b74beeb9757941ed0ac36c3dc61a5c780db370da42b8e87eb0aab5ff3578015d

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ce46d6cb01086cbcc813b57dbf9f8cd.html
Size

6KB
MD5

0ce46d6cb01086cbcc813b57dbf9f8cd
SHA1

943cdddde9401a74fc5d420b45048cc07adb55c4
SHA256

b74beeb9757941ed0ac36c3dc61a5c780db370da42b8e87eb0aab5ff3578015d
SHA512

f953558b88b5ec6a854bb4772d18b927e454e507abc0d91e2a6f0af54d0e57d3f996985411fe148b7842d5db1c0c54edc828502ada94ee0e7f32d8a31af4f5b6
SSDEEP

192:Zy/O8yw4RlDEvHLgszgAMLydXDChxiqEuf:8/O8yXRiLgszgAML9iqEuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d98669fb3f977d83dfad41e55f70bc5c44973092fafe81906ca8d38ed6855457000000000e80000000020000200000001558df93b6b8499ecee6a5d5dc5ddbeb3319348c77365a829f50caf5609b7c2020000000ccf92a8fd1e481469788b5ee7a2c254bb33bfd1d6178e855ae7ae2f81d1e5b9c40000000b4e6171730308fc687671caf4b7d5bf04ac168370ef8c2b2a07a8d5e4384222c10bbdaf365264118401e34ef273e0cf0a2faf077e8c6f925a352bd2e02927c51	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7034a0d4fb3bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFF52131-A7EE-11EE-A5E0-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000fda594ed278e0d1bcb0306b198a6fe62a19108d47e22787de34423c2e82c734a000000000e8000000002000020000000a89a87229d822abb6c7553f31df1450c314dc7de11fd80758d33e903b48270de90000000e2562585b11987257a6c6495101ae87b044858e1a3c9bbec57f8f39a14392dd3bc0ceaac88dd5a03134c5544c2107b3cd13640a931b1e385a6815a0894aacdaaadb0b1b5d58f771c10f5ab16bf1212b330047e6feb986f1f6bd1a0bcd375ed75c751bd7492f38365af74e4b74b3d7e435e72a22002e88f06a17be7f22be4c629ad30ed6440baf0e726c4790efa9cc84e4000000003c219b770736dba55e4d4fe9d864a8c36f513dc5f69467ae35a10390d5649d621da390832a0236d219757593b13bc2bdfad59b2c7d6e0d68fe8f70865d27049	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410197413"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ce46d6cb01086cbcc813b57dbf9f8cd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f94fddc35b632d99f0638f04aa9d867f

SHA1
ed68bf724e7019b2afcc8cb3f9a2ec74cc4c9ae8

SHA256
c5c829c0ebfdc5c6b4f22a39c612ed16653436ea6351c9524098eca701a8e45d

SHA512
5c3a84e9ce0fe5752a14f86b1b3406d800a65ac2c18152f41161acfd9d330e47976495deaa419f28792ad6d5a95a0c3f36fc4d6c9a2714d6215b12483e0c3bf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a239e6bbc12f9585da1eca6fcd43949

SHA1
d648b89dd35ceb20c4a2eb4cde1162c0725890aa

SHA256
4008be52745ca7e769b821f396511a027aecc8f502262bb9942fdbbee7c83921

SHA512
44ce25afeb70f3d9c3f870c905b8ed01a3e4f7f437d1d4fc733bd50fb55af434e2a631209c6863c356db7a898ef03b10e6e905f40d5ebcc1b3a0fcee5bac4c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54c7e11427fca13776e01b2c2dc27f5d

SHA1
fbe4020ddd457048d6127f82599babe80986db3f

SHA256
24c54451275b379619072b20115be2031924df5a34a0cdbdd833b6a3708f8176

SHA512
e6191eec00bf663d925e262011296a30d39586001c1cd28294b3b5b78fe1de9150f0528c1d7ab9493bc93d394b50d641a8fd27a4b235f3ed249f03ea2f94a05a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83e54417c4da729fb49bbcdd54945007

SHA1
5846a9db9b43aecb195af1960b1da0d4fdc7ec6f

SHA256
66152935d41734258148b1685e72203ef4bac6b31a176735fbfc09b172626c8b

SHA512
fe1cf73fbc74c2a5065c62a3172434cfa780a792c22192d3ec0ef3cb13238af558dd107304b43dd36417e570f6bade5817eff4d7a3868af83272bd58020c2415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b76371b02d0610b9da98d9dcf4a787a2

SHA1
e76c0777a6e4b7fc7155b5037eecc829680d8ad6

SHA256
562c7d7443e4de0908799df245f86e7f184ec55e7aad8b4174d43681fa535828

SHA512
4c04db3b7ae3ce1bfbbb42a8533ac80518f597bec82a56ad681c3f31d4e785cf124366c23b4c6b8f0f9b7cefabbb239e347a7ff0ae0ac2a34655729151699e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd51f42127c29b938a79ce09b5c537ae

SHA1
780735c6d04d74cd21d1ca3d3fdb949a816dcb4f

SHA256
91fbc15989571b5c755ad2d22b2e60b4db407413cea5c453b81ce7568006ca25

SHA512
6cafd090ee30d5f28e4d623e8f63cb0f4bf0aadc32dd4d8412aaa106f66c6d4db0eba9de8a7ef24630f9fa21ecf9d14776436f575503c858495f3810c07410bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e1061a50cc6659b46f4f2939d6b314e

SHA1
c2498ff29106e5a1308d403d4103f6fcd2ce51f3

SHA256
a521f5f9e18da698292b136f040572d8b6113554180181b61177eea40c368103

SHA512
c0821060637e12573b704e5d6f6e03cf2a28128888aad27dec6b393f1e2650e195518dd8602c2aa43f2b3c8c17512429a71bfb85323996801234dc15e5b73f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c01831c4aca66f52309f35dd0ad4ba85

SHA1
78b90a32e85e74dfcc686441a6113e2aa18f913a

SHA256
e505ba848c52fa206449a2f4bd8e5c726fcba876a715585324f0ac15a940f321

SHA512
d1b4f2016e1759a3367acdb55abc5bd44e739ffd2d1608222df79e72224b01e7b3b751e775843a0ceadde2ca29d66520d0ed20c04724fc3e3c94c6ee73bbc5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa204399f1b599dcf630d7c8e8b7ec95

SHA1
617c3c3752de3da76406645022bb505623e56b38

SHA256
5b9e502008fc857052d83bf5c533ee0aa473ba164bf22236f1a3e1c1721d1c47

SHA512
e0b0cd2900c4814546eaacc37660a2f93d32a3089bfc316a4506b3435e062b66ac2fa1885a29e472b69eb20541953aca5a1c1716ba11ba3533ced98169d2ab50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5824b0e491e81ca7f2b2e07d74771a

SHA1
b30ddc5d0dc650b073ddb598cbf33beff64d2601

SHA256
05db0d08afd69c5fdf9411a64c0d84ba857594a63026de30c3df263eafc2ccc8

SHA512
a45ef69d6743753e52a74f80662421a1d97ac17f3afa140ecaee4e8834b044eb32686f492dbb7fc85ed53dd766797c4ae91b5be9036313d1beda5790f5df44cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e67acd9b1ea350ca5a97ad5ed493eb1

SHA1
1d8f9ce7db86c72030f4752a3b7672c09f208747

SHA256
6f8e71f68f0b3663fff61ff783825d54f9149cf6cacbe31a06e4dc3d418e1905

SHA512
b1244ca84c7023fd32033da8e546079b3ff51e27551f8c7eacda91306c6978328e9d181abfefd4ded333d9760b134fc3a9157dd11c246f8af2350ef3d506bda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28a48d32593f1b57a223966c5e9f5fd3

SHA1
43e156a52183c1cc57c484ade32b2457a5e0b239

SHA256
c644e484c56098cc5515ad74e7a3753ae68b6ec8849994377f6f774c737c5cfd

SHA512
78e32ba03ae76c914580da0e871d7704a66652ce8af6cf9fcff526fad650abc94182b57b066029c462bc3f7adc8fccb7ad3cd52bba8b6f747950a422fd38b736

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab346C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar44E3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit