78784ea79aecc4a45353f21cff12bdd5006856a3978857d66e57c079bdd8c1be

Analysis

max time kernel
77s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f1a542fd76dc68f0024a44c39d69139.html
Size

4KB
MD5

0f1a542fd76dc68f0024a44c39d69139
SHA1

26516ba86d7410b8a237689593652a2871b0cc45
SHA256

78784ea79aecc4a45353f21cff12bdd5006856a3978857d66e57c079bdd8c1be
SHA512

9509031a3f8c56446447306dae9e3e6052a7b471c6e1999ff47db942a1271ddf66ec903d1da73df3ae3631e50d93c63c7e32125528c71a6a3b1e6f2bc13168ab
SSDEEP

96:NH7/veyNtjufSxxe47zq9w1AH1Pycoi0lK:tLLMy1K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b662ef383cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004183f4075d4f434c9fb8956f7c3abfb56224af6cd03f93b95eb6e9d1a56ee55c000000000e80000000020000200000005fab52e530929cc9867e3bcbab52a4b501cdb6d68506723fb52120a5beefc85c900000009491065eab0f3f30bbf980937ec73b920eeba03ed00308fedad1b99871e3850fecc28aee01d08bb85937bb66525c1b23e125c65488565db417d580ab6f53416b579fd6583302335446c0329a1f5de0aa6663554a175f1ad83394196bc48d3684ce7c098089545e4f3b9eaf5f46ceb74513b4d7f7b4f93d2656de5ffdc21c2b9e517dc3547f70cdb15805601ea4b2bbbf400000008aecf0077e1f4abeaf4145bf0634bbdb2ae4222d5674b96fc7831ea815f0260a24f7a81546f13c63dd46f36026277bfd8ebc77340e681b5ece3dcb21d9b98429	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A1C74E1-A82C-11EE-B578-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000003e16562a38b52716bc2c3c339e7727f438bf723eb88b3c2b35dfb2c7e8e30509000000000e8000000002000020000000e4702f6bc009ee05571d32ee94752220a7efd402dbcf9a9c3855e544ea44911a20000000058b8cba5b683833e7f20b0a608309017ff566bdbadbc97e6641f5975fe0c0c240000000a26839f188d1a1fec3e024063dc70ef73746492fd6fb55819f935be0bc190732901ef5d7cf6f9353c97011089d5e549e5b79d6fa1676b50ab5988cee14d88fe2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2912	2012	iexplore.exe	28
PID 2012 wrote to memory of 2912	2012	iexplore.exe	28
PID 2012 wrote to memory of 2912	2012	iexplore.exe	28
PID 2012 wrote to memory of 2912	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f1a542fd76dc68f0024a44c39d69139.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c8c3801344d0c2cfdef4a603f6826c

SHA1
ac0c7178a355d9d1ad37b8ba4eeb9867c0cb3579

SHA256
d1484c322b065c8a5a503f14a6f163ebb4e24140e904ea02e9e5e62bf7b6b661

SHA512
b60b99804dbcb9575b17c7aefd19987fb6b376d012a87d045036f5f8b7e6e8685acc384b6ad65fa4feaab81fde013b0776cdd3ce85e792cae197edea9ae9a4b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3340ef554316bce1275f322a88fc310a

SHA1
edabfd75dc8f6f311c2e4da5fc797cbc841fda8f

SHA256
c3727636c9b5227bd44ad20cd961491be5a0549117f7fefb98e6f3b7f70b54c5

SHA512
602bb92b1074ac61610e223249c6c688807917df6e4af91214860618a80da57adcc3357cbf4deb95cac18d86638eb6c78746562a18104495058bf635e29f6a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
980db9526956fd10cfb5b3b5931be001

SHA1
324fdbfe08466e26b9510acb0aaa38d7db258975

SHA256
a9710852f8cea4b82074dd7a0455d180a26ff5d7c1d1d001dc74100569ea2458

SHA512
8bdf8aaaba9e7edb8d3604928277042c06180c0900f536c2e50fade96498c82efd468311ebbcd3b1044f61495b69a340af78010824967f51419d51e9fe294274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78ac4c00791f9017612fc374018e425f

SHA1
52521684acbebc2359a3c181503372ac2bde31d2

SHA256
abe5c9e7e8b1c3811b80d6147698e972d34ea8da59200a882f168b4d7364d484

SHA512
b0ef20b42286fc09731feca57e2e8cc4661538b9b78b9d0631e7edc96770556813f84d999ddc2a3f98b6941b6c2130354dc111d76e6803d7955efd882a59aa6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38380d86c8374117b48b12a2308ef267

SHA1
dabe88810f5ef6192f187b0128ee6d0a53f574ad

SHA256
2ab277783adabb8f914579593be3e7144e972477bb86b08d428ffcf0e84e8295

SHA512
9952ff3ea6adcf15d9589a716bf95b4203b6b4349ad1cb77a809853b94d0a7d4550761446ff65d65a8cb464067dab8750beb1146017c3aa7aba64d40131b2efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0df09b0678e2b4af1821facf6a767e6

SHA1
8617b28462ed8a698a6a78b7ea87e05a1122b0d4

SHA256
9d5788356d2f43bf66ada7386431a6174efd6eee7bf0c649654035538c058702

SHA512
a543f22cdab63f253701c81738f6ac1f64c54008f9925904f5cab1bf1958c4ac13df2bf6cd53cf57700aa10bcf58d11e878dcf883d8055dfc52f9798c0d1bdc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810d38af148e20bb4663cef47333cca8

SHA1
872973ce7843165bf119c2c3b6c286d5e9bfa99a

SHA256
28658269bb9424442ab5db907ebf335c1adde737d79c0d454b31b049da618911

SHA512
a0d48f08be3c2905b6d5250fddf37a9e441cb7313bd4334580efd63ec0e7b8dc942428f423cba9573c940e0b6eb46bda64f7a77d6f6b7fb50674b73d54ae98ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a3937c7602924585529fabb404d417

SHA1
3858ff32349ce1299265eebed40931a056110ae3

SHA256
4f6ca095bef5eeda0e6ba217b8cbe19680670f31929fc1fa227aa3c96cfc4dad

SHA512
3c830b0d9a7785958b08442299e162b4d8012a411e784bd4ffcc673424c9e084a8ff203edc8f3b42efd9737a976f28a388bd55dafff6db260bcb54b117b26868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
992c7bffc7f4f649e9e40e09d9eafbd5

SHA1
06fc2294f427b65690e92f16179d966a63bc7178

SHA256
8d2133e3b5ab86f36a138664f5c15a9aa343565103ca9571207eef0abc505395

SHA512
8a956ae753f2aafdd69d668996f404581ec8dac0900940d773efb1c0f8de1df409817ece54ac1aa158246332ebe181f8c52e4be69dba28ada58807654d6aeaa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b43d3a530f5da0315116bc7d23f91d77

SHA1
7853605715877c6d2d01d640bad4462b803b3a87

SHA256
1b460e410a7abcefe47c8a749217f1c3857457a1e2e3972de1e57557ccd29d5b

SHA512
df80f1512f4bd59a8eacc0510aeb4e739bfa380985e7e882ec1f835702e1b824057041b578c70bb48b6c6c50cecdc9f3b1524ca480874b9606fe9791b0d7b9d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
384a80b1a0481727d7b5baf8ce006d47

SHA1
d874339496131f04816595fe9213f9fa16bca94b

SHA256
457b0427dfc1c9a6032bbbc96802465708da77cfbf58449b8d2a68d95f516823

SHA512
b9f423e27644a2e41fc241fa7d9adb48148403bbd57ab66d77a93fd49f9509dc40a2f79c56fb1bdd36f1401afa39bdf44c2760caceb30d068c8d9bf7f729ae8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA749.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB0BF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit