799144355716fb714fe7255f0898cf76433728b8768f8cefe5a82abd38e57ed7

Analysis

max time kernel
223s
max time network
286s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1888dc085018a1ded969e884fe17cc48.html
Size

60KB
MD5

1888dc085018a1ded969e884fe17cc48
SHA1

5c0a27d22f98c6e66c313ffac69afffaebb15891
SHA256

799144355716fb714fe7255f0898cf76433728b8768f8cefe5a82abd38e57ed7
SHA512

724d2559351f4743d15f2666ba6a1079bb5203d2f3fa6559de9a4adb23d13e79849fe683f750de7bc218c91fdd331c1ebb1495c76f8bb73dfa8a6f2875fbc1eb
SSDEEP

768:+6j6zqLoJ9sFPNEfBwHp0mSjaPMsPoySyQW9FDvq2SaDVw:56OL86JqkI/UFDvs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000fec5d4ac3f539fb3827703fd12eb1cf428a85685c45c72fb981ff7078e6d2de0000000000e80000000020000200000001e52516fdd1e3d9ddd340b8d7a74a90075935606a24e99a7ac1b9dc0e811cfbf20000000ebb638edd4699a204ad6588a8d161af4c7b391151c16dfde9101d86dd426224540000000e120b15fb925b5a2e41a95096ca060a789dd5f2cf9574fcaeb1772bd9135c22ff799a789620ed434376f02f1ee9e2815e14650daccb04ea841f22d92922d026b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e93b7fb9c531a98f8f95472a230a6331196b39e19938e0bd18517f4c56559abf000000000e80000000020000200000009697fd923c1cca8ec5bfb856745604d3267c957b9a79277e3780542af4b3754c900000002a8e5a5b5bdd38f88c605660e974a5a69d543ce8c4b6232e8b40138d398aa0428f8f4547865fb7f050bb0caf7ba95556b0ad46963fd33ddb3fa77184d797d2e4911e4c24194a818410efe743aa51220980a5570b691aff2f744024f065b42269849140afdfabedd2efe2cc4af3f4cfff651991b4d8bb2bba577e0252911f5284d6e751ff3cb3cb9221ea4b810fd9ea0640000000ae0b23e89d4ee2071ef1e4f64bc103353d985ce8778fefd7bc0867273953d63de2e69e296ef843140cb6bb7f7c964ce4f312a914574640874d7e62e5c841eacb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5063cb092d3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410218518"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A402F90-A820-11EE-B311-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2892	iexplore.exe
2892	iexplore.exe
756	IEXPLORE.EXE
756	IEXPLORE.EXE
756	IEXPLORE.EXE
756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 756	2892	iexplore.exe	28
PID 2892 wrote to memory of 756	2892	iexplore.exe	28
PID 2892 wrote to memory of 756	2892	iexplore.exe	28
PID 2892 wrote to memory of 756	2892	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1888dc085018a1ded969e884fe17cc48.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3c4193ba63b6ff8a8fe68715460acd6

SHA1
d37004d60cc5ecb3f11e9f20242b9ba3b2f1cee5

SHA256
5bc216d528dc1824ac5f9799372f28790b5eefee4cba271cad02eea8c6780531

SHA512
42de6c2b70a7b424ccc1c1705924abe23b2eb496dce022ba0f90b866c79975e09aa94f5df9db690355d8617440399e4540fa4d1d4cc824b82030e0cadd22a0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88aa4acc358db6b5f958f0680420b139

SHA1
3335898a2f71efe0c2f29b03fd41cf3026b001ac

SHA256
3e213bae8915ebc4dccbc3fb337e0cc86db3c89017a2ee0196b0d9e3b137df5f

SHA512
621e67f8b364f0ec20e9a41ffc50fcfcdad0981e640f5f6830d4f4bc28e0b2351072536bc8c86d0964f446f0363f2f192c4b627a3c1d8e7986777925c5a5e9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf2a3d8fc094788253743d4964d2cafb

SHA1
83b43bcdfcca0703a108d75145e48e66daf721f3

SHA256
d69bad9be337a79e51b2735c78806f04eb2a3080f37a6e7e45766f709f351182

SHA512
ef9e304ec57b211344b8e2d07475703ef998541fc997971548135017b09aa449d910ecff4463be19e595b8d58e8a2ad1c3bd2f37aa8e69353cb964e1332e301f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4447e6690f4b8cdb4d893811c6d0e78c

SHA1
fc96206915588d7cb2e720830d73645d86d77254

SHA256
5bccd7dccebd108d4d5a1f4b2e6a57a44245bcbc3edb3b946274eecb79fbd82a

SHA512
a001502fc2fdcd62b3c93bcca76c69a28b5d132d2c0e5e9d8abfa72e2ede4dc1d72c9115db5bdc644dfb964156a428cfe262fe8eaa9e51cc30ebd3afb72e1690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
088d8d8e47b89711105544d46a992225

SHA1
322b29e3019011832c5690d64c939028e36db7f3

SHA256
7a6e30abdeb0809b68fc1617fcbc95b0c057dc744bb424370efd41107fd814b9

SHA512
d58624b84e0a8a23db1fec797f972bb630b9bc9bb6bb9eb393defb08350d3ff416a14251cadc53f5fc1ea2423ac15f25f951b2e17124f02190623d1ba56155aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e426c5d46ac10e3f06f57e923f20c516

SHA1
209e047a46f89ae294012e17267a68ac90d89e76

SHA256
ff75897799cc18eb40282ce0ac82c242d695de460a90488ef31ce772e17b57f7

SHA512
1a64557baede04b9154594ecb443b213bf1323bdb5ffb6c45f1ae038bff8f5a93c7d9ec375ff1f494bae6e248e454ac70aa1168bddc9cc5c88b04e9361e097ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7241bb1b98e7b506de56ce623e0ffbf7

SHA1
6ef7ff50d26a7895d5ce77f4c16e314abe8c7ced

SHA256
372e4967035fbe702e925c0d0f46eb566b20179206dc6b8cdb68a5c14e201cf4

SHA512
cfb3cf275a2e53b096247d16a5ef365c0866bb6924b962487032b662aa363ca46724fc66d1cf535f9da2040e00fe03061224b42c98ea608150918b5bf95f0344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
828ea4892d6a3b8f8c6f6fbd88927d11

SHA1
083146f7ecf573a807681841d4b4a4e4bc0ad11e

SHA256
01504337336ca38f6386c447b2b04571557664da40abf3bbd1cb20de1ecc96c2

SHA512
97ecffb1abc4988f869e160cf5cf720f21d3313abc6d963f364027663cd833fdbffaab5d4af8465fc6f6b3b0acb63a46e6405fd98fbe7116723d26b1469e1f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d365481a018cb9538902df8febd44417

SHA1
782dc7a9b22a13db17062753c01ff6b21a4f1ddf

SHA256
9fe808a61e623d16667d8988e5665bc3261ea295c14f0925d18ab29f33fc5e1c

SHA512
0ef29857d6ad462782c8cdb5dd2b2be9e56a714d406287290cd80f0cf9c417df0e102347a0a28935ccd4122190d274ed4b06a1c25eefd33ebee6f031f8d5f322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
255ad69917312f323c39ca35b1e1d493

SHA1
d2f722b73381483c03bdd89291c21fe5df904332

SHA256
5b7e45d35ee75928fc5606980e65e5e9c903c63ca4db18bf679fb7e9f8cd2e9d

SHA512
19f03d36fab76caf2fa3e8174c3c3be72cd4061851e2d0363d60bc2bcd27e783acc93a98ccdf8aec0e6eace30e6d84efb1a2d49fc62f713c4b0cad982610814e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4d04812022e11236dc8e529bf2374a

SHA1
cf31cea2fa9967353cb8ac26a0056af0188c1e72

SHA256
d49881ddf91a1c7d567cace4f55650c0182add854f895010b98a5c21851e19c1

SHA512
be0a5c8af2bbc985db7f3a5b32f200d0bb661cbbd28ff89d625af5ed0477b5946019225fdad81a23416fe9f1b2bec67fe26e63e23d78206a01b0dd286a2e5dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f2db0434eae294a0425b5432fa7e8d

SHA1
e78dfa63daddcfaf6aa8921185b01d21baed19bf

SHA256
38972ebd0341425231da43d28213b6571586ffc90445ce8864a21485b229bd92

SHA512
bf2d3096754fcbb656cc9c2fc8a1d7ea485294bebed9f5b234897d1bce1f7e5e69d330bdca18a3add98ec884d1335d6bb1d3df957e43d33f91e06e1514218502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b31f83b9419bcab5fd5d38c4509c5d15

SHA1
9d4f85ca8b236536550306901781ba7be4b735b8

SHA256
5ce502993a8fcdc094836e8f347f9149b509ef5a2ff3f3492f437821a77f9553

SHA512
a8c153f568d0846486796a395b9884cac67a2a3827a3c275af27c6e7a7d5bc07bde0268b701e331dc07e35a41330eb7df13310090f09bafe2bf21108d0651cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F2E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit