b4f26d2d16b232b058cce0b7e35616dbb77c449bd4fa050e68b85b5546280ecf

Analysis

max time kernel
119s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f99eba4fad8e68a6719c18a7c606371.html
Size

251KB
MD5

0f99eba4fad8e68a6719c18a7c606371
SHA1

7c5c0ac6febd410a60bc968c1fef6dd681938d8f
SHA256

b4f26d2d16b232b058cce0b7e35616dbb77c449bd4fa050e68b85b5546280ecf
SHA512

04b9b53c517151dad1268fd669ced487502ea6906525c8341c2e17d1a0d2255b07a71d64f365aaf1807ebff7917ab081f69c22bb8c101a17399f721385026b58
SSDEEP

1536:XwLfbGxRemWo+axnUVlDqcTpiij9x3zr9/wY5ld2G9mKeZzll6y4YvqjgOFWTJ7C:ALfgpI6Uoij9xDZ/P9mKeCMqjgOFWTAN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410143299"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000bff312a1c95893ec51aad1005380d3eb46c06f19940b6445248ff281707c31cd000000000e8000000002000020000000478eef10281055d24514df2a4b31ca579985855da19e41de36e18297cd257bff90000000a977393d3208297f44d8b594fa6cf65659b773713729d908ec9699cad030786cb241138ebefcd3b9a35cd6de3500f84e263e59f0490e4fa662cba9a9fe9c04e303e123330dc18c78c0cf0b3ffb083807be6e06b0277b52149f7d2f0d9a2a13b304784d54d9c03bb04c7650cb907a7507af6241682bf57a7b65df30ca88cd51ffae7c3032101fb5cae28f2eb53008a178400000004568e196548bd844f82d9ff877160e8d9aef1fa7f4edd399b794eb38d8dee2028bd4bc14d5765858d201536ffc6956637bbabb6f3c5d5440ec3d3070a1b3428b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAADADB1-A770-11EE-8CF2-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009296597c06c612c2b0729d3bd0bd9c8e729c98fcbd1611b225028614f07aabe8000000000e8000000002000020000000296eb9a58fbee14defa442a66f62b39a8434f3e5e022f2b1f3a7559fd667897520000000aa7e7450ab3225e9f897b058e8614ec8ef7b9f2ac2f737e0ec3622acda81ddff400000008bcd25fb4e939a231414ce04b182c77b01a1d8b0331843057bfc94a8a8e0b19d760e11d265089949fe93351cc1ce44b21b4bd314e1a25bb112f6ece522541dfb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ff92dd7d3bda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2952	2116	iexplore.exe	28
PID 2116 wrote to memory of 2952	2116	iexplore.exe	28
PID 2116 wrote to memory of 2952	2116	iexplore.exe	28
PID 2116 wrote to memory of 2952	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f99eba4fad8e68a6719c18a7c606371.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a537ba607791e8bbf825d27ae05659ae

SHA1
cbabaa976bb258c958e907f9736f361e71ce633d

SHA256
788c86246f00af4243391309d4279a451df3868305db09ec44173d1fa5397c1f

SHA512
43f0cc7d0507a50c621d017dd10359396b4d54bf546b64f178090cf7214918e355cc02c7a36334ae688da9ec64291cd9fc5de2c85f6b08417078b8eb0c619c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69f242d20cd36cc1690a5e70a6228690

SHA1
92c1e640a4b73640b4a8fe630b0a80f512fcccf5

SHA256
7c2bd0a1ef4b480c09a8700f3e2073458f9cd5cf0e1b8bc42a7a6093b2f95611

SHA512
1ea45a813d09cdfea86121eb952c61a258d209992fd861e267ee2abd83535697d1272ecaf2266dd7af815b6e8ef34da08731815e804deec34cc61e42bf2c6d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa6f13025ca463d342d40f8789bfb50

SHA1
81684173aaaa9b82325a874c94b02219af0117d1

SHA256
1e507ddaa9272e928a2032298db78189f335c9bd0882ea72421a000dc75959ea

SHA512
240ab73759c4584a6c176081c5fc1f2df862cb3a67bee943d202d8d7c13a376926ff5bb4d5f62d36c6a6d41693c9cc88fc99f8643066e4b17a714c2fb8463393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0180f13a697604962d6b4f0d26651a62

SHA1
5b8f7c421cfad83f10094923f8f3a9bf47923660

SHA256
8cafaa9c35df2f291a5f569674d0561bcc4ca76d7cc4967ac4d809398448d9d8

SHA512
6849e23e3e15d21311cf57873ecb08ca025b8ea5d8c47603e641479f558d7c9486573d7af4714ad8230c1b9951d895fec5f9f3dd41c06a31032208a232d34bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ebe8ba451255d965e9f78d9ab290d6

SHA1
d8e0c442db59ab5ad7c149324296340b19ab8102

SHA256
602f30cae0f4b57139efcc5182911ee6072ec6427c55f5bedd7a6a9fa1351803

SHA512
12ffa1565fa185a9422c72e0fa5266abc20c097b0d6a93fdcbe0ab3772f2effd5a9ecc25a4b5f0ce0edbf3dcd144c5606e13275ab6957d9d5ebd20cde83c0716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12c15bdaf5fd39fae6fb99960c30668b

SHA1
17c90394665b372cd7c849e783b5ae21857192a0

SHA256
ab9a7f1622b94bfaddf825555d8737140f07270cfcb8b57198b0a9be23f85333

SHA512
7601ab0a01a043be4debea8203b8e34c489028676248c8756ede765475fffb8ec1692830f2241da57f1ca87c210dafb302be879e7e0ac037c7d475740f1936b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8493a70b9aa8fb4f53ad2d7f49cc2b2

SHA1
5e55d2cef0336bea6eb79b92b8d9b644d379a8ca

SHA256
e7ad378c88040fc4008efffce7727e5c979b5b779b1b5572940f0470582d4895

SHA512
75bcea8a0aa5a81fc4a2d9ca138f712f8ea9b54445aee1338eb82eb06ef213b72615d99cdca81d4186862105fad0c3cf13326c76230ae3c75b92d75af0df3ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ddcfbfcd393d1e549ecf4ded4b041c

SHA1
fe1c088496fd9a7303c8eb32d4cc6e340222e25e

SHA256
670828a49184d0d81fc62a51d9516c21c39881f2fd6e3bfaaca70196e4a1843b

SHA512
dbe984976f5dee1b0896a08320eaf81a035812691989be09cc64fca7f1b823b3279109024f6ba7e1c2c334fb97262218226d18c42de77219e8997fdafac097df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eba196247029ac716d65308746402a8e

SHA1
5224207e26d90003d550943bfd8d8e4cbaf2609a

SHA256
7c252a3f62835d554185120ea306525f8d20a7c1814265a79bd2363b02ddbcfd

SHA512
97c3e953bb52b61eae97d28cdbf50b75f827c86013ac512544e2fa29181e7f7d7678db32d5ed7316068c524e0b785d490927b7daf14d6d2887119add55e7d0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10be9777fd67916be783dead9177ed5

SHA1
a4b1d3e8c3c861e0f2cea39bce0bae1efbc17ec3

SHA256
532e1cb8bc81bed0f8dd611f34212c16941559b79f292d72d095c1ae73b21192

SHA512
5c931400444659a2572e028bb2f8309aa37fe1818d9c9339639d7c978718d1d06795c322bb8abb7b4f99f35e991624a3feb0068817495bc8b59d0fde9c1b09c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96D5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96D8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit