793a2540d625cf4bc386038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeeba2d1dafeb9b164755955136c4728

SHA1
230ccbe7c01f5440cd0c2a1c44dd1267c556450c

SHA256
2f00e13d32dd83c626110be1032b15d52ecbd9c8c145c3e9717d57c62856ba73

SHA512
a7675d6f94f139f710787df32b6e2b2f501a7a42715aea380a3796279851c9a19f78f1de4cb2829b48fd38924f3593f23ed15f7dd6f34f0a84e7f3973761ecfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dac59dcbe1f5cf5586fb6cd411d13148

SHA1
4ec82851fb9dd903ea852fcb393490451b908538

SHA256
149e278296b1379c12ef5c8ade2f806e496fe312f1402fde3f7fc09f29ebaa7f

SHA512
5259eac2b8f21cc18ba06c43f952648534a935b9a91118432403462ae707a975e49a1ed1a06f620fa1041436a64e044b4920e254df3f8a9d4b1e904ca1860ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79e6983941c326ba091566dfd8df857a

SHA1
0a114f53694952de334f67e8ecf1e790570a0f18

SHA256
9df66d94567ecd79b4a001679abe534ea21e3ede6aaadd00e9ed1328d7b01a5a

SHA512
9cc4db60455cd9ba512c1ce0d447b6f871b0cdd5b8f6b2b81914c9485e60e9fec2994d26893c0cf44c6bfd2a248bebf7121f7c19150f97fdf964752519d56e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4686b44f797281b0c88aa9cbe42dfcbf

SHA1
429f448f2c19a5470ef32186db5453dc8d81122b

SHA256
a5d023b698d3b0d57f1626bdbf4d9049e5a2d9aebce10e0e9a78dcf271a426e9

SHA512
edd2cb306662ecf728e9b11b4256ff3c94c143dfee79c9f745f601daa04e4de3fdb2a3c82c51f7f777f578738c013f96415058eb35bd590dd8a11fefae648d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29480376d072894b44d1a3715fcab32c

SHA1
c4c4499a12c907394cd38bbb3c5d4b60c469dbf7

SHA256
f53634f945391cb6d3fbe9e6dbcd3980e7b37aa33a74e64b21a8722068a1d52e

SHA512
8b7238dd5b72a3c08b6293c26e840c41fb1e530105b851b2aa23eaf9346ff9d93e335a3a033e19a69001c7d6153f1700594efe14cad0b43cd0516f27f839372e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e28791aefb162f708e1c00f5128bc6d1

SHA1
eb82becc6ca3c21c5adc41011870e361e316a532

SHA256
2b5b37ddade8613cfe22e68f81a01b26bec13e4e01f1f2f708b54a3ff8d2d965

SHA512
35ed02fa46fb47b1dac5161c5c8f660da3b4a1105a8b76e788d60694abdb28b01f135924552ec144effb8bd532e4667a9d718fff9c9c4c171ee63934ea220561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89052d3e0d02dbc0c9f479e163da1ffc

SHA1
27ef1c2a179baee816352dcedbce2d9cc0d510b1

SHA256
e8807dbb6829c81c1674656cc260eb34e1b041fcdd37be608b6e63689311d1b4

SHA512
99fd15a18c64dc1271d65cec224dd51ac3b48e91d43743026822abf4de47c26c3b1179819efb8fa884e642da2dc8ae5eac88a1dd33b4566ec544521d086098e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41484229a0c0c5d2937384e9f7df1b4c

SHA1
5bbc98020a97731b18dc096041cda75b3b06a397

SHA256
e9994eb702c4ec8d436b7f41d3517e3210d4e82d8ce39f2e716db8d9129d22d6

SHA512
7ae87575666deec85d8138059d4432c78509d55c61ce8fa9e1674d6645417e14ea62312d5589628d202d4d17f920cd338352941f47ff5fd5edb952c79967d77a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB54D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2CA.tmp

Filesize
115KB

MD5
bd0423f52c9aeffb6e27f6461757179b

SHA1
8f86b2a5d8585ec7d1e74a4b27b3a11cd8a1bca9

SHA256
f7d616b9bd1e106b63af0becbcb09721c6f0469442f3ee7424c1ce5ab7c4ae0c

SHA512
5b19db9c91f18f192faa7478c5e6f8233eff37fa6c47575dcfd0b897b8b0a58e12bbb8b34b5f7172a94dffaabdceea403c797b4de3f257765ad1efff6a325247

Download Submit