c17e3f21d4d9d46259da60e56c1d6546fc081f3ecebc11e2e2f248fb3fc7365e

Analysis

max time kernel
176s
max time network
180s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f1dbeb5798598c374604183ec24cee5.html
Size

9KB
MD5

0f1dbeb5798598c374604183ec24cee5
SHA1

5b633b61f252e5b1ff773c986ad28da5a9e83928
SHA256

c17e3f21d4d9d46259da60e56c1d6546fc081f3ecebc11e2e2f248fb3fc7365e
SHA512

dc8478abc5aa89ffc99bd6438e98b1728f28635b52dc74ebc79d33e6656d8c0eb6160683fa17e1b199053d82001ab85743351c844e86d7842e77e64b7f86ede1
SSDEEP

192:M40c7pNY+O+C+q+nLcd6uioHszfTkGLTKH7rmy8CHMnj6oCJJPyrvur:M40c7pNY+O+C+q+nLcd/ioHMbkIKCCHB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64E68651-A769-11EE-8183-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c013ec57763bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410140073"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000cf75c4311e6105b8054051ce0633009920f350f0ca815c2d55ceca2d1f248a69000000000e8000000002000020000000527b9731ef53535bbdae5e86ec1f6757d23213204b9e93c3996a84ff34188524200000009b2df48fad71c6877ddc7e8d0bf5842abcdee207f6d73e44fbc987b7e9cda230400000001c56b169b87b11c5eb875611be8e5f187d8d522c270633d96a331bf4c91f5f4c9c260c0e7ce94d91db4307d34353b7578fde8cd11774bc3ae819467d657faaec	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000003145a202e2b9ef05d38807f593f6c7f53d8552fc6aad8aba9a3938686b2799f5000000000e8000000002000020000000117b90d7618a853b7422d4a825a4ddbbd7d3756c344ea677e0b3eb4f19f3796b900000009be5d269df7236c7db26da209c01df9d603ca72d6140fb5c152c5ea0a96bd19f6045debfb9617d436c07eed83ce12de4bfad431318191e2566bb4df94dcbea57f3be5497d9491aa10f56ec5f8815b9cae7f8f1d982314fd6de3f0c66a598be2e011f1e586a0b3927f4bf608cb630d13e9ab6e31ee5edbcb7fdc097d53b5fcda98b20c13bc9ecc40163b26df777e7f91f40000000630eacc12a01d7efd03110735d547df9bbc8b20bb237e5a3284ea06bd52bfdb0631dc76a20605a94a6261dced872accf8126dcf48c9d2507628ef5dfb78b5dd4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2296	2776	iexplore.exe	28
PID 2776 wrote to memory of 2296	2776	iexplore.exe	28
PID 2776 wrote to memory of 2296	2776	iexplore.exe	28
PID 2776 wrote to memory of 2296	2776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f1dbeb5798598c374604183ec24cee5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
444796c660c3184cc02f1b753e47a40b

SHA1
b689414b8558ced07bde19ebe65f36fa7800fb0d

SHA256
f5587c36bf2b2af56e64e53abdb815311d91f8ff4b1e3eea62d49bc8ff4fc4ec

SHA512
2c409425b6f685e0692c6475d5559ed5c53f50514063d93857def6ea78439c4e550421fef30037d1e4aecf6b44b6e9ab7e4e5e79fc174c7cb1a6a16864c9bf7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aa49398f19df894e8780973a17d84e7

SHA1
fe9e367329750ef479e161d7704835db29393af3

SHA256
4de58211f2522a1f3444fbda7a2999c8f19970aee32fb1a40b14b6eab3afdf5c

SHA512
7d52c3c8634ed10525924388c64dfc4d44a14258799ccd11399aef629e4611958024b7428076b5bcddee8f8c4ad4d05c2f7837a222c82f77be526153889bcc9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0090b7772c8714207bfaaa28824930f

SHA1
fd0366baf2e2657f812d57f045bcc52f2e75edbd

SHA256
d5cca8653d454eea80cad8d225a2d0d2d390ceccc9cc5ec2d06bf387fb345edb

SHA512
818a29550718222db7fb98e756c3ba2a4ff94b3812f70860ed801beab2aab1cdb7f7b51ffa0568e5a46dfaabefe8ab829d289da4ececef943d58a62ebcafc986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c11080c74f3d9d809e0e311f42086146

SHA1
44b26d68550be0e20fff630a0c886504d9eb6085

SHA256
f312e035a3d2852f84a31cf3f2a887a92e75233435bb4fb454af1dc034073919

SHA512
c389020fef8d0125c6e86ef306afe1abddec9855b1f3333156fb22e79dfe4bbcb657ccb95bbb10699dde82da847de3723c50efe7812ae4ce937836aa9fe84592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e75d99db639b494fb119d374d22f0847

SHA1
7b59e69f18c8cd99e555283fbe035763dcd023d2

SHA256
3d08a4fb73f35d6dfd2f6115467414fba991e4206f0da584aee62bc53cb2247b

SHA512
e5a046d18a6e608a493deef05ba40f1a16fb3a2953bf78a42da513c126249cd54ad791d03a5d378fb0551348b54914ba848109605a10730d87bba16ae2fe4364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287b04abc1b5b3e9ebf425759f1a0fac

SHA1
2842a642ed58bf6874230e94b8adc40432280716

SHA256
bde0065bf3105ddf76d659bd44396b67a34793243881dad4489d7e3e3b789e41

SHA512
48d157200e855f80869117c3fd7faacf2e5af385cbd896a4a01d5f2b437dc091edff9180221f5bfc1930f4b932de66874992f4eb341d4db42e4f2ebe181eaf76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1142033004eec278baf08b6418f7a99d

SHA1
a9cb7a0aa1c8189496cc6d2ba7e74fcaca0bd6e4

SHA256
c612f1743618cf64184d5d8d11e9930cbc6a3ec286210f1f6f30c7995b9e0653

SHA512
588440a8aae688480326c849436639f7c46ebd914cf1ad4d8af40b4b94b43285672fe6bc359a2356b88b60d4c5cc7c041af5ad983bcb1b7b1c519298b2fb4649

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC248.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC289.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit