ecba59dc2411c412dfd014e943cef1894dde3aae97ecd0820f5972cd4db61a4a

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bae8a4bcfca9e364e34ac9ccca4573d.html
Size

30KB
MD5

0bae8a4bcfca9e364e34ac9ccca4573d
SHA1

e5eaa3d01f036fa5e7ff6e4cf03550ed80a1f175
SHA256

ecba59dc2411c412dfd014e943cef1894dde3aae97ecd0820f5972cd4db61a4a
SHA512

b2ab50614c715873f386cfe891bb0d836735f70b5be83edee960c8f2d4a99f2f549028831e0110f51fd9373247da7fd80c3335f1e3e67c6eb349a0d392cca300
SSDEEP

384:SRQx3ycICYeoAfOAOZOTWVFYEvRaSz2yWs9WE9qsXoj+DjRaQyL0K63fqDoDnb10:S2x3ycwn/ZOaVfP9W9j4RawFo3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90101ba2d03bda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000728e57babc34e861b1a9650b3acc4491774d7ec878c84edc0d0289443986fb9f000000000e8000000002000020000000498743fe3d05bd143d6174b56e3a574e8a83f98d36f7d4d9ad3d72bcaa92f09520000000852c761aad904c113345d56eb4149ce6ed962dfe10d76393fbae5dcb3bed7223400000007534eb7bc630703b0b699f4420352b61df79bfa6e48633ca3888d0f09ee5cb33c5b446d7b693443a5160293793fef9a045363bd74a170be3fe481c43eb76f5dd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410178831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B337F411-A7C3-11EE-A0F6-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006ebd380aa4f9ef613f8c2a6e4326f885433ad6cad7a88d07e253dea392e55ce5000000000e80000000020000200000006ba8f3bc55beb76c3a21db8521ce6a4d14783b75472d7078734c79afd7f7215a900000008f7398cd801c117f4e0dd234f377b1b1587adf442ae8fc7d88e576286b01e10e075816bf8ce412b81aefa2c438ab5233b346cfa42b5e72382f3d098dcf1e54d9ff1bfb7fe81e654533897702ae9b1b6285a62a6807bc26ffce9f6058fdc198caddbfe3051999cefecad996654bae0f785e4c7f9c3e26bdf50b697552bf8682b6345dda4d8d1c903822a23a7ab7686e0e400000001d0283e26a51c1903a7a98ae018cc89ac038ca67a2440317ca8325ecb5e142ae3c88ea6123fa5e311b766c5a34431ad0e8aba21437816e32736f4c9cc91a4c13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3048	2256	iexplore.exe	28
PID 2256 wrote to memory of 3048	2256	iexplore.exe	28
PID 2256 wrote to memory of 3048	2256	iexplore.exe	28
PID 2256 wrote to memory of 3048	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0bae8a4bcfca9e364e34ac9ccca4573d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb71d4d679767f900588fa39b30604b

SHA1
e933ff35d7dbfa08103e6f391ea4edaa20454c91

SHA256
e49734ba97b909490a18057f407057ce7fb3be9fa391b77aa59aaf1fbbd5faa5

SHA512
1d274a1732af7dd38a9516bbd429795dea73257d4f6749e500067f62e347b9912982a3bb916c9355d30f104fc07118de07f1971c3be0b9b6c76c6631a348278e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c25167e83f53058aab5f0abd5632b9c6

SHA1
64182827ac036e5255aae9755443f2363efa75e6

SHA256
621162260d9e4ce85af785f2a2419071e45f98affcf3748319de685c6799795b

SHA512
ddd80a2ac1b41217217dbb0e4b6bb0390a1cedb90c130d36e6d9e06eeadca99698ce5db7c5a01085481af73eddc7c072a58de670d9ce63ad67ecb7cb90fcbca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b269cafede1daf6452399e2b11d4607

SHA1
d3f0e8f085b6523a85c9963070fd03d1a7327d77

SHA256
aff405de27fc34fe14fba6508dcc6de6bd483425ad3c32bfa60639aa1aa4c5e4

SHA512
b00b134fc38380ec38d396ce57779f1c58b36bed1a562e5dfde8b939641d57ad38e4d5cf884842c1338d6cf98df4e460d539337024ae1b806d0accc384c56154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8e5c86941f0fc6ff42c3e0bd0572bac

SHA1
a63b2637dad6b68f4814caa9574f3993c465ef09

SHA256
027bc8ede8801378b8babee4ca63b8192c9a309cadc93b5aa96b7b2647f4d720

SHA512
e311eb7ffa7497c01b87ea14217d859cae15607556408ec5439cd7f98d219c0c4f7b837d14f83843d59eb9c9e7935f861c2113b51275fab3351043c41771c581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1dcfd221e40385e3a45b9fd4b7b4908

SHA1
5d894ba189f2f1cc018f5b059f85fdefc1878e38

SHA256
4c9bdc4cefc3c77e7d40c0fff4b27c6aaada6ccc7c7b490570cbaf8514b3fd39

SHA512
c6efdff4454295b79cd5e8928be5297edb9f3e639ca4b9895e75366ca85d8199c880f1466554af1e32a4a8df834ecc2cada9b4eb32eeb9301f568f4d9ad557cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b14ae9e587655097944766a11b1a1df5

SHA1
f66cc0c4606ebc6e95f51fed36ffc0f6c215eb41

SHA256
c8e123f948e9e325874b23f44f516bba60116fb4bca9d1693267de68b94290ea

SHA512
ecbf7522eba2d7152c0ebc5df111ffe8a01a2d1bdfd8a0f1533c1fb4b76ffcddb2c949687578182724c6cd2345ec567f38d8efcff7e274da8e5f3c01c3198c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b9a572cacef42e4e0566d1d9ec9968d

SHA1
27a5d97c5e58e7c6eb6150aab56da9b41c1cf122

SHA256
74c7a66fccf7b6eb083a6428cc3ecfbaae5e5c456ff1a4296a31c8e7851a9b94

SHA512
d2cd02d36b962848560f3252dacefd2de068b91442fdd7f7e0b10b6cf1036ffdd50019e73e77470481b36c3ab6e0b1f72338f353bea454fe18afb454a8e4985f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c83d4ee3a08cb20d55d2062b80ddc0c

SHA1
ecb531d6ec1fd9e767a0908db0128e9885c29640

SHA256
f3f85509e8ee26e4f7c5b25ac71e8ef7a33a045be9ecf95cfadd7b5a6169d096

SHA512
34b5a47dc76f1b1818d05d2a3dba991f4454a3beb7e021c356712e0a1ea96cfa85343e030ab536af65a97eee0b6e15f220e4488ced061ec38afa4edb3fa9fd47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99222935c446885ad78d4b559ce6f863

SHA1
62a0ab4f4e4ba5c99d20461352123174dea5d85a

SHA256
ca66e055ef37f3c1540e051e75b22f278ffd3bb1f0f1fc54e2f3969cb068858e

SHA512
186d1e2b77cc888e3a2f1c623940d8bfcdf50c38c73858adf5cf6d94081d50e09bdbe95318958df47f0fa18532fa37e64df66d59cc155e75e3e5b4d3a3341ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e307b3d4be02f56605c7abbd0bab0c

SHA1
9e10c8690fe10ac8af6a0f84cac5c31db845acfe

SHA256
aa2c77f0ee08122286c2f51dae7d8e8ba384a47e3aab2128f3e1d88791350667

SHA512
eafa33f165545c4f1bd9468a1624c477acbffdc42f65054cc4671e571f8305a35df86d80b185e2cd839f7869d75adfc52a674a41d80b86a32f895c941819511f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e2fea1b1ea9ed807b1ca8b93f2e28d3

SHA1
fdf68b7bd49b9f2981bf57c42efa4b44ecf10577

SHA256
047bfff89d6062bf932e993adf99ad0e1e61765f66d11d5f907229243329fcb8

SHA512
372afaf57ed3dc4356777fefdb11a51f69e7e02c1450732e43a2f95f038a8907fb3fd5754ee826dede5c28b342306bde013df663886be3a90bbeaa8b370cdd39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4abba28d108a4ba3c6cdcd665bbfe9

SHA1
e756eaebea7e29508d13dfc1ca016c70486d9dd1

SHA256
4210bd07dbc3b57cdbe3193a61d91b00612aff485fa27eb6de1de25c41444540

SHA512
c51b80a0428e3edce5bfb70620be06ae0504d7903d0b657aedb830cca87e9bd047fd57fc861a0bf30399709261ef88c9e2477bfd9e57e693e565b11281c070fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4405a75ca57dc412825544a35bdbab

SHA1
baa68098a6096e4c0241d2c2ed4d51066e0af7e1

SHA256
d829f613fc6d5458eca0e718370e0f18f3d379907ecc8b83a15385893b4ddaa2

SHA512
4602b3318f0de7240aa6c01f91bdf40f22269b63a6eb24c4dc51e4f8ac534894227929bc25e04ef9564c3d52bc710fba10bf9b9f36069ca6a9dccf97f85a9c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit