0ae042a4859fb178fc4bf08787c324dddc2c32d7e6158a1538b4f930850add92

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17704735f9fe2c861126ef37fa0375e2.html
Size

94KB
MD5

17704735f9fe2c861126ef37fa0375e2
SHA1

bc234e47c6863c39b9588c72c08782e411f63811
SHA256

0ae042a4859fb178fc4bf08787c324dddc2c32d7e6158a1538b4f930850add92
SHA512

78bb0d33ae255ebfb387cb180fa4eb4270012d57334020aa53539030988e7c455b4121fb04c99d7047a195071a5bfebb8f4e5b73ce1fd52dd516abdc93c80396
SSDEEP

1536:WO24+SAwk9l9elgvfqXsJhVnPEQ09i0e0a2xAgr4A5mogThJXSM4J9:WO24HA/9IAlnPEQ0Y0s6AsmogThsM4J9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203c2cbd1a3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410210692"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f4c44141aa1b46cdc6d83bd82fd4ae461c08dc9d95997d2f075cb7c4fc6a64bc000000000e80000000020000200000003c9e3e37b585a5257e3a02e6fb8311ad7f62a013ab89a1254a87dada8f97ad5a2000000097d04d99823acbedcd8ab2e63a4bd884fcd5c76d6337131d1028675caae3576540000000b472482baf8214d9e26872877d9aad404c05cb5cf84b5eba6b54984b50cf0f523f52ccc5c475acb1de889ea52f6828d59a5328e8279cbded6225f331b5b82a7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7D5ECF1-A80D-11EE-9305-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000bbfed1956ffb533606ed02f1103c10da9fd2e155c3f7f72ee2716d639350ed8f000000000e8000000002000020000000dcd42238bb119db02d307d6d40e251aae70119cf136fd0e70e5ccce64c3ad00b90000000658463a74b55822afa2095303ad9305682d9a1254e5990fc257669febca5f8a864528681cf8642ac5cdcd1ecfe05c1453beeb319e7eae09f2ae16007637bd9efcc494ff19e57d063ec22f7c4575cb8b5b44959a4f9b4402c11c67b69b6c5aa903fbfe1f63ebef912019f2e916bd9b9290e16700cad387e88fe39df4d16e9c32d8c4829f81dc2eca8e56d4af276288db540000000a4a619ca20073a8201510f158353785ff77e12e0c72e3a903edcd528c1b8fb755919e349310830f550eb591c4c8ec9d76f4d4c775d2805d6ab715aa53fdedb88	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1724	2180	iexplore.exe	17
PID 2180 wrote to memory of 1724	2180	iexplore.exe	17
PID 2180 wrote to memory of 1724	2180	iexplore.exe	17
PID 2180 wrote to memory of 1724	2180	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17704735f9fe2c861126ef37fa0375e2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
ccfcddc5783df222be32334d1e05090e

SHA1
fe2c3224c7592c6dbc3e3b96ca06052cc782f4f5

SHA256
6a122ad36040054639cfdf034849cd5bdd95f20abb48a81c0b75802784a3adf0

SHA512
5748eada6302b4c163067adab7a63164b593c26a45d58e43216e73f99709df68a264267ce22a23a5a3a376e8ef3b3cfe0eb27b4b5d160e45575e1abf6dd2b335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7b2930b5675c9ac5b6ef6a15d2818ad

SHA1
e49b6b746e784549243c07586293a108ae55b1a2

SHA256
6bab6667cfc2b87c067680d38a149601b563317e87fa4cef7d0e7347c0ab6922

SHA512
1ac9af0878589acc46a3358f43b7645bd6e2e5b4076bdea615df8e2ac0b44eec9b0b9d8805c04dd6909b8265293860ee0315756eccf9841c889ed9cd4ee00e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9725a73bdfa5eeac1590fbfd1dcf3588

SHA1
5e707eae035784657d174134d1cf73a67930da81

SHA256
f64b5c84aeaa381935340947dba29e7b9736ebe43896224033fced4be4585634

SHA512
806c1321eabb790fc378cb6dd269c97889c05078205812b0e539747b495226e33df9860771438ea2c6e857a9f24c4c820df3d4f9a4a9efeac07a712e618730b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c136bdb35fec3d62d1e3c9919d614b8

SHA1
94510c9eed444f30e89fc513bd938c596d46f649

SHA256
c169827ed5a8c12f9bd33de1f9681b2769cb1e8cb4deb6fcb038a8657a05dec0

SHA512
4b7dc771315ffb82e929567e9b3a0bf00aba6aa8ad1332e048c832fba47b30ba0b81334ca6de1a6d426406b833c64771820465ec90a96aa85f0a89b84abc6d8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2433f1e7da02f5245ae79c935fd30813

SHA1
3dd17e52ee9bda01369749c687f3d701c3136385

SHA256
c1803dac96fc9d1fc0dc5331d14982109ec4e52188c2e868b320cab145bfbe60

SHA512
63e27cf76fa7a6ec3c3f662a91ad01f7d6f64a587487c0c8c738837c63763e736904d37534bd499544226d296114e8edfaa26b98de099f72c2d477c0946895b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21cae65a95193a42939fe6dbb912727c

SHA1
3f19bc2f5168d962d11382270fda081b87e61cfe

SHA256
f9a0f065efcc585d6d75a10ce544479125d3ad8c90dc3f22e26785857ccee570

SHA512
1a282c4f9f422100d52a1d066a757895ef92bdccf38142a794f87a1256c21a04cce05c85d6381bfa589472f8879773f6d9c4a0f69ef3e6c68557c254fe70e5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f0586fceec11e1c63e4bb3558fefe1b

SHA1
821a2f5fc25c9ca319898d4bf3e7fb68c44ef80e

SHA256
f3b52b4ddfbb6bd442c4789d06561793451308526da59f2e6545d8bfad5bee47

SHA512
43399bb0b25868892c16ac3be7d8c3aca196ffe53503d76e6d98570f593a4451b0e62f02bc5fd1495ab2e712e87378445b559da7fbc693a67aa5f84e694882e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1b5b9994ab62edf75f837cdd546a3d

SHA1
58171db6cbdd80edf5c75af62927e14706b575a7

SHA256
c039da0ae5e051fc19b04a16c5fbfe02f2a9d417f3def7e97e271b84668ad1ea

SHA512
68fe0d90f2d624cf15f32ed175a103ae67f13d8e226175d55c6772853fdcdcf711a9e3881e5ca523d713e2a357e539755f449ca64ab5d3e80ddcdb2b210b019a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2bc87b7184dd4011b210116ffc41d7

SHA1
2d68f6565eab66998e88ff675a68d24f220ea2d7

SHA256
cbe9ca6729228ee84db925b66036824fc8653aa8d485d3e39e09a2a1b1eab1f2

SHA512
805aee2eca4fd9b86aab72e6058df7c0fed41b6eb4226f22fe36e02d7f4d06cd6818f33dceff0df12e42ce1b1e25909cd368d93625a8726ca2ecfd45aaa85fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b0e79e7a8303b7a702afa4b134cbe62

SHA1
078c264883b75f6d61bbeb7147dc8d953fcd7f11

SHA256
85b4a8880e7eb5a59798176f3395a25f96f478c44b38d690270c916266008fcf

SHA512
7cf8b8dbaff59af7d35b53c5a8bd03609303b8a8e9964e0e520afbab21f1cad9fa698c95009c352430c695646f5b1d3740d2437c67bd9abef062b0b1d8ed91d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2721.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit