b9a8a1f17c95fe25f640833132bf7b3d0949cf7651c616a5c7a082745417a82a

Analysis

max time kernel
120s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fd0e6a02457d4c0f4fb4789c5b9dd95.html
Size

83KB
MD5

0fd0e6a02457d4c0f4fb4789c5b9dd95
SHA1

1fdc75e046bc9877c0ea6a3d1c1b9975e41ba6f8
SHA256

b9a8a1f17c95fe25f640833132bf7b3d0949cf7651c616a5c7a082745417a82a
SHA512

de160282de641d2a71ef4c3de1b75ea671f4856726ca11e85ce1cba6e0bc707ec4eba7981d48027f20da4a6a4da57147ad22dd2a2967978d7735d8ca85428d31
SSDEEP

1536:0XHrbL1SBauQx0NcNtxNSNeNBNYNoNJNbN3GxQ:QHHL1SBS0NcNtxNSNeNBNYNoNJNbN3J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f3b9374e3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410232781"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{524525A1-A841-11EE-AEDD-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000cbe554f5fd34a6e63858958133d7badc3e440eeeddcf0bf3cc56741f70079c3e000000000e80000000020000200000007b6babfa0ae1001d3919b193b3785bae1b47003d4a02c0838e4290a61ed2ff13900000007e699944e31322da6210dd2c16ee191193be3fa2fc9ab8e278ecf53839f0762e880944e51bb818582d70e42ae737576cfde9ededa180195001db8831edad38655a196f4848826655be2bf3cedf32bc9f5df87b2ba57a387531c18b2ec541c2cbecd7222b6bb4612791261410118f7d7323b21f6f52078b767fb8879b8c0030681f7310c9715ddf4dd70b8fe36f8c0bba40000000b4bb2da6b4192bf8b98244614ff43782bdd0b1d3f1984b90a2e1cd36635fdf458784b08b2ae4d1686b70b866204b0d6b5de7e4b272bdbdbd34c81622705579c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000625a36d9fdf4d2dfa828ef9e88a1bff9f150f9a9b32dc830330614251c5a7ab9000000000e80000000020000200000006569d380129d14ebafdd3d339e98a32b1f2daa3f48df9d0519af2394ba92efe920000000e28636931c039bc5f2055682af15409589aec2dbd1a016debdc4b975fe95850d40000000db5cefb759ef78387388b80402f2a275bb78b30eb869b127fd08b62ba0439bf9fd1bf7b991fa355531c82e69092314328d8d541050446cffa4e488a24cc7e78f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2736	2548	iexplore.exe	28
PID 2548 wrote to memory of 2736	2548	iexplore.exe	28
PID 2548 wrote to memory of 2736	2548	iexplore.exe	28
PID 2548 wrote to memory of 2736	2548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fd0e6a02457d4c0f4fb4789c5b9dd95.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a73489dab37eefb1923ac374adf330e

SHA1
ecde6578672ea99d8b989a29442d66454154cded

SHA256
1dc015996ee31948f2947c3611244e4206cd7c8fffd03a3386f29943b67fee82

SHA512
1ae2922971d283c3370c20da20f5b453b346648ac1f4fbdffe73dcc899ee0ce0f431399af999a5a37da3d615708e1629dedb996ee71da2d95c4831977ea489ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60e634dd3a7103a8e64c5ec71f5e356f

SHA1
7c0bfd4dd6747c17f01ded75a8d11c392f9c8812

SHA256
51dacfacc152adfcb089d3c733cc225d278713cbc7b492fbd4772790cfde5843

SHA512
6f90cb2cfd2fe15125cf82b34ec692bb773ad683bb3961d1d4d62d4db6a10c6c3f32bb2a5f6a99e18f04dd871732a6203e85094731371a1dc6355f7b7189b21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c074ee4377f71d3a6ec605d862dd003

SHA1
75c630929a5e59367d41d2b9e8919ce0411f2882

SHA256
ddc42a17a79e6803b60879cfb5c10f1933760e6b8ce70d30637e68a95626b082

SHA512
00a1cedfe6a086b3c2fd6a1a1f93ff30ff720a6b68af5c27093ea9f1e66b6bdfcb40da7889a436b33bc9e919dbfd4173ea4be8843e9aa5ebe29b8c49a6c657a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce8ac3eeb442f386816b14eb83027e5

SHA1
a63f0771098f2168f669e95a279f65eb1b3f6dce

SHA256
e5c816d3641a6a5bd9c66728f02a969fe7dec3519a13bc0f73a6875485ac3c70

SHA512
8331122bd56f666f8d465b3cc6925ed2a0c39c759c6e96ebc77006ee04402dcfa1139f459f8337cc8c756fc9aa1e08885e833e8c95ec7c700da98698baa26a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af3e4d53d729e7d2e424c09e2bc90251

SHA1
b18578aa17bd9dd398eb46017921467568571fcc

SHA256
a1ffd889d2c6f2beb9d7fb1fdcc00f56882fed80fe7b220eabda508ba6cda7e6

SHA512
3662fe6ee5e7aabaa87b583d1c9eb7a34f8152d29ca902c0d6186f1704db54b8f729dbc9cce6394f61e60c21140d27169629ef535667c41413daba11cb85e5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f38c83c2f4f5f16d9e533ae4285ffb5b

SHA1
12f3f148267aeaebcb6935272b4be7a8064b1368

SHA256
4ab79540ec896b67fbb66929a7e3a9dc37713ba509b2da4673852de36224dfbb

SHA512
0600fcc3c2c9731f408d055b896e3626a666ed9f0f9dbeef03047b779ed600809e66c8726a3ec54d5db38c9fe77e11f72e94b58e3492b237f9899a5fd146a018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94928f84ca5dd55457dc810bda646d3e

SHA1
6db97033015230dc2f2038f3b2c4506bf712517d

SHA256
95c05ac8d48610e6d015ed34ff78774df1eedfd8385f86c1cd243a03d47d36c6

SHA512
a9aac9a36ecfc33bda5ea8fe36ca0c5ccfcddfb64f1cf0f94c8b3d1b51c5e9ff9bea5a76fa6a02ab2073ec9ee49e469744b64d823feee8641913c3b72cf01e95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fbd30fef85e75d9b67c8e834f46ed29

SHA1
4aea4d5ae73ff0f6c17713f6c969af0a0a5ff848

SHA256
7a3b70e35c5dcd88d9d0119113acff9a7db88658a452715a63bb9f09a665b741

SHA512
3f476a68697116cbfc74cceeeb973bd376605117c23932c5c4d537078e775adfa2081bd1d020ce9e86a6177f9f1d8f549f3516f6a12336f005ac04c2dba740c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f28872e4f133d3672e1f54649cfdce4d

SHA1
cabde658365824fdb7dc46852e981540919aad91

SHA256
04cf9a9e5961f42fff357c90e0c102885af12903c661d14f8a155bb070515bd4

SHA512
2775f2e95dc2f4f71b7c5e506ac72e98df8ed69a450facf5a015692bd0bfa0a8db80a9491bfba9871dd9c7ab1584721e55e1d34ae791590aa074cc2cc2d85a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faf115926ae6db067360e3c5c29fc868

SHA1
42cdf549a716cc5ecbf59269bf7cdd6754f760b6

SHA256
d2d3b0da3e2d3bfc9c868f42beee4d3fc4b6fc61cb008de403b30d6cd2470250

SHA512
757ce2acc9f1a12cd32ba3c08e48ec307efa7a96d8ac67aa5e3e3c2731b89ad56be34d06a7fcc5fc286741e6319b00bc6f4c95efd481065399d4284344f1e03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
2ce252e59bae7f0e719b9785a2de7741

SHA1
39f86464da277e573ccbc7c843459b0baf92bfa9

SHA256
3929679f353d362e0a5bee5869c279ed0215215c32dc0be7fb32f2cefa79e3fb

SHA512
81775786dc61dfd49aa33673201be400d7c6442545bda063b507d416f2031b9881ef36e588c97739814c86f067262e9635a91e1cd6d676a41cd41083693dbb2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF0C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC076.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit