d156c446d57428117234cbdb17721f56a7fa844e6712e61dad3e8b84944cc624

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0da91603fb3c0cc54937078920e02043.html
Size

14KB
MD5

0da91603fb3c0cc54937078920e02043
SHA1

7a56866aac12013863fcee805333221306b6f999
SHA256

d156c446d57428117234cbdb17721f56a7fa844e6712e61dad3e8b84944cc624
SHA512

cee5fdf3693973383c7c9246c6d25e0690746d05b7af39f84b7cf4033bec71f06debea138ea5d7b7a6f0c4cb998a778b14fe441c289b977d9912f5a57015d02e
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vumlKt6DvE:aioWD/ZmXg8SZQLmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e2be2fc759975ab88f0c49afc2e8388fd5ba436bb56946bc7341afdd7bb424bd000000000e8000000002000020000000dc1753d68b52823b91e26cfe30e0b17163be0dd61f19fd5102c98724fd01164420000000da0812fc30500a11dd3a3facb8cbee40a91b962bca999ab0fadb616d3e4abdaf40000000edbcd7a95ea54eaf85e10c61af69f1e6363c22a09ced69a661bd4f5cc0fbe5da6cb7e7e4c9a43127ce4d36f64f86daaeb213089b07b1172ae05e574bc91eafd2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0AB59281-A803-11EE-94B6-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0755bdf0f3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410206021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000960b64cd24e027344b0e841cd4e66b741bafdbc7ec7b3594faca7808301c5d00000000000e8000000002000020000000212ba279163d6252ae229cb4028ae0019f72256b2f1d771d41064f40544238a490000000dc88359b07c30dfb12ce5e420369e1af7a37b4d557f001b58f8c6ea85aaddc7c49c382a20932cf7b41576cf45a940684be3945bd5744b1e5161d771532623d1ebb5283fd0873bcd7b0ecd8cdc5b6826067dfcc77f9e1319f578f71063edc051f2cd8497692a9a50a726209bd6d3c0d0d4f1d5e96aaa480ca6e19cd0c16b8ed9b311e884a94b36247ca1e4154a1b0eece40000000c5040092a1dc09b70d1196a21d079126e11027c3c58d307762ff210fb7573f14392245cdda2537a54e3d13725141ece26f71e6f04fc36b68db979108cce39ccf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2668	1676	iexplore.exe	28
PID 1676 wrote to memory of 2668	1676	iexplore.exe	28
PID 1676 wrote to memory of 2668	1676	iexplore.exe	28
PID 1676 wrote to memory of 2668	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0da91603fb3c0cc54937078920e02043.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27df05651ba5b729279ea256c2995e85

SHA1
7c1b6a8438def06f591f4bf6573cd5f7742d7397

SHA256
bceeb9602d730c5bbf060738f1ab7bb1cfb6dadbbaeda1ce3bdf0bc1833568e7

SHA512
f86c28d56501de757528f6dc12a21ea39398b9308204967285bd8df89beaa15bc2a9d7e9238829c287587df3f2bdc0f6e4c38346528b50e658ecb975f1859351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb85c0779151ce35bc72e2209ef3c9e

SHA1
9f5db5f51e05dc66d91c30c8fe7c3db01d4346d3

SHA256
7d9c5dd73d1b8bd9c6b4b3f145960137998d31e812d8ba7ab62c528e380f4276

SHA512
8414dd07a9dcd71efbb9ac19d3c4a9ce3489e6a47e26b8776c7d60918f9b00380488aa51c8f0e69f348a05539574828ddf23daf7fb5396a1b8e81a42e9182994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f9e82aadb78aef8f9ee7179d64f092e

SHA1
7bc75ad429ee2487485dd6686751bf9f753e8c1d

SHA256
a0aeceb93726a120face95c4380555443c7f1174f6c565519a0aa7b79c4a08b9

SHA512
3bf7d8f5ab1484049d28d161fe305e4e4f8f54bfcb7778d78256097dae5ff8e65dc3eb0f7b7380ed5b6b855dd3754d37fed9ef4cd7649623dc1cb57426d0ba7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
680876077fe87a22be2f420b7103ae2a

SHA1
bef059299869ac15f01747e514e8e5e5c6d5ddff

SHA256
237f25ec78d3b82b1de107802bd78c66434bc397cc89782c9ba80b363175ca96

SHA512
c47214d0a5c8451015805836d608e74304cf6fa9685e2493a790ef46adfa1649abf197a3c1c74b97e0275d9054733eb5a53d308864443f35c40ef6defe7064c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8044f083935a967ce7c9e931a53b4e5

SHA1
47d684dbf25b43976c2db0ba7ae37492d279717c

SHA256
dc7c913ab0e30aabc34d0177f453228bb99f2871ae0ad10383f1673545abc26b

SHA512
e68eb5779a0a0f3b423d6393cd04a2adda4a55b0ba1341abfa2c07ea6247fe8177e91d766d45a66e10f48089331d3de6808a97d968309941329884d35f51938b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13650c1dbf12679de74473b27117aac1

SHA1
c8c7b2d6341555aaa8b7486a24c7e9571b0d1092

SHA256
aaa8359a3d7799a5199f9b359a4c649749841c316f93488a0f9b8c5b85aed479

SHA512
c2e21e172ec410aa28b004921cc35b315e210b032441a0e1fd57667ee817d297c6037d63370b5d868448a87c97c3d66a18f08ac6644aaee61f7f2a377f01920c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e8ba801cd7697402c212a0bf5becf8c

SHA1
57eb2d48ccc9fb66c59b8082867546fd07ecebdb

SHA256
aea9205c071d8a40042aa5f407219799126fb0dc22f939e098df155a7671c083

SHA512
0cc944a3455f2f270b0392f8c7fdb9e6bfacc7db3be8dec713f50a40092cf91bdb5b282a38c73684a627decedf16cb6b5bd71196917f50865285c757a1f6c095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fef4edd754777a6651964a5aee4e794

SHA1
683d194d7907c64ad5d11950aeb1c188aa3744f5

SHA256
1e8104013c91d9b621ebe1325fc0312df2d19d4a486e5ffbe053d0a6216d82fd

SHA512
e1eae026a2d66b57a37c656c3d4e934b379233c45a0f4a2f374140571d2786b6554e059da69f74801900cccb3b1af44187385bee7320102e816dd046adcaaec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90b58fe258dfa703df2632d37cc32feb

SHA1
e9814865b694874345fdc002db65e16f398fcb15

SHA256
627f93be034f9c006990130bcd180968bb89e2a7429c3d8dbd863e40893aaba5

SHA512
f0b70de055538b42de6601a1554cb5bea8a7b33ae8cca6844a43ed49e7b20283f58fe56aa46a0ddf7700c447d25d5df2dec5398c72cee4d29f97c575e15e56d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24fb6fd64173a9b5e14b0b8b37127a0e

SHA1
ed3b0928654fb2702cdf6385eb03fdc8c6319b85

SHA256
3343eff42ac11b2dca8381a44619fa98d42650c0ee7fc955b8f2fa8159c0fe65

SHA512
11ea48a81461a5502bb7b9a44db56f0ec062c0d7f43266bc1c003c7292c18c2c2e81350b55fa264d8d18814473baae603ef75623c71f186033f292e83a2f9b4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eff1b3a684214d152e9cbc947ea89d5

SHA1
8a97c9a0f7130e6b2aaeacc74713267b342e78cc

SHA256
5b52b36da5ca32430673cd1c147d2f5f76a34853324e2a7dab83b1e61c556f43

SHA512
5d7d0a7efc5ff8191eccd4d2063486f177bd389629030b8592f24f9256709863c3a112a6baa6af1a584e822f7810ae4f1e26213bb885a82652715fed8320906d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6753fd27fe9e4d88b5602d13aa909fc

SHA1
4c0f1518ca48a2a83024a1b22ff2ccfd505fb6f4

SHA256
5e3ac5c51e05a2b986c20579ca0dbc85e2ac77ffcb0a6a8c19a87a461cb57a74

SHA512
056d97531418e5ff13a9f5ad493067d4b7d0dd52247b089b6b9c34a42d98d4c893a80c265784c17998f1db2cfa30687e2aace435b1656251b934ccb77ce4e62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3891.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3930.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit