9ea63f5db78eea33527cef0cfad4409dc815529d40835ee39a8c354193dec30d

Analysis

max time kernel
143s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12808741c56d4126424a9b5c60e08804.html
Size

12KB
MD5

12808741c56d4126424a9b5c60e08804
SHA1

d70c777478dab83b25b86c403830d1124a6f3517
SHA256

9ea63f5db78eea33527cef0cfad4409dc815529d40835ee39a8c354193dec30d
SHA512

f0393a2597dd61221c5b23a408b6e50b26a8cb67295a1c431267647dd3e02f740671539a8649e194259a489c9bdbb6927401e020f7962de59cbc273806aed9da
SSDEEP

192:EihJITEu6u16WA0oLHrs+JT5e3w8wioBx+4TBx86HubQVlTOBxILxWzfk2x6:/hJITEu11TMs+JyyPZzY3bA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b971eab23bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410166088"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000054d6ca7c07f499a9d11a5fb5298b5fd8af6a92d8bf00f8ae8da26d2d6a7f979d000000000e80000000020000200000006cc417b47df0eb8b4a5793fa91bb1e710a3dae4b37e91c81f6cec2181d6a9691900000007888990ff02b4bf03789f628f973cd26a5c8d31fca61c45d67b07b24bdab88211ca8d44b9634809a460770f0aecc0dead7f497d4587b1eb3c434260e1708a899caeef0217dd8d5ec745cf8da0fcbf1fd068d65a25de07b310027992eda500c755bda36f511a8ffb473f4ea5c21132ccc8a62f414c77ba10e2f87042229fa520e187dfd60e48400058428c56f165c189940000000151f6227321a5cf8b6717ba05c30a6880d59ec35cbe2eac765c6b92c7a824000704f4d6caa865141c3183cd592a34e030f00beda7769eebf72fd072a12a704f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d49f18086720fb95f9bc098acaeec8a2f7e0c9ccd9d33329ae74c3d83b3c826b000000000e8000000002000020000000e26770ed5db05e32dbee240707de0d19bb9a112829822e5d2679747f1884d4e1200000001f357fe86ee2a7d4d8e3f0b7344d5a842814926e91a4bedf293bae82cd794c504000000001ccebd9951438a369ba52a0d8489b2f9790ea1df70df2ac41b7d7efa15f90a68486dfc363d8cd54226de6900c093ad1d66db3c9581f31675c9e556bc19f2c90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{111F55A1-A7A6-11EE-9005-D6882E0F4692} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2024	1940	iexplore.exe	28
PID 1940 wrote to memory of 2024	1940	iexplore.exe	28
PID 1940 wrote to memory of 2024	1940	iexplore.exe	28
PID 1940 wrote to memory of 2024	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12808741c56d4126424a9b5c60e08804.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07192d9627bfcb941f67bfd10a1be34a

SHA1
c4bd7e7fa2e659ee4292c35c472e9f091bae583b

SHA256
94e20517e73e7926d092ec147d8215a0866b3854061d15b7cb0598756cea571f

SHA512
15795581c115ed38b560b1a1eb4e4e4e7452341ae3e534a29b4c71b434a7183d784b9afbb3e42f62038cebd920ec0b90cf45e1b6668aaaf165662f71cd4c0fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43718201b0561435878d343c30999c24

SHA1
494c70d89000a20bf8f781ace305222df3f5b27f

SHA256
35d5d0da646eb4be778f8d4b5e0babe68e92a321daded91a220192a8cad1081a

SHA512
3b08e4025793e9a001fbc1253bdce5531f22c9a04bcf505c18b6517fd55ad376416657a88203babab3caa114ccd11ecec7a1c4881839d32e9deb8f051645f43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd9a98f07a1cd450d148eea8d99907a

SHA1
3f999fed318589b11d1ecde2bf73d0f0f6d8d84f

SHA256
0c803890ac7caf6e387bcbe05537b7a9b1e4db25a4e2481d7b20f256a894028c

SHA512
e6bbbec98ba136e25d5bc4438840026f44da7d5dc1f18a65b731f1362b7f3a72d6e67777aaa47e8d63c96896d959ce09eca2a514db2c312bbbf2c31681080118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50bc01f09bf919bef73f629980b500ef

SHA1
36a27a104fb1885edd1436ff5e8a9c2c9583ca3c

SHA256
406ba012aafc991b6ff13c60e3c484411b58e759e3253677f2e831f7dc988b85

SHA512
800854a5b4b47d0d3d6ec6cf8deb9dd1553b6e87d57fcf420d4eac6c1ac33b28af433d45a99e3903d99a147fb6d864a521137129649339b2a5747b35f0287770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc7750c9f3babc84313bc884101dc68

SHA1
22156cff37a9a93bb00da270a2dfa54bd772fc98

SHA256
9cdd6ba82039e86b6cf82762a11f7336c729d04740ffbb482990072fec7c7e46

SHA512
9a54ec446c8b25738049201d9042b009a0521b83b16484d4cec70023e31eb2b157d09c88e6bff5e8a2694b988697368f53f815f6d0c3c94a362bc302460eaa23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c5334b49ae20c59399678bc4b79f9c

SHA1
a945dc5307d3974666ba50edb86ea23c69037c68

SHA256
8ed858532b191caddc16e2214b03c178c5f195339bde926c91e5435557297822

SHA512
c1cd944d812cf4cc298d49d05f8ba9dcc5632e7476168737111352fe8a3fe90950142d20c150599e99743ba2df942506df6e2e42f4a45c31d4f0f7ca78ef1be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7b301d9d4a9ec27b96a861234ba9d6b

SHA1
398c6b16d1273fce78cb2afaba405334ba15c5bb

SHA256
860bb9835d63edb31aa16212edf0450dd273630c24bf70f0def8d95cc71af3b2

SHA512
74798c5ec6f537bb1916ff6c1afa1b8bfb61ef88c75ffdb2327ebaa276e43f4164b6a54a198a734b323eb67f8b33d6df47e3dcea81c4334e1f3fd1d5a0655b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c58cecacb599ba856d9012b2b7e1028

SHA1
3e66c011cb4995a78067c2f23fe34105efd2ab27

SHA256
ecf702753f3ba2ceb887a7aa15cf860e7016e97b3fd644e9e38c2668fcf76803

SHA512
9a45fa4b81e07a98c701a89b1c8e69abf30691b3cf7f6afd1f31d1c11524756ede7b8ff7fcc8fc6c9b25a69d14dded1ab8888df7fb3fae1ef51d1ef37816cbb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2334c199a91900cf86bda6f4be5ab5d6

SHA1
3f1f16430e3a0049b401f0bb1499f0f7409cf7ba

SHA256
a5e255b2fd70fba5155593ff40ec2de2b01576760e2a5d109fdf02fe7b0eb94c

SHA512
007ab89e702a014c9c3b3b4a1b4d19b8c4ae10d7fbb1b67201e403a49e783eed5996a1916c09b39ce928c88feceae9f9d0058b0bbe3285e626f5c37a9c26ebc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e035ceb67c421942d31c6d387e950bc

SHA1
3f9a0eb223e22b3ce7d4b42daf01b1be95029294

SHA256
59cd3680a51767b9c38e73e2dcd9149473f06f75b9788619b1f6ecdadd80c027

SHA512
a3301e3566c1a1d31cdacfb7864df9446a995f1023a42c383c579c9affa14e66be7fc6a6599d5149e48a274e7f08e468acf06e9d87e739d0deeb1b4eb056f97e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f801d941d231d7d760acc55ebdc946e

SHA1
bedbe14979008ec3bd7b5c754c11d5cc928e59f7

SHA256
a64770e0b6da542ba289a7ff2295792530cec74cdf03babcdc3c0e9f38e57aab

SHA512
388fedc1c941b434f1bcbc87b2b8c7549836d8e47b850e755c2409895c7b73668cb4b86b25f744278575bab2443b25e339cbc5a0f3ddf1573d7a7f967407b226

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C26.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C87.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit