a5bf268123aa9b4d5780c67cbafa5efd2b30a724dfe717554bc91408b882c08e

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d01f34af94d1f50f2651e48bc11b909.html
Size

16KB
MD5

0d01f34af94d1f50f2651e48bc11b909
SHA1

20fbad1ce2231bf22f5bb7418bf2ba2b4941a0ff
SHA256

a5bf268123aa9b4d5780c67cbafa5efd2b30a724dfe717554bc91408b882c08e
SHA512

f8cb6a7d29aa572f4602e76fbfd570d42c0873eecc5654de336f0bc9b55f7d1253ff2388688025a9f39bf19f116ea1fd554ad9abd833f09125b4deabf4983480
SSDEEP

384:S6IeK7MS/WukquI9FIRhfxSzahIvBl3LknV:SfeK5uAFyfOa/nV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000077ba00367e152b9bfdde79bb538ccaf1dc3d64839c954b2328f1973461440dd000000000e80000000020000200000002cf2b63edd9ac9728b2a65932b6c5cc45693e9f41e47991b260a16874f3f4e27900000005f114d80c5aeffca2f9a51a86b36a6333e18f81c2dd4511f3ecfe65b21dedb3828474e6111fca595c773901faac53dd51bf923fc540935c4b48debc413cb614368a6a912781b1641ba66231c0b8c5537c494a850b73e574880510f5b71f71eb63777dd9ec394f144fdadc829d817c7c704c67246fac82d1c74b4f57d92d5ffa5d88b95a1aad84dd5ed4c8b66bf0ca2ac400000009b4864a76b52764a4e7618335e2edc07d6d28929b9ffac1a51b3a089d0244f99dc0c752e23d6d9d6f5716b8d35670981805d54404b7d8a658a9c8a6e2dc0c276	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D26F061-A7F2-11EE-B2BF-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804131f1fe3bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410198731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000003a23984c762e9e7da4a08c689aef6c1841a134713562b4c7d8001762849dbffe000000000e80000000020000200000003408835a25e1be2bb340b2d85a7bc9c55e822c5bbdb219d690134ff4bf866dc7200000007b3aaffe96d58efedb313351452d07b4c6768cbe4c62fe1f9f7c567bb2cd74c54000000048f8ccb156888d54c78b3fbcd2a8eb9f927ac6910d2c2287af111d5d18dcda6223a2c946b10c0552be2ba81059cf9c554a0e48a6ca7c68a7986336cf7a7b59ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2380	2932	iexplore.exe	28
PID 2932 wrote to memory of 2380	2932	iexplore.exe	28
PID 2932 wrote to memory of 2380	2932	iexplore.exe	28
PID 2932 wrote to memory of 2380	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d01f34af94d1f50f2651e48bc11b909.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5b7d83b7c0756ba173c719b4b71f75

SHA1
b2275964ff9931380bb54443e6f55342d2f33876

SHA256
ff06ad176ce19462c86e3ee463636fcfd645fa8981ed5dadb9cd3cf53a052876

SHA512
31a3a33d0c7cffc450c84bdc94880fc74b773d3193eb6b619e19a863b80b01ec6f3b01e1a064eed46364d917fc7a03b121b356299830a778431ea1cda4d5eee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cba9c6a56abc144d074450a4450b12d5

SHA1
b70431cb9909282a643d88588cd9a312bcd8652f

SHA256
02d211564d0836b7525c118fcd26105f950f05a48a80515a5c7972083d92246f

SHA512
af3ab5e7f5779b9f797584e0f750b7893973dc199f3b8a9cfe5c9d8527e6d31d220b109be64f9ed8ea2fd9698294643b52b28e877582a660dd49da78f5983567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e59819f5c58a37defc38d05ded665c2

SHA1
fddef430e192be8ab63018d4f14f1bcfe5ee38b6

SHA256
2b7e059f3a0c236ed0c68dc1549c82998755f21e85be9b33b8729a3002dd0ce8

SHA512
39bd19b3aded082a09fbe5bbf6be9c14b96b5f5d1a7f250a7717fd85ae4ac6e3a31e09a2217f801758140b8b96860f10fa8d0a6d7b4905b79bc6eeded7cbcae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
896305e95c85f272d2919bf4d06223a9

SHA1
79a050acf88fbad7695e73571b4b7f047b4b7270

SHA256
d60526d4c4bc5ac8426c53e0731a361f4ca097dfef29d842242a181f18b4e173

SHA512
ec3e714600064997dc5793b7be634b115ff62726c403ec679bd942c8878c2865625fd6c484639103c23578da8867e10e1d93d8d6abfdc54e61f49d06f03640fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdb5524f8fa111f949fd82d8ff6b286d

SHA1
640ee61a4f4398b18c1b84bbd0423998550a773d

SHA256
9d8f85b58a218516d880851e8faf5c2733712f489b4953afb4a301e1686abd6d

SHA512
860445fef38e248e17f6dde8efceec06b7f778a6e9cb2a92cd55fbd9c62979e4c4da75a753c21b63c7f982a3d1f96501914f4b3b4698e6512a71fdd65fda6d19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e361fca361b18b48873ebc1f1f882d0

SHA1
70df22da5cad2b83537f1afab69ad420b1a390b5

SHA256
f51a5503219d0df0714d2e23771e7afc62e38ac8ee0bd90179cf46b0cd422b8c

SHA512
b3952de78afcd19206d20c387c6f3fb74aedf791fc360b19d2f6fb131024ae8907851d987090e0035621f7b3b5622f733868e899eac6787793b8fbed458d9878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c430309dc724a844fe5bd1960ca33dfc

SHA1
b20d846c5d06e5fbd28abcef935601a24c23f40c

SHA256
54b6dce992cced3e9eda22fbbbcf3f137603acab9a54489c2624d07fd1fb4509

SHA512
9abdb0a0f28c59594ab6129c80da4e71716d2c7757bc8c7abf8815af49724ad6c2e0b7d94bbb9d19217c50f5339e2e4c0300e3ae9b12d2db94608840be361a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25e6b7214d7b2b8b8ec057ba26ffc26d

SHA1
ad11add421c879f8ea7f7447b72974e731ced72c

SHA256
80af37f5a62c6a599e99af6145da67d06347310d339304c6523ffa5ff49db595

SHA512
e83111c4733e38a5d4affc66d500b9dc3ea9c7b8a1ea63fe241cea658385e92a494ab39e1d93a5af82bf13aa29602b40219063c73b5181b13d2e2c8c0f796a75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b5866a6dc2746806a0759bdc14be31

SHA1
e33ae680d5190d04df4df20f3de13f850049ee1e

SHA256
0b96bbcd68ce39c74e43e4f41bfed9b8559d41b94a5cf31b998b8b126bb64a4a

SHA512
210c2bea45c545657d0fb7740f5618bb391ff1ba1dd0cadc433a7f68ec38b22654d1c56b2211be9d214492bc8810013cd89cfc7b082e49ec1d2e224348f0be3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ec71cc80789a864ead571ff7ba43c8

SHA1
7c9b7c1af6c5cbb12189664bc3838ed1887ebdc7

SHA256
ffb2b95fc956f88cfd27d504bdc9efd5fee4aaddfc58292ad55818a35e775ec3

SHA512
9a235f7de8af298f3808405473f3ab36ae52e0842dc283c7a7b4975a424a096e4eba066e12b0ed63f247f441be97d68255e67e34aaad30e6b5cf04c754d7357e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8a6e91e0d59954a9c367e7c516df698

SHA1
b57d71164134246cecd3dd5a888e6e5851fd9de7

SHA256
9ceee727494c2ea916ba9830f604d942a56e54605a2e47bedb385fdd90e604bf

SHA512
942f869139a95a9bafb9ce481b24204abe79190865441e86ed80883fdf93097377083b46bf58b04666ce8fff8b8e312adf74fb8bee8de391a49c30a5211788fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
384921214575c3ba6426e6e693c4fe8b

SHA1
9f808e2be7d699d71c897e0c97c85e53dcd6a50b

SHA256
6b782bab33fc6735541b6589a065210eb39e0ee24d284d29cc49c12c3a70fb53

SHA512
b20f914f22965b448e37bb7634caf49fd828d68ac7c7ece2f257def80e8129bc7388b1b8c4c67b46978ac6e86efdd0918bcb74d57c5b2943595fdbd77fbc5005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83c49836f8aa7080c407da9746a1f267

SHA1
821666c92ec52a68a234b2f76f2007785dc1410b

SHA256
a70e585b8afd2936c3cff9268ca6bdd02efb4f073b17594d511f86777c65323b

SHA512
227164120d864d3992aafe24206d70a94766ee22313ecc0597c3fdcec72df7b284a1f7566151c9c8fa06c3129110c31fbae26d680a261868f867d8c1cec3d42b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c1ee8afa893a10c87fa20985a1ef6da

SHA1
7b9d8a9cca26b3416a733890c14901b6b5f9faff

SHA256
088628c0cfbfba7ae223a788907dd4879d945b2329887e8d3829c643ca03dca3

SHA512
73db14a4d858f16737a1f2f13b8edf548b067925f69acd20199d50f0196e1c32b3e975b70c1710334525918116d2c491ee9b5c0454d692ffbfb41c161a9c252a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e067df72162c630df008313e572c034

SHA1
05e27b651658db543c0507924ba505c1718d3879

SHA256
ef6a20e80b0508d19fd09cfe4da83ccf49467a6d2077e71692c5a9f3a6b2e553

SHA512
38540f2e096f0e8e581e0cca6558719452a662c17121168bda462e68927a6a64790dc237c40365f2bb348d08d7fbed9154d090a148b6d8a559a68acb216fe6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47BC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar47CF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit