8f9d839c148c3c19835538ba55c7857714deccf6a1756cdc4a9ae251154814d4

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b02bcf7a7200826a51fa43ceec122a.html
Size

13KB
MD5

10b02bcf7a7200826a51fa43ceec122a
SHA1

30d1810b1e440a926d0f4218189d38cf19450392
SHA256

8f9d839c148c3c19835538ba55c7857714deccf6a1756cdc4a9ae251154814d4
SHA512

9ccf2a102bf1ae7eab693423d54f1277c521fbf185bf41248de74065f3570d8e87522558090bbdace42e415715deb0ee7436bab387fde0cfd5c90417adbf76ec
SSDEEP

192:F9HD/Kgb732vGYRq+YwUeET7XWqcz5AHeYl0HWlhFoI6fBB:F5D/KgfmvG4xl3EvXW3CeYlFhFoIOB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402f078d663cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410243233"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE9CAFE1-A859-11EE-93E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000006b91ad580d17c0b0fc13050d2ca34b2b5448c359f1cb9cb8ddb38759861a3f8000000000e8000000002000020000000604a5c200b85a0c8cb9195c19cb7f95a609a37a26103b5bc079870cc25353a80900000005fa58bb070cab0331a6810efaf9975d8d3828671b2c3ded713352b7c3932e66f6b5a473c3e3ecbeb5fffd13e18df226ea02c3ee8a6fc72a476adf96c94ef312fee0c15d1e461743dfa5d9228c33ab2e3d30c48d75ca6958241f4314589ecd1fa197bfe6097991c9227d73d7079cb524ffeb835a050011fa732698e26364df467fcd0ab6ab61b4127d312d1adb6ecbf444000000075e34830856a86c5f3af0897694a41f87387c1d05cf21c8d7ea19be1eaa6904ba6bd0ff305d0deeffc4be34ebcc89b003cc0d57dca329407ae083d94ef73131b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000001741554f23c77c407ab3aed0fd5f99cfffbcde0a90f6b410d2a180087d1310f000000000e80000000020000200000006d066443a9650d2b56bdc44dd4290abca9faeda52a4a1ebf27621658b9c01908200000005a8a0a55ba47e999362ad9b8a530601f62edcb06bd021d34b429fb77c74e245240000000bab9101984768c12af2723ff8e681281067097483bf4e9982fca30533bb5e75fda4d6664544db7a00536aefcfa9b6fd5f4829fa744733c9a1732119e445a898b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1152	iexplore.exe
1152	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2736	1152	iexplore.exe	28
PID 1152 wrote to memory of 2736	1152	iexplore.exe	28
PID 1152 wrote to memory of 2736	1152	iexplore.exe	28
PID 1152 wrote to memory of 2736	1152	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10b02bcf7a7200826a51fa43ceec122a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf8908e1a2c112d757542f5cde3de1d

SHA1
4af5dc19bc422538649206c12103983ea1538958

SHA256
397c154fb3baf10eef1c6d8dc772ed8b2b7a3bd2d379fd45cdd8ff02b4038369

SHA512
8cfa804c9d9ddd3f4b6a390bfa0e2de331b5489ed2e310b4cdf150f956df05a174ff7931bd793e1edc988e5e19c84bab7ed0a664b4de3c41943feab1f903945f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410d4ac82efb61f4e5de546fd834178f

SHA1
4125928360ed3e06aa1b93a1de05d72c511a3276

SHA256
20a98f53b3ffc691dd000ed4432c6bb014340e3c7d23fb971ccefa3f1a764d79

SHA512
5a47d7981e70892f672a9694215360f2f4e93cdf4b8a21582bd7d85e65ebc04d038c62ba9a1624302aa60844c97ba58d920107c37eb33902e3815d2dc2263f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e352a07b7c7ac765a0293ee23e14bfe

SHA1
51bbaa04794d8e7ef152e1e8a3fa8d8a2aadbe73

SHA256
1a7129466a1582f216c0ed784d48c5abbda86e5c780cab0ad323bf270a2b5b1b

SHA512
1a83e9c8d29c114c3d35e18d3a2f5fd96b6c4b943539380b1067139a5d1d54fdd0419370b1356ee66a69895f1a4ad21e42752637e4b2b67d82be10e9d0192b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a6f684bd8a125a68e55a8d68c66a85d

SHA1
6efbd5026333a3713eae2c09dc90079bfefafb76

SHA256
00471d59afcfbff294f391bbde2546d3ac44567d414fc45d8127d691e087e53d

SHA512
df6eb5306cdddc44270f228559782e856f01badf84feaa70862a8b2b92cb8c177ad0191d0eec56c4ff97ffb428fa3bc0e7ccd58935fa03e6c8de2bb9aa170340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9fa16b6820124a65c5c9b93a9011ee0

SHA1
b4251d4cf3378716aa90f2cd29387fd3587e32b4

SHA256
1e6075617829df86019d819716d336f8af07261047af8be439edd29ab827e9f8

SHA512
8cddc59705e8caea70bfe477ed08948132046e6e5a7e830c1925b00bc2b71ec217383b97bd7aadc52edde24918f627e5242d3e6a5ecf49d6f68b9e9098cf8cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
940194e48f99f3385081d0a1970fa03a

SHA1
bd93e21324fe55c92e8c48e5066122b6d96885d8

SHA256
9a19817477ac857fa685981b27d62d10c252c674fb1c96b0a8b9cf35bdec68c9

SHA512
b0ea3db6757f1e2f68da773545e371acf253de0fca5566ce76c4b0e0173d246ee6718c0b499acb90a1bcb6f41857e5f2b884fb2d6f0f5cb76b48421ad530c16b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4493e1e521f6e48f020b78273d12e84

SHA1
f023dd6172f34b1f9da8e16042899368bdc18a75

SHA256
0dfb537c07c68a7759a3a9194e371b66bc602179f633d9ddd4b7b952edcee201

SHA512
d27c34f82a7192f995a3daaa4570a13c3c209335ccbf140fc790e2e38ec7151778176d5d67de9da627fa05f88deb63f28698c9ea17bbad156ed31e7ca1f8fed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6831cc8c68bfec08b4f3684224859efd

SHA1
665ac25edec57f5547300a7380a145bc3bdbd6b1

SHA256
005b69afc169aedb931a58082571375ffa0b7ab1ab4b18ca841e68ff27c1ef25

SHA512
668ed741eb3176e1bd4e76e9c0fa6d90c942c304d7503afd6412e00abe11359f04d1a2c4b495b17897ffa1476d1006a8a5f8ea142df90763e597cd7fa4e5d68d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9258b83b851b8d48a2a3e0bfb51d0b03

SHA1
2a875919bff669dadc989c3d7ea8975bf910f883

SHA256
4307ce617cbd52b4b5cdc8051256908fbbfc6ee7ff8de9acceaad8765b0d86a6

SHA512
d87f84c88d787d85f1346548db40dd672225b6d5e5cd3718028f701be7a30307a9f19140a751d4099971b13b4af3eb7a1598ec03c9ebf9f5d7e0259f53a86ac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC371.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC3F1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit