fb0d0aad3b18197862fa3ef410eed7c4f1a14990ea431f19de2a8462d4c17cd1

Analysis

max time kernel
122s
max time network
161s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f379460df309ef48c62e694736534ab.html
Size

121KB
MD5

0f379460df309ef48c62e694736534ab
SHA1

62da000a42ceadb42d5b94bb352c1bdc3dc01d9e
SHA256

fb0d0aad3b18197862fa3ef410eed7c4f1a14990ea431f19de2a8462d4c17cd1
SHA512

35d422e080d609bd352ccd20a1e9404b20ec01f8c184873347f371181ebe15b5a1381b56fc0cf0e10397744cfc79dfae86e840101d205953d9353184a494202c
SSDEEP

1536:iKJswsLTp84lENSL21Q43C9lafXoPeEOp9:Nsx84scl+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410225898"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cba0473e3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000345e31cd7b25b8610619341207ac5b04fb48723b73c6dd325104a692049de12c000000000e8000000002000020000000e9afb6752906f11898a354e40ae3c1fdcd02f01255bf997379f0253d426b4e36200000003df9905432549188e9b12021e2ddd329c22e17f12aa61a604a2fa13a9187e53b4000000051f84d2706391ab958f43ef51c6be01bff0f515d5ef7a92ffb5a0f0f103c64cc815ad51f605c1de42930dc2f1d06193780170ed6c4892de92cda77f05c785314	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CDB04F1-A831-11EE-A20D-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000036c9df70698701673e4ed42e9777cce35afa9e025e58775109ea5fa5e6fba185000000000e8000000002000020000000e99aba0270753626ebe06459c81dd3605523d286169e5c58b31363e3c3049743900000004ea738c88f625125b3ef2f7ab90c3666f102a789c118885248465c827acc33296d5bbf3a0841de2e2f87159fa86fea07baf9e83ffd1975f134680cf80eff9f214873f5606cb6868ba29d3e726e7954ae7c6281b7835603ceb4fd8486fb9f6371d41e7629ae011d1e9b53ca9b31d277ae83ab9a25ee846aa5de7521117f6a38dbe8813489bd9fab0199683068dabbd3ce4000000078e2afb58bca84bf34b2de3ccca04643a852b235937057e9552008cf9fb4b6a5f803aac056b578658af2ef37c60b796d0151e05102fbd363bf22445572af8819	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1104	iexplore.exe
1104	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2012	1104	iexplore.exe	28
PID 1104 wrote to memory of 2012	1104	iexplore.exe	28
PID 1104 wrote to memory of 2012	1104	iexplore.exe	28
PID 1104 wrote to memory of 2012	1104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f379460df309ef48c62e694736534ab.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb19a5090ed975f6427f0156fe9b4afc

SHA1
4493451e203bfc6494a7a94ee80edf247facd833

SHA256
045cf6b5c5b259c5d93f24cf9907250571ee230b0bee6e2fdbb30f9ff7c1c77f

SHA512
60cfe1db34604be54be0b15e23a71c6a4dac012bbef44754c3c2242b9995e4f27bba370abcb6f54f8dc01339091603c334fff1046b8569e575ca38c614d2c2b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d15314aa6397a5ba4b50f95142741f4b

SHA1
e3b7eb13af59171b88ee82bc184febc30392e749

SHA256
ca35c47e531d108b7e1b78904778f56f43b08a79967aa3d111648439c1b3dec8

SHA512
f1d2371a65e2ddb7b0b680427b57e3ef30bc3b30a75bff789cf62b65c82a3225892b6a2e67dd3d74f8f7add5958d0c8eb8381e41369fd9ffda5f0f0d8a6d4dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ff81659a73fe197acd9d51230a0a84c

SHA1
32be28c226d6d5306401eb0f0d0e1656ac54130c

SHA256
a0b4dea6da799de8d024c63054da79a14738d7a846077d5527971da3e0d3b55b

SHA512
db4900cc35c6b49ad4fe12296b096d0e7b966d03b876047dc88f6ba6f811436411334c182b7106e678dcb4698798ef58990fb42e380ec76a4226e55e57ae5a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5e957f707f73b45fcf767042c9482e1

SHA1
85f9bb6656a0cc14fea2fb82d404376059cc61da

SHA256
c8815206511cf08c53127079ece8f29f0c6077c5cf8e72b0c3ef9652051e2fb7

SHA512
f3dcc3c863416bd31aa99ef2e70e1e58bf2d30c3d879c4d8e7d90fb49a59364c678ec1f525c0ce35c80f969b4b14a12359c9ca77e5aeb4ef11aa907ae42afe53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed06fe663abcc70959efbc9c18036b6c

SHA1
cb7f2f4919f1304860ac6576d736f8fc2557e656

SHA256
67b6057b0bf95995896837c4dc72005e9775a6153f14d2e6adb7c75fdcf55601

SHA512
d687f6f00f9ff152073357650371dac508773637a6d8d247d5f327461e776c5f02ae2c3dfb15742bd8efd80d9b71221e48eeabdc9e2a673616a6d8ef7a2251f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F11.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6194.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit