bb02f6445fb21795a0fbb56ebd582df2598f27c45c7182e523e1613ed4a70482

Analysis

max time kernel
157s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12e364af85b2166f5328231f75afaea6.html
Size

55KB
MD5

12e364af85b2166f5328231f75afaea6
SHA1

7787fc8a64940047d275dd26468814da6262443e
SHA256

bb02f6445fb21795a0fbb56ebd582df2598f27c45c7182e523e1613ed4a70482
SHA512

bc58e78e4bf6b372d2bfa0ba4dac101cf4dab762ac83434b70c1c262a2f522ef1bd06e33715f7a9cdc9dbcc4cf14815d21556e4e67cb9d33a38461e3addebbd3
SSDEEP

1536:wRyXguVYW60XEdCLArIzCYl8Dfilaai50EY44pXeXexgQTIiEKI:lJV6xai50EY44pXeXexgQE+I

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006ff7156aa40ec3e47a90e20e8315b40039a13222679c6ebd9798639c3031f4c3000000000e8000000002000020000000e824f80ad45b10ce4efc686dc39b82e0ede23faca1c54250f21be9669ba96a6e90000000bc0fa33932bdf9211581e90ec4c39b7cc72498bd91816c9a6526af3c68620fd3e680fdb002bd98f47096fda66343706a71bcd865b3abbd8ba420f606ce91e1c3e103da7d2ce31095a7733e8e741ee60797464bacde464da03f830b12e87130498343cac8dfcd8f0b96e60f15aca8e1c2f5a721bd65b472ba75d44d629428083246e669f06583384381f137e0f82303ce400000003517462cada4152230c949b0dca8d64d6e64dcfa3a7c2cfda497a5105e280c46cb79c377aee2a456e4c8559f6f5c5c73d85c86594e2c52d9956f111636f28901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000062b2491b77b1d4332f722ec612046d916f8e194b11095c9b8b4144b863f6b4af000000000e80000000020000200000008ad368a7816bbff748441ae0d6f162756a031e7dbb1fc0895d346784e544586320000000788b1533309d77701a3a016f9ffc4b1a9c136ce45626ffe90d5fbfb88800b5d0400000009de7c3c05018481fff0608e6d2ef9dde0f29916de07f5608681e98ee3e6166bb1eeb78be2b545e370cb6491c428b7b24444b160f84e63f17cb64001a7af7c9e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808812d8a33cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410269570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC5A1191-A896-11EE-80FA-EAAD54D9E991} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2704	2404	iexplore.exe	28
PID 2404 wrote to memory of 2704	2404	iexplore.exe	28
PID 2404 wrote to memory of 2704	2404	iexplore.exe	28
PID 2404 wrote to memory of 2704	2404	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12e364af85b2166f5328231f75afaea6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7380ce0460f2d8a1ea316c0164d65a0

SHA1
c9215c893cf15a4f48dd9157ae4cd03ff50b8517

SHA256
f9fab7bc3384a7fa5ea860d289d85182b602b99860977d5c3f94fbda01423f68

SHA512
af3571e24978169cdd9a2e23cf6401cc11415cd2b7ad19e6adf66d103adf54a854044b1ec7c9119bfd75d3a28c1cd5bfd655dc71b4b441b2c7de1f735306fe32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fd754334d55a5c86f4a1a58e118b80b

SHA1
e5ad50a54da29d991b2bd461c8e339b8bebf1d40

SHA256
fb19531f6c8bcef96f03105c86a6d90090420c4200bb9a3b4f951855c16a999c

SHA512
2fdec929b2f649ec06dea1787816a20a0701dd0eebb545bdde232cebb47747896bb84f50b432127713d05c3b4c3904e6bd57e632ca02882e3d18a9e3f924ba49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
765a1664690e2c5d4593d8d5181baf4f

SHA1
bed49365373abaa63d37bf07995e901823a4d6d2

SHA256
f46b1291b13dda19e42efc96fac4774cae9f7ceee5364e39de87bb0029254363

SHA512
bbefbbac9506d7754962f73daa2f1dc74052abdeda1dec8066a6faa6c78e4224258fa82b168000786ddbbaec53e8b0c637c21480f434299cf21223d1e11d8ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3585494412e5d6720e2363b753eab83a

SHA1
5dd40a81a622da32b5784862efc94493ff19fa96

SHA256
863466e02a6b31dc5b3d671f2aa47f4cfc4805697aaac4300c909ddab6166bd8

SHA512
75d9c30f49ae139dddfa9d1bca70bda17930303b9adb7b026dc3511e7dadf926ffafb9c1d925600ea79591d37136a406a7e32d075508375fcbb2a0492f20f4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8179c8e01d4530bacd162da5f1a5808

SHA1
b4c8ca5f288d0eaf6f9d84f13ed8c50b7a15a8ba

SHA256
eecb93de7b52b1c3bd8f561587ab82ee5345cd62a78a4271363643c33ad183df

SHA512
d95c4f3fcad2c11ddcb5aabb79c4f80b3dae38fbe815217fad3b5ccdfd62174cd2be9c635df62befa96fca9b8144c24e65923d50de8378721565d885d0dca4ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c5a308a06de58e76117ed3a5276820c

SHA1
d71e9a63d3671669b282ae684c06a7fc3f116591

SHA256
6dee564b162b103c7e17ebb1022473359e243c0649adaf71a17def8903f5a28c

SHA512
12e2d81f9d70fe674cae05265d59939e957f2afed8706759ba2ef5dc698219c120a35437d72c92aee0f055f16b6da012fc6c316a6f7f5f900e83d665b3ef62b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b19539a97c429f8ff9c5072b7f7bfb22

SHA1
782c633473ce6f1c25f52f0a76f7094fdbd2ab7f

SHA256
56a4064c1340c99821dce8ffa73f6de5582d340bc0adda982710040ac4841338

SHA512
e133b4e16541a3d4be6aa3115a8844a5af67810bde42017dcd3198b13cb3cf68f8a7cae4a6d8f95581a6fba6b303265fe560badaad14fffeeaa62bebb1c505e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
567208f483765fed48967fe1b8d211a2

SHA1
55894b540559617465f59a85caea5d3719090de7

SHA256
9f13c0b69e8d25e47f29298ca391d2baed3ac1fe050b4bed06b57b8fd73fa80c

SHA512
f6961b95fb198c052126a95e4f77facfe6c044af8bff6a63c595bcd977b6dd7b05fde64c1db90977d981df2b1100645b2bd5bd29583dc955f23226606f2f4125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e2890d65efcfd0046c2304495bb8864

SHA1
7c03491b1c93481d9e88d17061eff93608ae1651

SHA256
7da6eaade396b885c647ceda03ec3bf6fcf84bebe05000a34a023df7ed757047

SHA512
0c68884c9465deaeb0f91474f5a481b79184d85e411f1c2305c0692f220e446cf2f11d058fa572d3da6a11357979b684ae478975ba42b137bef2ddbfb9f7f407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71531928bb7c481b254be74f6e1bc472

SHA1
bb39133c0c4d550eba0ef3f200853cc5f358f4dd

SHA256
7e75417dfcbbdf07710de67a98bc2ecbd88d31069273007bc460f71caae56862

SHA512
4f78a89558c6830e0998ad7823ffc2663bfcc2380bbd3b67a313e9607b9bb5580402273759bac8c98474ce83e61d6d922b66e565556d02d5e3a9b7369fa21dab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe373a201a798e0409d6368ad2a93d3b

SHA1
59e0ed7b31702e209065f478575d0a8651de0444

SHA256
3400b7479e44ffe798b823c9d7cda3d2bb12adf7f8c52f6d9848c66b27e3e1c7

SHA512
06113d5407d78fc634fbe969187514553ff7b908278326f0ff33b1345dbba803cef827ed56cd23e72f703f3f1624b3c10f8daeb6492fb2323ba9ad48fc15b081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244dc939c19e7550936e1bf3eb8817e1

SHA1
4da99f44065b0d2da96c2c61c8b606d1dadd1693

SHA256
49a61de0b7d96b80409c5b36bf34b1990fcf2ab72a3bd672a9593f31e5adc79d

SHA512
709d7e7c3898a2cfb5579a6ff4be8e067b9cc8fd096ef650e4e98276c6cdd831eede0ac2f8a4cb2538fc1741c924209969efeb29779a22fea42ddf8d556ebbab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db957553feb9227fe25559503db76631

SHA1
8669ed624fb2a65d3a294216bb174285fbc817de

SHA256
a1fee3cfc435207c0027a09be83b0b232f7f294a7dab3f6b9aadd50ccacd21fa

SHA512
d28e34f76bfc6647d35c8ead7ce3c183caebe93dec82171f3f726622541a69c97abdd88717a37e3769f568438a8f748783156714a04610866a4bf1188eef7f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d3d784a8870f212a5c3970104bde0ed

SHA1
712b4c0e9ab114af588ccbd9bc3584e1a45a36f5

SHA256
e6205d96253abbefad9cd0f882e9ebfd6fd3afbde61632c6a306dadc3da2bee8

SHA512
734163ae92609b33f79da48c86dda7d62eb69ff28f515143481705af842efcd392cb10a0405f506520cc59cd6f369cadc589b33833d7d0a2b947e3f8aa57be18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fde15adc1fd34cd86e91faacac7f159a

SHA1
72e71e093081333775f4913ab987848ba73ce666

SHA256
12ff54ca1f2227a91e8ce04080daa824fb5964a7d00e1fc2fdbc9418f23f5189

SHA512
9f3a5426835e81185233e7429566837fe48c88cc6d409c7cf2c986467b1cfdfd1ed97916903083793e55f9db34a2dceca92e68cbc18f3a070482e8383da1c98c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a526a955150051734ca72d333deaf7d

SHA1
9660fe5b85d29845621c118e297c34fb0d97f8a9

SHA256
b5d063e17e8b1d9cf1a1030b315120a972f6801bd9e41831dcd7480b4d8ca14d

SHA512
b935ca3ec628bb0b89aeb86c13f5353f4e710579ee5db9b78583f64f143deed2cccc288d50e7d9eaae2891ba034587c8e96dc1a9d7c2da25ae1f91fe257efef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e8be5d82fed24a78ffcc8d72fc9fa31

SHA1
f131b3eced969b82edc7bac880c17a668aced9eb

SHA256
640bdb880c2f1bc6aa4df90bf9d41a47368c2625b43d785cc0f13ad4bc2b37fc

SHA512
0715314593881985243dbf5cb61a7d2a51343034e52325995e29e9844c8d5f05c68a1a305fe08fccf237b5f09b504cb401fbfce70ce6eb904c5e071db34ce517

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB983.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB984.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit