dbfd7f2b53608371acb70b2de1fcba018c3c9846e26de297fa1b058bf5ad8dd0

Analysis

max time kernel
136s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196e68f8d31a07886b25537a940f35dc.html
Size

50KB
MD5

196e68f8d31a07886b25537a940f35dc
SHA1

11b00776673ae87787df123b094710e3dd385803
SHA256

dbfd7f2b53608371acb70b2de1fcba018c3c9846e26de297fa1b058bf5ad8dd0
SHA512

77c91651d73110287cdddc44cbaa3343c6bdf2d4904445bc466f91a313b5a82dfabbac6db1bf1bb723edcdc6a0a3ea2331fbe6898d479e8c622e7cb62e9263d2
SSDEEP

192:weDL12TLx3GvXjSgqdlb0IzZdKQ3gdTd8zZoLSw3PMhTSPPCL0/0YnCV2fQLkFO0:PUZ3GDazvDgdTd8zlwf/rXCk4t8F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{935CF341-AA50-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410459226"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f68bdc0f192e12d6c1c7e68e03f1de8cab9d2c9f820af22a03ca5243c1694709000000000e8000000002000020000000b0426f976b3172fcb328917b089097bbd79fde511e31822df4200a1dcd0318f020000000631c5ec1c2fc395747affa3d34c90dacfa80ca21fc826fc6c384bdf60d9a62e5400000005e303a7bd62846e96bc33ac7de36e6bb51cad9c655aae6a4c7c5d78c6198c30914fc35d6f19c32d2d2e8e572268e47dcc51e62c70af732a5eba289967aec8a90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100824745d3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000e35244652f2ba95ef2ba165cda4dd5f5d413b2fff991851ce5575188ab2315d000000000e800000000200002000000063a8bd5ba7c49cd275e58d1733516a23f6da4052c339f0b4d6b75cbae880bd19900000000908753f06c2c5262f65331d731acf51f52ea706a4c24c91807d23a7d8f7d4450a83ccfecdff21647a9b2fe5fa4642211c10791d463f0c9d3e4970c26e0dd0d4f145155439ee648a84e4d18b6c3bcc3df27d1432d11f5e86f834310644a4880de10c3d64d354c46ab4fc7f74a4a3660dd254308781f46980591dcaa7a9a1d294bb131d27e9fb1016c7f8549f9bfd20ab40000000572450bd1e411386cb800a1b17618dd62033fb8e8811095e6ded83fd416a93613f80ad187230ace5ac58ff3444940f6569dfb9583c7982a5fd404a9b37564ce0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2364	2636	iexplore.exe	28
PID 2636 wrote to memory of 2364	2636	iexplore.exe	28
PID 2636 wrote to memory of 2364	2636	iexplore.exe	28
PID 2636 wrote to memory of 2364	2636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\196e68f8d31a07886b25537a940f35dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2a819495ebbd37f8ca7318a91566241

SHA1
14dbe6631b0ece8e575d7d36eb036ad367e4bc94

SHA256
100513f6e38460c579cf7360c5eb1160c090144f8b5b5f6da4c530750692481a

SHA512
23b20b00e62694a4d13883909bf15b9a6274d53506cdf850b1edae99ddc1dfc30877d576892f5495529ee5f4ce26d040b019d2d71d129ec18963695df8f4cf32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdcfd7fd9033ecce3ae08f25e2d7de2f

SHA1
3a9262172d9e5a5ac7eec9df2c996e8eedafe71e

SHA256
9895f181b5e6d4fabd8b1220ca57f45e8e79a7007bf107c5b961b34859a71da7

SHA512
b77828841d60be9f23c1ab1b8ee2f2a892b89af885c6a9bec6e0dec7c4515adc3a625ee039617c060c244e4f45fd2115f55d1b51b8786a40b4ac9fdb0d49166f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4621fa70cc7ad7da92ff5f701992539e

SHA1
5d563a3a6d895acefade949fedc5448b85ea479d

SHA256
68da3f69a7d33484c284fd629336ccb69d114d2d603b98679bbef4c6a4bd0f36

SHA512
10ad57a432e9ae8d05f0bc51c6d25e68fd842cf9a54014920998eab1285287af2dfe2e36bae232fe93a252d765b014faea16f5f96c114e0e70547e00ec323f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844f224dd88362e47c36a8336f999fbf

SHA1
c738bd08f3a656330184c7a24ee18edba91c9059

SHA256
bdb1894d7a6216f7468a9a8d8d7cc3d1393e5425c2dac3c63468ceccb9fbb1b6

SHA512
de107fda855584826d8c930d47d5cabf851efc6462191258a25b86a0b958844ab18e3ae7034f54c22803744925e7d0806fba0d49f18ec25e680c6eaae745331b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b23cef608fa040909a015da6de2f3744

SHA1
79da4a65b0ca243b05ba049da999c008b968684f

SHA256
2b55d089a4c4dedd11bad1f2f5b11f8ea93cd28042cf9583ce6c418b3e27ee84

SHA512
eff3a045ef59e3187433724e0dbbbd7eead81445cd2ac4fa07a0f37c1b115fff668edf706dd92ea0bf1f5b75cf9e622f4018832e0e2f6b9e7192088abd5d9c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb823c66cab37ee6cc1e7aedb3dedd53

SHA1
70b362cb4d4319973e04654c7cb804a8168ce035

SHA256
2c0cf78f57c0916c5a111f6fd5eec280f261f03b9207e88119b259a3cb8c3661

SHA512
cd61213fd2ffa73a7d2d1df6046ac6d144aa90ac841dabc3eec494ffad8ac581cdef4c01b22bdc3d3aee78ff5e1596259c43f091b0398ab7e8a1b2019a2bcb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518cdd83a442571e837641ea53d985f1

SHA1
ac713d272811ccad95d917eab615acd6696c9861

SHA256
307abedce0426c1de5a8df936a66cadaff5d48a1c55b9a74836a7148e0fe6c27

SHA512
09a20ecd37ae1c4adb74ea340f52cecbbe3eea3bfc1792fc6b70b317a3060ed59e17f2afa0ea348b198d9a2deac2f5217b84ed560b02fc799fe434fee5ff8f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0ed50c427b736e71bbdbd9a68ce5ab1

SHA1
b288ef78c5f198890d8c1ff2e291eb6a77b4354e

SHA256
b4759e10c52d4527b055f285040a641f45d5799867c2ee74df95219aa0e6796e

SHA512
56486b7eeaf9022bd8b056028516772decf17108c4dcd7066353273945a656ef3edc310d6f80a07ab0aa82912a670eca3b1b2d30f419e8ddb8166e52f1dd1aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
474a7682ed33f029209cf6b4e4598a24

SHA1
1d46a77caf682ed438ddd68b95053c5e70bfc42f

SHA256
34fbbb6bf54837c8746f0e9fb281be3ee7a57b3a0b95879078acb1564d16230d

SHA512
41396c254f1a1f2062af04c9d112fef00adb74d69ac37bc040546c032a970b2e0106e8230d6038a6d8f8191b3e9b9589249f7134e853c64b073c25190c393d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\3f04ec[1].htm

Filesize
550B

MD5
c53071b5e066a5f0a8d651bec7d6a3d3

SHA1
e6381d05c697f1ca1ef7190aa4b1e219b94c1328

SHA256
3a4af7e572660cf612a66aeca818fe4b3b55ad6db9a9a394b105dd7742ed903e

SHA512
3f1ee125e0dfbd5e7792b67fb8b16faef0c37931b0f32d213dcb70cb986299d95dae890e25b8559fa6127403c5ee04cfad9c849699375a2641ee7c238fd8a458

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC488.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCAB2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit