da21b6e4da9b00de5affe38e7cca6a9609b8296873d40437affff354bebce614

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba9763b6211ad20f15db9210ff85e6e.html
Size

36KB
MD5

0ba9763b6211ad20f15db9210ff85e6e
SHA1

4f077cdf2db751fe6a1900c4557413116545b689
SHA256

da21b6e4da9b00de5affe38e7cca6a9609b8296873d40437affff354bebce614
SHA512

f0af7944b31653eb8ff5cb56da8d11095870aee76259d1dfb1dc8e9a0ecba57a99ff2af78a5cd440546f2829b153335cdd4e6b76a5653d5023e6f28b72443334
SSDEEP

768:ICGpHvvCIooi4qxGqKhAAEwzlA62cmj2N3u:ICuHv7ot44tKhAAA62cmjUu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01786cccf3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002315010f5061fdaa472f7f0254c9cd96611a8060e338564e2e794dc28599c3f8000000000e800000000200002000000066bd2db07fb244a4b68db28ae1eb817312e5dc78831f3f2756e8b3ec07c1c20f900000005470d8a00f23bcaebd8087f7aadfe42b614cf8ae5e4565d4353f3fb3a1b02ce0abdeb0eef660d7c300383fd3a8a6f94248c65e5828f89007900b3d6791c5ae34b8548f17a2320c6303cafbb1b37412f0a33b1230869de572935f01dd61f8c365056fb0bbf8b701cc850e7a99a94541f49d5d30f75c0ee3daad11ce3813650a5984365190b69dd42fdcf1c92f302f3fa64000000018389629455cc542026d86c4c004df87cabb44dd0579f6b96d593d0098cc9e1efd7bec0f1da8c3e1ec73ff041cac3f1a4ecb59288690047ceeba7f6518159786	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410178492"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009270c88d43bf86431d6984b59634abd5b5c180a80c6139fbf8301129820a1031000000000e8000000002000020000000e2fd25183ba81954b26d07fa6e6df09483af05bff297ad34da6957a4584fde6220000000311ecec96885198b55493376a872de8d93f811fc67d598b45e1f8eb787c66f0140000000cdd5b4d620d10348c0df0c5e208c6e624a84ce386b48d2db8dc3b936b71040d556b0dc0fda3b2f839e48e16ab528e7b454332cc14ae9a91a2ac0a4645356bcfd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF590A21-A7C2-11EE-8427-464D43A133DD} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2416	1992	iexplore.exe	28
PID 1992 wrote to memory of 2416	1992	iexplore.exe	28
PID 1992 wrote to memory of 2416	1992	iexplore.exe	28
PID 1992 wrote to memory of 2416	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ba9763b6211ad20f15db9210ff85e6e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b8b56de2c4dc5d9e0743b9e88868665

SHA1
652f86da12b331d8c80e09978cbed439e34c0ac5

SHA256
d9dc9ff68ed8d473cc8b907d62ce5467ec20fefd44f3c52d4be1fd7cf7ae739d

SHA512
a4c7aa665748f50c1a03dce91a549e635322ae3ccd5305896075a0698edfbbad4299b40f82b81b28ffd1158ef3c0668444d8fd0ebeb53bebf83592be6b1d0c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3192b9292ce88d1e6783fc33a0999fa3

SHA1
3c4435d6331b16c86f4ac2e4eb93d2869ab9afe5

SHA256
0dab3f9ce496e96606975be3f0d2179f79a123153b3bec8ee4153816b2404f98

SHA512
2160a4f80aff79887eb58d817c562f4702178a97f25d18063369044bf4a83ea64070dd69a7180af62504b01cb627fbcb02a551510d68041b7d5f6dbda0708a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bbfc935aa447f6e8a8018cf1c9d9b69

SHA1
b80e5312000efdd745f880ce85acd33ca499700e

SHA256
08c0a6c99f1e5e269dc589b109d19d180f82690b9b916447bc436dd1b41d2e99

SHA512
12788e01a6aa9895d4f1fc337efbe206b08208ff11870288cdb6771288af6c4ac43c79847e99095a7aaa1940ab57bcb40a7f2968805f59af63ff34c4d8a4c999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b1054b6140f48dd45ae83ffb0aa19b

SHA1
3de93eff549f473bd3ff42767c6d8f154bbf33c8

SHA256
fde24838e6e31a034462d6bf5f50ccfa36bef44647d88a0cde113b30f4f8826b

SHA512
046056e826c7ae500ab026499412c21a0672e6e991835dde8ea5bc1907760ff93d5ce338684d06c147a22bbff75b1573d82aa36a60d5fc48d25bb906af5a9c82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ba0b4ea3ef6387713a1e37f99ba5b2e

SHA1
38b8ac163c6b0607e2d72553f099bd3c8cf7c9d2

SHA256
43cab75a593438d7d5a3f44da0dd965be52db19032cc8d7aff300eb36511f1a9

SHA512
db2aed402256a9194d7ec7fd90592b0d1df7a02d1beabe2159f9d0e6ef4f21abb151e16cd4895a9b4d5a82af36f51fd30f277a1048d871402c215d52530ea763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03b1f148dab2a8d6b95645aa4e368b8

SHA1
26dbb3f51282fd7f313a136131c4750239fc3aa8

SHA256
9648820bbcbbe149d474638df6a1e98637c6e75d294602bff0bc92d4a5fec6dc

SHA512
a8fe7c751f35a07e735c6d327b3a870ad3a837d67bbda1d3cd6127c0b4f260f063aa43843f853e614b296e53d7e2a0bc77d5c1b9b4fc2fe9f60a8971afcc72f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c91488b0d64365859a76dcb91d1e8338

SHA1
16a363db5dd25684fa945d68e7d18fa74d4129d5

SHA256
eedb6e7c11a6dbae190dfcf5ae2447b2ca8303e35ab46bc5b3285a1d8c5f0b2f

SHA512
c457564f84a746f9f8462864f5c895bb7a28ba05decd24a29331e11d27f5369d6703d158337e91b99cdef692d187f77ecd6352fd4006a49e6350ed6cf869486e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
660f2657169c9283f8bd0c71a7e46843

SHA1
018c3d31adee95a62aeaf4449d5e2bb9f8f4d125

SHA256
c0185bcd5c47060a54934bcb000d6066a74bdfc13815de75d5b7ba03dd95e5a9

SHA512
d475e552dc474c7691185c3d1029b1fcb41537def45cac59a6c35b481b9fd2c7512ebb4d08eb3e8f54ca7a128280456bd722216c298f62f737fadc67168eacc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c390c3b2d55da6d533aecfdcaace0757

SHA1
9bda3923d1068d3495d2fa1f0255d751b6b39028

SHA256
9ba2b6b2df0055fe8c6a5b8c1a2f36c4e776ee8f7d6ac8b5eecc6b213b1775c5

SHA512
cddf60f5099fd1b0965dd3c8d116fadb693cf19f32ae621a51df4e0a95b281643c6030ea072e54b93f49bfc4c6db994ca7aa5d50fd2085e4c5cfdcd639453276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c26b1dd0667268a81619a80545cd2a

SHA1
0390ad1a15b0e839f03fe05849f5124bb28fd5db

SHA256
d497765c186374bc32b60e867d7807bcb6275752186e0f453061c7d7bb7ad375

SHA512
04a47dde4696faea3dbde4ddefb1cfccca91c080ba5fcfca44e87ad94ff017cb114e9c96944a11b2282bd010e352e308010fb721cc346a00171d56769f83acf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7acad8a13c18000ccb6be5fc2a329db6

SHA1
df4304f5391f438ab5d4e205956864992ff1c37f

SHA256
b97a6c9f1cf53c5911ab16abbbb4553f5aaa0e4ecbb38fc6cf8f23a7c507f65a

SHA512
30396d3b6b1f5cdc6e74dcfbd767d3d26254274aaebf4b53ada2feb15ecdfc48590d876095e173e75af1b04e03f67854eded6def33a3ebbd04aa7fee67a1618c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f13752891d9e186d803f51213ee58ee2

SHA1
8f919f589824aa4a4dadd2df0818bd225faca34b

SHA256
3903dad4d4d3141edf8864e72a7e3aaf200e1f5aa2a27a47610685f156f78195

SHA512
741532664a2907371d3202cae4d7135187845cf6dcb1e5a01acc75ab64995f82812b62d4788b3587d3380cb28046b272397b504052f038881220ccf33f708123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ce112dd5402e52d0aafda8a025fc23f

SHA1
edde773d8e4157b47d41b4025e492c798a4c1aef

SHA256
6d3b4e39daa517cfdabe2125df780ac593e9600ebee170c399d78cc9c9901b84

SHA512
5e0c66c94cf7c5f0e39bd53974a07ad1ea1eacb7c66e33a1ee08ce254eac6de6cc5bd5d457321999777179a2ff2d6af45c0c24c99da6e52e31a4aa1f339702b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
378e4cbecd364aa9b38e110e0fdb0a2e

SHA1
f547e22da7e8c1f8afd491a149cf68d27124bac3

SHA256
f286cf179ca8d367eadda9e8e437fa993d60d0d1a8395351cd43d46c7f7183e8

SHA512
726fb624419006b648b203b2d0e68db68c990081c7107e9a5fcec229c921d9b7999608cd9b0321ca6e00b1002ad1f77a6808c15f5f46cee66af3b0f49cf2f2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61144bdefbfd8a90791c20322527af3d

SHA1
fb276b2140fb67825589aa2216d47d8dc6bcfecb

SHA256
0530fb11175e327813288724acf8988994ca31f656523a92e0014d81bb3e0098

SHA512
c8201a502a7c408a088af61d223b4f624891d384656c10e33543eacc345123ed63489144faa75d7ea295ceb3edd981f67584a9bc63c364ea8668fbb1f60f868b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6c533a38362999cac03621cabb68b68

SHA1
67de6793e58c0cbf02d6389cb03692605462e560

SHA256
03baa78316a9110e069d5ffe8f054175471484354048ff0d17ede38f1f6b85a1

SHA512
e1dd598b00073aa158d9b3b6e400fe9173cd11e98fa37301671a620cdf8a644796c733ec7e74cbc37f3c655ef45503bc35b1d482d71730845998cf2582068bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d26bdd1e69b066e612af83bff94d60e

SHA1
69b2a70714592605713e86e45d878cd27b574f07

SHA256
006ada334fd03ea56c908c8629c1b7e45561af028939f02fa27229b94a931116

SHA512
2ca676e7ba1afbc3d4e27759c11ec59e61c23ff8e20ed7aae3042ec5ef5086bf333a3f74f84945e81c6b8fe6dff32a8d93e7237c82f19fc776c00c9803db7234

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB241.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB772.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit