ddd904598c23fd5233a7bbc6643272d523b83713943e8735478565a020ca9559

Analysis

max time kernel
146s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f91cf8eb7c03e9dbbce825d41aacec0.html
Size

2KB
MD5

0f91cf8eb7c03e9dbbce825d41aacec0
SHA1

c945d0a3df6f696b7c7540488413b66f16eb26a1
SHA256

ddd904598c23fd5233a7bbc6643272d523b83713943e8735478565a020ca9559
SHA512

682d1c79cff766e2e162b5fc7a11d6d608abed607965a50a2456295fb805ad658098221c0f76a69e50604ca152b176b6d1f35f2d3c48254cf7588e91a2ffba6c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410143118"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FA5BEE1-A770-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004aaac4249348c9c6ce3b3557635bcc76e1bd7d60c3c2e9b77d597ad0c14ab87f000000000e80000000020000200000008e558e3981a18036e0c8cd2198425ebe504e9d6df106c8b263a637c81734b26990000000ab76fb4f1be22e44c052c9455f59fdeee4ce163681d9555ff517b4dd4ee7973b5f0f4e631d3ff22faa7e6346cfda78fbb31a1b602b31eef4e1c18661a4a8002d7774bb4f2bd8dee57d06f3d887c6e0bbd43300d93370744d8709dad714dd97754eb36c778213b7e0f8f141dc48e6a153a367aabfeb58338cf771be030c6b643add41acf6b671faeae410d05f428c2065400000004f9c0b2152a4cb2de4f3afdabaf0e0b45cb9157addd400897dca8d5d81c1d0b72c11517d8eba1037b8ef2fb2badf5dcb382c36abb2e29ec050eff2ded2d2800e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906e847e7d3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e7baf5dd3e189635081f6fcf8f80d909da278cef92ced854790475eea8d49449000000000e80000000020000200000002829e27431544d3110f17ce9e6c4760bd9398c178756db18bab158f56023622c200000006f9fc3d4d8c6c29d0a58f99fad6557a2e45855671624f8c4b2d0e746de2ed10d400000008ec8ea25ab69e0942eb0d71940c98d7427b87b4847094e16ec55ee4884d17c75f9ddbd0cf8300b8e9c77890e67df8738541b4064eff96eab6818c7f17bc762d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2768	2400	iexplore.exe	28
PID 2400 wrote to memory of 2768	2400	iexplore.exe	28
PID 2400 wrote to memory of 2768	2400	iexplore.exe	28
PID 2400 wrote to memory of 2768	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f91cf8eb7c03e9dbbce825d41aacec0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9214949fce9e5248cc24200fc66e791

SHA1
b117b424fadc10aafe9abd4ce779c11fa8497760

SHA256
51d9b7182355cf34f97537b55decee1f965d1b2675f1afd775a454c8154dd57d

SHA512
2a5e1c377591c45f0af9c5d64caeaea65fbaee31fa5ebbb48af01589d7c7d193a20f38a73cd4a34cc7b36df82c317f9ea597d271079757a9e817014910310792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4c9aaa6af950c84391555e3fd95f46

SHA1
85647e1cb17152b013bbfa022b310a90a4cd85ba

SHA256
211f03275eb4000be26ab6e13b576d5677bc896446c44d6678669baa76127517

SHA512
121b9205b1b0ac7a036b4957370c52e3b3c75ae0ea08633dbab82e12696185aa0f527d64782fef4e9a7eb911091e0bea2902f86903303511162cb832599f7f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96d6cf11068a0c1d8a12f8f899b970d5

SHA1
f3be929ddc48fd9e2e271275db41fc1da859bedf

SHA256
2439cec23e184404e4be3ad8a0f27a5cfc8d962d4ca749930928dec54e158bc0

SHA512
d65bc3166d9c0983a67fce7b9dbc86baa7bfdaf9a07c3eebf67bd7cd1eaaa6b20a21f26e2954b25c9cb555befbc901011dc0a1101c9bae4b50037ebb878a52aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c9ab1e5c54ba291a0abb8b4a20c7e5b

SHA1
7ab2236bd8e85a251aaec2b85d77fa9acea8e22e

SHA256
e6c2f8032e6d0c56f224e24d014fb55fd6ed0eda6bd9b8b262ee87f7256f6a03

SHA512
bd0b5e9f251ba4933104b2f03f4681842fb17528ac948b31d2dc70676336891ed855191095c90279286eb51309941d40074343f1ff785db6ef22c23f1d3320e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a2bc7b617bbab068462f4cecd7ca8e

SHA1
8681030d74c3459e2ba284a6614d463c292e8235

SHA256
9765bda8a675904e040fba51b7256689896e94f0f4545c8f6777ab008aeb51bd

SHA512
acf4812703be29f0c819a4fdd65ae9e177e5836cde7c435a4d6dffca884ba2f7ece65ebddbeea6068126bef48eccdbed1aa12ac264a27440f163e347497be6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
029488fbc3958ea2d726b7fb2d6a7cda

SHA1
a84df6894998a1880df9e8a86c776d78c4c62c87

SHA256
b15c0c6046c8041f998b2489c6f07ff7dab03cee724bccaf4ad37a455dd8d243

SHA512
ba1802f89c26ffd252a52287c50fe277a5a8832f758908c80b3eb4b19be6da9ce6a3c496807273dc19da971e1542b1fe1daa904b4bb2a723ff18e1a032b4c6dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bac8cec7911f201ceacdff378bec7bc

SHA1
91624b84bc5cab9020ecdc796fa756708f09383c

SHA256
da099eaaf0aca7bb1a89e57873ad492683e440537068cc4f63ddd1d46ea9251d

SHA512
c2c0d462c6e18c92d9ad672bf84a09dfa220f22ea045a7d0cb02a47dc01b168793e74c4823f9f857ed9fcb9a44516fad47d6dfd8ac9056f1ee746ea1833074fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2964.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E57.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit