404a1fe935cfed35dcb2ab61dde6e36adabd336164f2e0586ce55b7666b37047

Analysis

max time kernel
122s
max time network
199s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dec1be856011e85f9afe8c39c75aa04.html
Size

104KB
MD5

0dec1be856011e85f9afe8c39c75aa04
SHA1

43e60d0298100699cf601b90de0589933b9f179c
SHA256

404a1fe935cfed35dcb2ab61dde6e36adabd336164f2e0586ce55b7666b37047
SHA512

08189461432f8a1323ef7c7fb46b25a39e0174395a005899a05e0c2bd192b8d81876a9ec02119586bfc3bc2a323b41800b7f4f9a1165c03c0262717dd2116ca5
SSDEEP

1536:twfyOLhSUl3x/whenL6JuCw46TrRKznd5azzt8k9NGIkeloz8d59pg:twfymYgtGT3azzt8aNGSloz8d59pg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37529381-A757-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000983d545466cf690ee5ed70ebb97df6b8352e4276ce55abdaccaff8b426462949000000000e8000000002000020000000d08b999bbea9c8a04d61f70e3bc1abf7b4897a83fadf478bf9521a0072a284e720000000ba7ece2d86b58604dc6595e2e050947f74c0607be2780a0b7763877b5bcaf503400000004dc4065afa8aaa8ecc1672a866e7176c08dbb826e84f746cdb269f25f461ee1deea61f870dbf8d481b2d8d0068f54aa3f866f3cffb954a50d416a1946e3482f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20741d19643bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001aa62aa5e63bb92c402bbad83406e9bc4b843774a9132aed107c8c4a3411b59a000000000e8000000002000020000000be367c59d342d90320b50f1ac7bdd7b02a72e2662e63d79c77910d3653cadf889000000054f99f11d1e783b0074765040be15300aa4437bbf87368c9453b85aa34073d672c39f1121729d86ac8d44b9f34f79429ba1baa41d834f8b8e9a70a98849387b32821289a39f5be0ee203470cb8098befef95abd701847710f8aae4e54ea9aa639513e5ed95167b7bbc921abe63c3643e1d0549af2baba88c80710595b69095cd94edbfe13f94af18cc5766e04db9ad7340000000fd4119d69d2a5225141227ecd9635a8cfe3e6e4d853537725798ae8861918128e73fda3097c2c1f9fabe16d19be4938ebc12122bef60f8c90b6ed18fb8410f95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410132237"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1788	3060	iexplore.exe	30
PID 3060 wrote to memory of 1788	3060	iexplore.exe	30
PID 3060 wrote to memory of 1788	3060	iexplore.exe	30
PID 3060 wrote to memory of 1788	3060	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0dec1be856011e85f9afe8c39c75aa04.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9105dd3644284d67e4f0ee2e9b805038

SHA1
00916b4d1f074b31103c1cb98d403a38967a5695

SHA256
911070c1892238a848c99a0f840e961faf1bdf07fd8556e445473da54f106365

SHA512
df1aa0cd66b24392f8afc624af8bee43e976cfa67c07182f5372d76b121f5ed1c533f5c0c9d2f375093852c2835b14fa357c8b9f2c1ae969a4e7c473c3d04a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7d297bc7978824832acdf942a51a0f6

SHA1
b7f5b3bcc8236a2286d250b972b4cee8fb55d848

SHA256
4385d5455db5cd545d7183b121a3265f509334a072637ab60aef8359113bb25b

SHA512
659f13af483074d7eb0c4133dff63c8079bc8a9fcb912189ca86416ba6dd7e8d0c776f5d659959c83ae51381c7f8663e1124a1f394a2838fcebfd4a90165bb54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
166b97bfd193d26b4e8ef02e7b08585f

SHA1
d135bc3a7234e9caefd105699617c3d37cefb018

SHA256
d919dce5f01fc4c063e9ac5dfbc16d3743e4a8a4bc5a2dedcb8e8d48b3a119f2

SHA512
96af2d1c93e4f066a9cf4b4ba18e83ffd40031d0f841ecd571324035f0e77844bfa35339c275b4038f4ad3e3a1df8a3d5fb560c7b9c0a0555ab3b1219771ad45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec03e7f174bc759f8f8a3bf7bcffa2d1

SHA1
7e57fc7a841750933a4d11fd2a5d4babf63e074c

SHA256
f4bea34aa91103598d828589988d35a054330db00e347b0e8e443c87f26656a5

SHA512
5fcb64342d1f1bcd524c71e699d20b79bc797640aed9f42f4a4d29de6d5578cf0bbf5098e5bb9b1d0d532ed63f9ed46aafa9519d66944b94791055a4254e3d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed2f941a26b031015bc9306ed9695432

SHA1
dfa59d573420c584e809b2777d945003e60c44b3

SHA256
e3629419e4ad65a39659646ae02db77d8a46156dab27cdefcf9f743100da6483

SHA512
a9895b184c421d3fa6909f090d10916dafda567e9d2a63eb5579ea421c4b61a219b568b1478e37ef9f3a4e317ef360e2d3b998a57662ccff7279f1aa7658c6a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc5a384a7a080f9748a1cb7f90b253c

SHA1
5903ec2a31f62b4dd823a72681abb1c31ede22a8

SHA256
f7405c511ea45c5276e986bff97cd4665d683190ee6b0d2128561b3174d459a1

SHA512
4b8c69771d9a9d73566e15c8549946994793e7e1468f0b570b4f8b0f74ac9aaa8af19590fe21b36b1bbc09006f622bd067592219be1d942970388b7185de6420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a1b9d4af4980b3d02b569066d8c2973

SHA1
4aae6ebfaee6362facb1c0530335b65a24430f49

SHA256
57b098b93729823ce12fd7012a6ca20e1704ce2124d77048c2931184d3cc774b

SHA512
c8cd1f9a2647bbe2a818259761432244f40bd892dbca9583f69a8311c898a63b08ec29d6e85a3a792b37081f756b37537df2483db6e3e7104004cdb876dc1aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892b2170fdf369fd8b9d4a842e53e988

SHA1
a8730b9bfa9dad9e54513a3f6335c5bd2f6025ea

SHA256
d038ad116401082187a52ce828e4c1b02f310ce3f9f69fd8acdde8ef33c52e25

SHA512
0658bb98981974646187dce35a1cb2a7238aeb1315dd0cc9282e18dede757be4a0e66e8b9310d69998f64a70c9bdeef7fc549e005027b5bbaccfe4db8c3c0d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35734a327ed1a0d01281da9f16caeb1c

SHA1
37fbf91041ebf44128dd48801a353dacd1bf804e

SHA256
de21868198604fcbac2df14ee8649cbdf3f27ad14093e16d719e8024b693295d

SHA512
3dd4a45469034d42bb85e03cc0e75fda4a93c0625e409d7bbc5df888bdbf1fbb9d03302a07a9cc9df860b1be77a65afc104dfb53632d0bbfeef1f16aec6f10cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e91641bfda5a92d97d451c0dcc1967f0

SHA1
2140549b6c0c8f7c1c09dfae7f154b730eeef78c

SHA256
72c206ee3955f946d55222449beaa2bc6042e4f76fc018d3498b1ed425f75ab1

SHA512
3289add2d17517662444bc9a4924d8cbd912678d7e65574a7d4ea3604779f4795cceb72715ed1553bd4e38779e6fc79561b43545e4e74157d5280abb5d0ec0c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfa3f9e7533a7b590a2703ada88a6173

SHA1
b295212e32c5e576fe12b7efa854cacb18e1df4f

SHA256
21a04ae97c1d5788fe1cd7a6ab91c5b213eb13883f358545a5123ba5dfb5482d

SHA512
bde965a26e7db54ac8c6e1aa996f9cc46c88078cec774d29e787aa5b866b6f1b7ee3c55a4a2002b4178eb3fa5b0b9063633a243fadf1f09d8f249e25ee510aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db62bb309ee60ebc570d64d310063bb8

SHA1
302354c0b6a4a966893b2ac5c01145cb9ce2361e

SHA256
309847f09c2d4f2b4beaceb0cd5d074439ea4f2f5e388069af968c9d412d79a0

SHA512
ef1f778e20d48d5299434bdc3d06ee3f3b6ad306f145addf5fd0efc808a54f4944b636dbd1d0b98e01c97d7e9fcb200cb2485b8df54f85e5bd6482de061965d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BEF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit