72c55227cd76940c4cd24da2da62038280e668afcd0ddceef3adcb1b4e23e25f

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

189ffa1bdb075d9d54cfaaf8e01cc11d.html
Size

30KB
MD5

189ffa1bdb075d9d54cfaaf8e01cc11d
SHA1

df6d4e560c05267b1ce406acfc444551d5d785fe
SHA256

72c55227cd76940c4cd24da2da62038280e668afcd0ddceef3adcb1b4e23e25f
SHA512

9db28b3cb8eda082a78c964893334fa0eca294834af08f29510c6e164cbdcbba29b3a13552ad35ead8c1187064fd195b78c03a22e2370bb0bcf641c431599739
SSDEEP

384:dCVbUgZ5GJzrWZD+ySj8qBoaZsXMyaKCf:gVsXWZD+9jf9ZsjxCf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{249BD6A1-A821-11EE-87FB-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e39b371ede972caac45be83d66329ec07ca3fcdc8b58db10cd51c54a6b8842da000000000e80000000020000200000007f265fb4cddb6fdd85f242e578f106d16fcf511665d93f4edd735b05d51eaf569000000015582882cd46d1549f651d60fbe1c2891a0cada0300514aed8ec9ea948e8dea53e43a3f754c0b1a6073eed079873a0fea9d8b647e2aea6d684b6c10bae28b74eb10e2b0c0c91ffe9e3360b1f5164e35f434d67f8dbfba47a144d3f31982a415517964ea8ffb316eddde336426dcabe9fbf4d457d8ee6624dfe926335c018ecbe90a71c66b88ad1833f00f22970c9dffc40000000b724e3ca62cbaeffe4eeae2239e96f90091306d7134015f3795f40378b663bebb44e2fd04efe7093bebe82ee05aaf961aa1a7b9ed9e31c13b7b9b7af086e5940	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fd44102e3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000035eefcebd4998330a726a0426d23253f60fd13299e0595d763c7cc1168489abc000000000e80000000020000200000001068687a5cbbc6bbfcb949cf10c14046a917a3aafba49375a23bfcf5f1f08d2120000000e88f03c0a29819f83d69aaaeb07b8f15e27a488fbef768a691e717cadf2ae71c40000000b9105d872b3b8970690fb94fe466abc41c222b9dd195a040bd33dff0991aed59e6bd98d8eb3c5eeb04add4a94bc1d795dade26edc9016832b255711d872d64d5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410218957"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3044	2212	iexplore.exe	28
PID 2212 wrote to memory of 3044	2212	iexplore.exe	28
PID 2212 wrote to memory of 3044	2212	iexplore.exe	28
PID 2212 wrote to memory of 3044	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\189ffa1bdb075d9d54cfaaf8e01cc11d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c3791790e98a62f0c8d2eef190bcf2

SHA1
9c10c20abd233e20ca842fd06dd8ca579a7c56c9

SHA256
c878d23af9c564754522508217feab010dd245deaca9e729ba668ba702d980cf

SHA512
9a77fb304cb2e65d0f249467851948c03b6c98d92b770bcd14e7dd555ce5e89dfa6802b053a933f82ef8ee94bcbbfa30efc76438da2919e18520c360f5f486fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a4f31d37ab62e1bbc36eeef295205f

SHA1
5b0c3ad81572c0ac962bb752b83dd85453975221

SHA256
91033f46233376f90b50e3cf112de59e5b2a2854118b277650db01dec2a294cb

SHA512
b9a88465ec38ba3a0a0a301dc64b3fe7b21df2e180e1eff4885616731e3c3d54ecdc093269ab15269c358b513d20a2eb83c8a55f8100076063b8753122f0b9a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec7e692b8689e61919f0f56212d9d4a2

SHA1
3221700e6167a4838b4e438c0d6ddcc3b904666c

SHA256
6258733051478017dedb27c902df1917c608ceb20d71fd0547fe4da877e65347

SHA512
0df4c1a879077e7637e13140fbd847c9db3f340a6e0f7530c6a430324daa872dc7eae3f6b1f6fb524543ecfd823a1c360653d09e559523440f2f99bc9ec8dfda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e15c774c197570e1915af7869c2933cd

SHA1
1733a68d7812be2d370423913452dddfed0f2d8b

SHA256
32c55c8e01820efbe083c8f1feef186830ab3517a6b3ac0be09ab5d94e362435

SHA512
e35bf3d878bcf45916dd2441e5ab5fe3a25e846595cb93c0fadc267d243082e6c6cdf72d4471a46bec8662370da5e7ede3f59d36b2808303de583fea903f513e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe8a212811946ca59e8f932d2fe6a67c

SHA1
99d2ea402cd5a7f1ffc441b67a7935f67ce692ad

SHA256
814152b2ec21460a55d812dcb00bd45c6f7b4e009f714ec9f0f47b6d1fff8b71

SHA512
4534429872a5ffae39d2d070aa211646ec302d399fa4d52f8b210c2a730e67506a653e26bf6c2a3aa714a1717319ea0bef4289da32595a2bf9bc8bebcdaf6386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0049fbb810b8b5a087cd49ec9177346a

SHA1
833c21eb70d67cf8c50c6553687689efe36744c0

SHA256
f615a17999e84a7a624e3ca31b6b1479826b809fb5a03074c25c06eff59e3991

SHA512
79b42eaeacc68e8d961ba8baf4fdabfb4bbd533a9a01337be683c298446f5eda17a0bd6742e8df9691e3d1d0f0a6a2beca74a7aec9896c63434ecd6f2dd48f21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4a49f3b618891b6ac3a1013e8cc48b5

SHA1
4390c3996c3371dde720ef80783f03d2236a34f4

SHA256
885e9bef09b63141dabc13d161af542863886689e450cee13d0102b479aef158

SHA512
c88d19c60f38cbf7c31d0c3656277c27a93ee83122e55789bc32baaa9e584e05656c0a8787924512f7c2915322a60602ef3c3d5776446bee443c70391b6f266d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a94cb1f9b5f98e33f8570e443543f76d

SHA1
9ae7c0ae73366af0421708c556355c7b05e6a4ba

SHA256
4aac1339056c7f8def808a434f798a12eac5799673c52eceaf573466fe5b1925

SHA512
0a3b5b449540f098a41c5512fa85f3b961ec477159b1e78f32f376a8fabf8a456c9f83c76257e9275ca6a0312453049f8eb3bd7d12848bbf863b6d4e64c84d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39666fbd84fd07625f89bb7f07eaeff1

SHA1
743ce249f03362ee8e6f7b3acaa47d090755e6ff

SHA256
6e4f47361cde464ae4571f975491c18ee156e328a2a693bcf29004e5b4cb69b4

SHA512
57f1a3e2c6f538eae6f54d587a0678e60ff167b4ca51d83113e3c5158ade60da99f5c564a0fd95cfbde9cba4b0fa7a9ff8eda3f1e949d930f57af2501b3c4a55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc558812dd94b47f6b2099841f32b586

SHA1
ca30bb1022fe4a8cf1bc0462f837eb4e0386ea37

SHA256
a58b44373078c50c883fa65b91e3fa6edbad38334f753b71c5a9ef48917c818e

SHA512
931e89ef2088696ce8d17641e9bd281a10c9f340f423113bd4d3cc61222662e89aa10d73934f4c392179b6725b175f15fb8e452c99906773c39fea59f665709c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c1ec95d86e9b5567442d267412789b1

SHA1
80f2061be40410e610748dd682bb9a51438edb4a

SHA256
431540d3e38127339598757d9564a5eefcc814f6507539a8637e4a03551a5b05

SHA512
259ab4d08c50fbaf5150c60f5587ddf631360382b68b91a7d4758d0460b51631cb9e00c51c7b685c7458dac061cf1491bc359f8d0e2a423abb8d7bd9b52ea36b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb7eca2b514b617cda5203b6c5fcaec

SHA1
01fe9560687b694fde5d82b13fb254047d63b0bb

SHA256
47e4144e209e289790c48b91b3b7c9b5948eeb4a6f7f27ad92a4f321b8aaf9ef

SHA512
17556d5cfc536e79ea6412572ed4713cba7051468ef8af94d6beca95f2eb208b86133f97480278ef066c3c20cc90c5117469d76eec036e3aeecffd63686e072c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF72E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF760.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit