0cded98cdb3e0ca2726b3976db9b171d024d7a5b87483a96d5972dbb185ff0b5

Analysis

max time kernel
121s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ece18433b7ecdf145dffb6c5667ad65.html
Size

25KB
MD5

0ece18433b7ecdf145dffb6c5667ad65
SHA1

a8e9cc5857a034fa389e3479f41dd8472177ee49
SHA256

0cded98cdb3e0ca2726b3976db9b171d024d7a5b87483a96d5972dbb185ff0b5
SHA512

1787cb57fd2651aaa3ae551069e9f48a393ea63e6fc7ce8387b8a6acfda68aff9062c50de89fc0e1972029f440ebdd551cfb8f3f2f9cd88a7b9096f256e0978b
SSDEEP

384:1dg2H8oM/GwV9IftkOUtxKTeBfKTp23zMbApLcLgWQQ/U4yhoy7jfIWrYc51IlSs:7g2HlM/JltITe08DO1NG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e3e21ed0c5510844f4818ead4be084ad6b7941e5567bc4a26e8a05920f9964b5000000000e8000000002000020000000e5af448ca090685d5f07918f24aa810704b23e704a0627c55f8635eb91dfc90e20000000af14637b32e1d480a1cd56e5191233f10e0ddd2ef1247352955c6de93eec82d84000000091528e2cb375949ee727350abb33330974837bcda5f21e04772e47f53e7a141cf08161024b3a73399854e3700effddd58c0b67a64708ff3d5a2d06db5473d786	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000017ffbda4998bcec9105f2630197749a436a3eaaacea905bdbc40bb8077f7b1ca000000000e8000000002000020000000ef6ee136e984304900296bea82e3f41849e8d25ac1bd10539ed1d45423a44edb9000000061dfaf5b8815e32c27ed9745ddf53b11575efcc593a5b20abd868b08195e5917ce7c3d5f615e3fbd2fdae96698d2b45125c3fe7bfc0703c81531bc9a2364f9f90b4d1e5e467a80c9b0761245901750cdadd74e0fc7ee4c8f3f78fcce0e054d51a095df8e112b46bcc80ac38f05296206c3cfe6d5c4623b284ee7328d5e1ce093ad2ad4843df51f526b20ddd2559d961a40000000417819b070e38536d8d4db747dc32e64411e864c326d1d3c53519eb6d71d8e133683013f2f8997e7f550a01b9e20d896f84bfb8fb7d466ee8d4411b0819fa419	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fc9dcc713bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410138132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7C587F1-A764-11EE-B1E2-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2656	2112	iexplore.exe	27
PID 2112 wrote to memory of 2656	2112	iexplore.exe	27
PID 2112 wrote to memory of 2656	2112	iexplore.exe	27
PID 2112 wrote to memory of 2656	2112	iexplore.exe	27

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ece18433b7ecdf145dffb6c5667ad65.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ab8d7026e239c6afa43a039a347136e

SHA1
a74d211294992be8742e5d115ac5cdeebe216c3a

SHA256
57670723b1cc63af1ebe316344234527672af6c724d4f9a7b272a040d0fc63b9

SHA512
11c3b767b24ab0ef169649ac2d42b3cec2e0e9a81407d6fdc4f9e0973fc128ee0c8de875450f963fd6b6b6b70e38bbfbbdc12bd67d308748968903a14490497f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e3c6cbb9d391a6383b364b0b93108f

SHA1
9806cfd2013fb201d12ed3ff07478143b2c48abb

SHA256
00fb2cc907341e53dcac13f5758af605f68a5320b0899f902f1510f94f8adb52

SHA512
ee9f58c34e3872c67d5ec9247be827d34895ee09328bedf30c3779c84350ee4ac0bda899f7e9c8b4b3b00710e985f5ea0a11efcb490cef269d381d9c0a09411a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50dfa7bf8120b4ae411e357ff8a81365

SHA1
14196f949ea0da996009825270fe786a0e359e8c

SHA256
937a5b3213162f0f22a84e68f76a138db3981c7f677e189fbf8a9a81e48f1e58

SHA512
bd16f976f3d2efeec7d4f2540191e93ee12cf1f3adb5c549870a3915544be6bd1afc2b27b29e3ebdfc5f6fdb1ec86b732be5542b079ad6db6116188242c77dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5648f2ab9c96144aa4d9b9a0777561c7

SHA1
8a660233ff1a2a549147b396fe7c135fca9c72ea

SHA256
52fd8355d88d44f69f02167dc410f3fa9b41f8b3dba0b7c05a5d91c9281cefc5

SHA512
6c50a79a14833fcd7ca991a14a3131928f008da78ecf2cab3ca8aa9eaab85dd42b9421ad568ee6dacee901f9c9b5d76bf4fc04e2c42d887f1e4e730d5a423fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf815454b1015d4f4db4df000ebeccc0

SHA1
a1a504a48d55e708a49df58c294b1f7a18bad4c1

SHA256
259c34833851e87751bbd08455a21f661606095896f0fac01fdd587ba43e4641

SHA512
ff71268d804a70f7b9c42c4628ac4bb331532911ab22e243e4af60f69f5d10f1e4f69c0bdd46045549b9cfea98bf4886a9c5cfbeb8a0039429a0099be4d27959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4048899a70d3fe32992619ae277d90

SHA1
f07f0f934e66a2852bbb7a60628c14e7c9398cd5

SHA256
068bed72a22f58306e757ae96ab0d00981b63a6c2a6a9682b16bddd8662f3b86

SHA512
601c6b46ec1f3cc596a0b35ff009416e0d4449b2f6487668b9d3aac9e6704bc248134d7f850b5cd2921a2dd3c3947cc75fd50d96c9c4aa7697789c8f27d38b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA5F1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB293.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit