500fb6f7bfb00344bad6e23e25b565e871194f1d2c44f5b18f5996da8fe8001a

Analysis

max time kernel
119s
max time network
181s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

140bef13e644196c8ba6d6b97962a8cc.html
Size

23KB
MD5

140bef13e644196c8ba6d6b97962a8cc
SHA1

ec68651e30000bedd47ca7f380964c4c9db1cccf
SHA256

500fb6f7bfb00344bad6e23e25b565e871194f1d2c44f5b18f5996da8fe8001a
SHA512

d01bd11ce875dd647425991760bba93ad3526f8ad58af3171704e099de47b012edbe8d02f435b73b9d2e6efeba96e0ca651269383cfae5cd4d5a1bb9a0a384c5
SSDEEP

192:PauTM0tcU6uzv/FYoHaOb7GAnGQ0bGGGe1R3L46gma6iszEUq9UuRbIMxRNG0R+/:iu5CXYUusuyNE59t7dalR0emLcgatD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000cb8bf28bceec2ecd669a02b88267ef55f35b17da16a239d093ff23da2ffd9c0f000000000e8000000002000020000000ec75488eacf0913281f5bf641b8052161f65b9ce6420c2834a175d89b35c141890000000f433b0e6e1a19345070608db05927f69d279c459d4b78b93e41ef00815ef4c13052931c1cb8e98da6ee64e5327b771558969110f403c56ac4e23b2b044085949749933db8ebcacee37096075c8dd876485e6477a1c581791b86a5e8648b005efdc205b06eba2c207e3e4a0d11be8fe18b2a53cac9f781368a5edc117f5341ea1ffa82bee96e4fedd0149ef9d0119fb4d4000000011a90d5232bc1f6fbbf9a77a4aef1c9211215d85e9e49d4ef1d36652cc62614a920758aa45e6b72846a4e8907faba8de113d0ca705fb74082ddf8684be9be44d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{252095E1-A7C0-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000003cbc403ff6314b3ee1b72c47bc2c3288524e363dc70b62af1d67bbd466a00022000000000e80000000020000200000001d4900d3473ee01a73fe6859d8a7467770473f1fb9f07e2d96bd1c49d0bb016920000000b3bce10aaecf4ef1755885804a3e4b947ae0cb9934cba51bc3675a7218f0842940000000bc9c196696d850d2811b8c83008359f87b90b0de6079cdee31a28a48ff15701fb2be08ffea9dfe30595a37d984e6914b5391951b4df07990d8b2c2ca09ad3561	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1033cffecc3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410177296"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2600	2296	iexplore.exe	28
PID 2296 wrote to memory of 2600	2296	iexplore.exe	28
PID 2296 wrote to memory of 2600	2296	iexplore.exe	28
PID 2296 wrote to memory of 2600	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\140bef13e644196c8ba6d6b97962a8cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f144b351e499a1da077e5bfa63af507

SHA1
607d3fa70489d1786ae24bb053d311da38dcc05c

SHA256
704ba0bb2e6d8c07c01ac7a3652fc19228b9b6f4777d5add7a85bd4be93c417c

SHA512
50738909626c0a1e12dda9d142c6b3f28f489c2a8abaf9282e1a4be1b12cdd58d93b4d322f513a296adf36ec67bae7c6778318363f83de10d8bc9c1e09b39579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
764ec98546b74db2cb14e11eb17152dc

SHA1
176673a7262108b1c3e22644d367a764c18de461

SHA256
2dcebbf340adead2395c6a2339ccfaf41683e27e66e169516066f46d512bcd0f

SHA512
b61509de054c3b298fefba5246b90e8e1525d957e2515c2062fd6535dc0a9891b6a5ead8cabf5b41c951d11fdf987930f7b42d240d54fed4250c304181a337a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e2f25b8ee532258e04e3dfce356e0e8

SHA1
add648ba5a413fb8e4f6de9d32f50bb138c16697

SHA256
e96455ea599c62ac3670733419cd201a12ce3f62db83310d24d085215597fc4e

SHA512
8c5152ee9c81f2de03f2a2d4b94f5ba8e7455e912a05d0eb75d3d16c6e9447626dbace05bc4ed21d0b1d8c6305165f77597d246bb46ad8162fab54359e96ac48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7b1d53bb60983a209ccbc938fd0b66c

SHA1
ca09fe9bbad537df59df0dd261bef42b066c847b

SHA256
c1b7ab1a78287957f58c29132a2f9060cc7f86f1afd7f397e4dd8d27e4bfa20e

SHA512
17f6e9e81294a6dafb043bec7de68341a1d7548bcf6c43746d24205ba9361ce9938a9b67fdd5234c92d295a501ee0a9b564232bf59521361ec8ad65dd0416aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061138637bf4f8a5fb43658d7f1dee5f

SHA1
d027de85f6608630711c589d462178d33f97e6b2

SHA256
647a5f75ae8d39086a317cd67793c76666a1a4867123f21a03121fa7c77cd2ae

SHA512
a86c4c8a2dd45d94858c71fcb1a6a94a60930c66831e468f35b812b17b2256835392efed7f338cb43668089d2e3b24c4c7548fb92ce7bdda1c27d0da367a8b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d28a50784fd84e5d66b969ff5ddb371

SHA1
6f0abb3067cf796e050a3c0520a14b75817bd306

SHA256
f6cf9e1164bd0e9f95916390535e0b97b4531d0c9c41e2dbdd638ebba157c9ca

SHA512
28446101c1a4cee8e55f0237e1e02add6ea08b7f09d75c077b2dd55dd4d0271e9435b11306329edee4253900444f27de45882143506b16050587394d5950cf50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b7966bc78b86337a63f89b86804943d

SHA1
405c2024a86cca4df62b96ac3fe90d48d5bed36c

SHA256
9fa014a16de7ff6b79300b229fa5228255e76d33761455d6106b846f61d6428b

SHA512
5fc49f3f19c40cf8e424315e20862e11755d65d5e104791896866a4a711cd08be49ce8d1cdb1511b0f5af8fb04abf0191f9d28d8f4174a1f54eb1fc0c62269fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04bf61db05ed2725fc0911893c35ae45

SHA1
09865f874300eeca986b744f22b1baaa9a3e6da9

SHA256
fc7ac6b8a470ea30a93a1354f69d171cb80a7d0cd127c201a1482ce4238b8f4b

SHA512
d4e96e39966565ce17f60952c0019a4bc067f65f5e81172cea923ebb7f516ba4c04b09fc531370750b6e06d6e77b31eeb0db70c114826ba3575b48a11621837a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e20cf161fd4ba71fb2c78dc0dc8a87

SHA1
b81b3d8fe274b3234ea3c0400db12e8c6ff1f1c4

SHA256
0e046937764cc8ea4ee544009ca7b0ebaf2c4379231839991ff2f9f228defd26

SHA512
dc0e6e3e59e4b36cb5be67d55677b7ae4735463872f67ce9a8d9e389d136ed396f6c6f47f20a479b5f2f51ab3d3af376699c6b326eb580232223465a152b4311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9e2ac0af06f1eff97ac946c6b1edde5

SHA1
9b5a61d80cb6d91b33a5aa8bb2b79665ac5e61aa

SHA256
2899c0de18de02bb27e73a4396d28187379d644728e7617d5b27af7a29547ac6

SHA512
0f74573178f2471742a552140f0ad76d535908190a1be0df8e6d0091238919e9061c1a83187bc466214dbaf3c8a27964c15249bf19914b67ae074dbb45cd421a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f667f58ecfa96c5f392d78481594ac01

SHA1
61b01374c3da1c5b42092321357c9477d62af43a

SHA256
8dd64b810fb0c34be91bf5c4f17d48456d8478bba74deb86eaad300358231f88

SHA512
feebb82c5dd38581eca2f45cb0df7baa73faa021c025fd88838dd41b4dc80fad5904b83d9fce2812c1b76aa2c72417a18f425e2a17cd7665e7508271658583c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c01c6f8a7ebee7f43d79e7cc38a20ee

SHA1
b86a5b4f9f6d62830ef0922ead5975cbf9a07325

SHA256
ea093211b5b90e1eea36fe2c3ecacc14f70a0178dfc6d5cf903866647c7e5ba0

SHA512
939f71f6c77537f941910e81a3e15ef1cac678567922baf531e34b536874f1b0b40e62c66c0f41c5400d07800b1cd3eed505c4e2c89bedffdd6330339f48bcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf526cc6afaa69d15ff5118527465f23

SHA1
670963813d9d08d073d357ff3cd778b77652d208

SHA256
490abe32bed5be64eb53ddc1ccc67c9fc2dc904817ae5baeefc515cfbc55446d

SHA512
ae960250a4d67aeb638b789aa22cbb4030c7b9bf3570607c88456b249afeab51b5ae424946d1db84e2bd89c2ffe252a67c0f261c8f30b98772f194d782b4d360

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD107.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD148.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit