0beded73bd8948674995ef7cc999ccc8dfc2a58a1f35fdb6c4456def2a487d25

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

137384055a747f46179d50220f0736f4.html
Size

14KB
MD5

137384055a747f46179d50220f0736f4
SHA1

96e4dae1f2679228d41467aa3b8a8e20b1fc4dd7
SHA256

0beded73bd8948674995ef7cc999ccc8dfc2a58a1f35fdb6c4456def2a487d25
SHA512

4136ec4b75a590e5cb2850c9757a4421817c0675798ac822ba7e51d62e268c923e95e605a2be52ecd633e63563c5db32bfc02932da6643f0a29602e600559a04
SSDEEP

192:SjtpfcILtS+bTodlnJm8Qi0S2Ia0rfWILLdSEjdO6FosLcjF0Ria1Fe47DsXDU:SjtpfjtS+AdTmXIDNLdSE2jEXXp3szU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e91aabc33bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000db35589a794051ea6677f9bfd989128adb46f4c5049783baa5c28fdccbd8248e000000000e8000000002000020000000c1487f739f69c1f399d482abbc7758b692805af851f32e1c30b00f49d0df64d9900000005616a385376fbf6e016daaa80bdff1516e68e3419e22b90e5a79b651fa554d96307f51b1534f724ec394cd22740f1f0f2e759afa74330d045d91f19633faa8b6a6002f35f11cb02184c5f0ead9820d7d71a5f632caafeb83fb1c9e19f36d5a4c43faa6062f6935dc8f17df8ba01fed6e7b61f58980d510a285b301411b79bb6435be56ac8550eb9e898bcc320147b4cd400000002be297ce67bde87e267269528c335b034bb4534133239ed6359c3862e9722688486d33995dd17ea71b0a5a076d59d32ab2209ddebf10e9ef1c7a12f6cd4c5709	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410173297"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ddfd1d072d4e8aaed26de13bad6e7804a4d0d8264b55159f7d4d1afdd0387825000000000e80000000020000200000001e36b38a0afa3f9e0d80dc8ed71bc93cea559a3fed90bae5e90efe420b8ab98c20000000eb9c2c691920968f265502ca6f6aabe5b6236e4e0b16672d9315d0a7d3e479ab40000000119c60c015ba609557ce76174f8b1ecaf73cb202021ed1ab6b2bfb60877cc52e0336eabbe19992576aa503f6d8772af5d96e2bd5a019dadab40199b69b5a46cb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D521F921-A7B6-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1204	iexplore.exe
1204	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3020	1204	iexplore.exe	28
PID 1204 wrote to memory of 3020	1204	iexplore.exe	28
PID 1204 wrote to memory of 3020	1204	iexplore.exe	28
PID 1204 wrote to memory of 3020	1204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\137384055a747f46179d50220f0736f4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38ba516a7ff562622f798523b94bc3b8

SHA1
98cc0ffc6bf4cb3612da08a4a1f68cb5d3fb26e0

SHA256
e75458d8b4b0bec992f50576d3e366b61271c46ad6136a67cde29a2d1a5ba731

SHA512
f799cb1c2318cf6adbae57fba0fbac0d3dee61e94c2308379d5de0c5faac87ed6092fe4f40e4a3b5b928876f069ab00274dc47c17089e2d608031488a27c10ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b7d2e175b0e36389d5f03db9253f98b

SHA1
fbc46f135e67ca67652c621d85c3deec82e7f83a

SHA256
abfcda0f733ce7980dc0dcfc0f45602e110dc2900775f6044502e7576b791f9b

SHA512
5738921cc80b03aae245d8f0cdec2c660f82c735906390e523db8b2ec20379f743f982759ab735fe7450a8b3978388aa3c59b9badc74d21fc24c759e8f16d9ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7039b2bd3cc995ec616ba0ca71379bd3

SHA1
9232303b0a1839fb764b5f13b5a39489490485fc

SHA256
3c63d48bcc397a31a768d133331e9115ae19304cc118c322b6f0c2f773b4ea6f

SHA512
b5487a35d5208a3dc6274714de60906f58fe6d48fd71fa1c2b458ef2ed2bcd37c4ae76b6f9e990cd6a312f9841deeeb14602719dda3a330ab03d3dc2f7968269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37c358ca3a35650d3a0570fedb9d8b8e

SHA1
747677dffcda79404640f05a357f0389686e2c8f

SHA256
ef26f3ea8869fdf653a6757dfc8120fad316f2aa1b76c0b54dee0ec18cfb4de6

SHA512
ff6bdc544a2568ab6169f1f533d5cf1bdfc651cc99ed06a7aab92f7c922a3b39cb91f63849cbcb32d1edb61a3d34df1ba57103b547f15878b33dc5152ec328fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0a4cd42d55b080d7de8c59af04a5383

SHA1
d87e9b62fbc055ea04f20a6793c39db6a7551e97

SHA256
c631c77d781a3d83885c0bd686227b62a4e249cee80be81bbacb947445659638

SHA512
0c62dee352c896871d642f5c9cd3bf771e17bc0d649110b2c4351191258c779f38c78fe86c4a8b6070692d7b133e5d233c2d3129c5efc857a2b8c5afdea8794d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4c92808f0ac37aaadbbd690a3d3f870

SHA1
95d8d498243b3c1d4914003806fbb7634b351826

SHA256
b97b77023be9d8daa098858dccda4f89de8b7e88bbfa26d623565205b41ce5e6

SHA512
058fc4efbfb05101b875784b41614bc4bce3292ce99dea9c4839da64c24825cbc33e5949bf285f3889539d37ada359399b46d3d570a41ee6ca75686cca0c8dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d7a34a849221c0ca43c61c63a34679d

SHA1
cdde3da2b0dc4dbe78232cce6a16ca2548c5b93a

SHA256
5f7c53f0fe92679abd1450d1d17354befdacb4d0222e0f42596a5b2a4d1a1693

SHA512
9fe33c47ee320a56c2bd9d7f1c807f6bcfd0b4596abe922d40aea77d1e90d420bcd5867fae0a47329c69461b08b85e7a05f2f866d71f26fbf1ad6731dff5242f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38269f8c7b4c83ddcf83f1118228770d

SHA1
bcacb6503d4c85f9e3c6d2752dbd39c927581f60

SHA256
c26695bc44c45ab5b90c2471026a4d13f221d8f9cc48ae1b6c319b312b31e212

SHA512
8a8cb17715f87cedcb991ca1f3628363eca1f6ad7ec40588007401bba4ac084f8e9c58bb531da437c24a1589dfa5b5952cb894f5512589ac21a5ba7c8f6c4d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7dc892624244ed3104f1b532df7c2a3

SHA1
ae95f4034a879e64dd4f4b0aa0989d410c0f0ba9

SHA256
1925c71882a037a3cfa7a93f319a7d7f2be92f664a0505b1e11a260e9f863620

SHA512
ba1c259d0d3daa0b38e0c0ba718ebd943d907d5731af574adb367df253a1ac63489c704f49ab2debdf4d784a74fe132e4dcf9aa5709dfa87653a5826410bef36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2d3080f5e54eba7e39fb7aeaa810019

SHA1
4a93cd20413cfab9f7eda442f66aa4656d58a0b8

SHA256
b32a5a6ed33ac9bd17f1f29560c1434f6e6df7fe664a4ad54a4c815ff195539c

SHA512
4f03a4731735fa86ba1d344f77392844c7d55ddf4a3f15fbcd91eacb0d3c1be31d33b44222a7bab9d2c53f583402a0b2c1747cc489b764eb2f16d615ff97112a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db69a1cc10e3300eeda86963bc3c33e

SHA1
4b898481c30db4f837785fdc8e08faa0a6fea22f

SHA256
af6c6270bf378847d3f4eff173adf09071e029d0fdbfa6c1ba9168ccd66b2b28

SHA512
4f93c6b0661f82f3216ad99c35b7cabe8e1d4e2945071a0f56974e39e1ed54f178023c991bc21726d1d0c7eeb6ed331aba4d65e9308e538e58027634096210bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e0abc9e6ab330794fd21a0da6aaf1e6

SHA1
ad039d92b36919ef00b1092789da8819b0ee0edc

SHA256
7b1a2e7441bc71035b193610e414395dbbe2424ac75c9a5b80ab446d1b3b9dea

SHA512
55ae1f7a24ef3cfe30189e981456a7184b0c71a1e74db7489da99f307c3a67eb386a5b398b72129be1765e1340910d5fc645019dfce7b1f6a72cfb13248549d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e0c78932bcc4932b6fcf5ae602e5f2c

SHA1
113990e10c34e36cd8e3a471f7d9ae2a5ea4b801

SHA256
27ddd93d826877516de13b1ec9e5a60d019d16f6c5d6327d32cd8a936612914f

SHA512
a2812af590634f7a30240b53ce4dfc6d9be72c8e95720bb763c31b8e232152df05e0a0c0fe0f11643fd6bd22f53553c739f882e8e0e84533b09b8c949f6f08fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FE4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9015.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit