f569165b75ab279e634a2a5b247948d6694171a8805af0e46689867e13c619f0

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b655bfbdc39bbf33f56d2ba525434ea.html
Size

19KB
MD5

1b655bfbdc39bbf33f56d2ba525434ea
SHA1

d228285bcff164fcd1dbf39e5cd78e8b145c319e
SHA256

f569165b75ab279e634a2a5b247948d6694171a8805af0e46689867e13c619f0
SHA512

14a4e635fc9ace681ba15715f70d9e7c2d12983648dd4d361ad0d6e7050dcad94b7faade0a02031774c28d5bb26bae11f575b1dd5f4b780cf8c79dde5a172708
SSDEEP

192:VrpYH6pYwdc6Qno42V3OYb31CJfsRFRpfxcpDBRMajNAJAD6/e7I+u6ESZS9y4Pp:EMB42TbwopfxiBRMad627IijZ4Pk69

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50A7E431-AA94-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000023c97408b7aa3def2ced1a48bed896435ee847cb0d11d7d1d952a7adf9772f30000000000e800000000200002000000040b20763b1b206bd8683bb0f52bb4097e215bfb0ff2a93b37043f5d5c48767de90000000e43d5ceb7b8485af324cf0d20615ed62d3d85b7dacfc07faf657763d01aed3703cecbdebb78c2485aa0a0d6084d45591fd0805b3853ae9e0430bf30fed6f455e097149358435c0556367eebde05640d63a479b7efb152e42471acf567d7675ea001cb2005dbf638711c723e927969a058929a3ce38ab2af08f6a97ce1a5241961164357df57e47166ae57315ff2f641d40000000d8068df6a3856854d6ab9d6da01d43a8f37b3ec09d4f4fb9dff488e7848360c3fe29221b2ee4b4e1dc2fb46a4a8b68e22bed7ace533b634a5cc39cff6e2833bb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410488318"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01ef725a13eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d121dfc12ec62f065cf782a1e8df1248ce182c7f19b7313a61ddcacb67ed512c000000000e80000000020000200000004bb35c34000bc31824c2320effaa4ae046fdd6ca34f0818ce25ce1056a4d30112000000080adcd04f4e464c28845572435dce3f09c248c42f7cc4394e1617e0100e37fda4000000049f54de4c3c2545677f39f2a0883d7bba3b778b05b5105ad073d99c5461ca8c8a36bd8fb65f66342966f938d0d752046974b9f03f142f6903912613ffd0d8d46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2220	2164	iexplore.exe	28
PID 2164 wrote to memory of 2220	2164	iexplore.exe	28
PID 2164 wrote to memory of 2220	2164	iexplore.exe	28
PID 2164 wrote to memory of 2220	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b655bfbdc39bbf33f56d2ba525434ea.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef909b309250e26e3c2644f1d57b1cc4

SHA1
265006714c781f97672763b5d6e32d0511058da3

SHA256
02e2876021b0ee9bc684e9810d8dc1c3b27ddb82d01a6f7925717b0110e59109

SHA512
c683855ad2e143298e6e842819ca31a98b50d47fc0d5be3f8f5ef00f32b65a0d67a598156dd48501bcd17483c82ddb768449d6359ea865509e06bc196f18aca9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf510ec74989b230af2bcc2b531a378

SHA1
238aea30308b2a8172098db65399f6e0a5e8247f

SHA256
830795844975b67993ddfcbadb66a28dd6338da851843128ce97ffd230ca0e6c

SHA512
602d8c2638694de9c48cc280e8bad059296da1f86ad096579ef0516f9a0d75c6def4978f7304d69d9387fcea21270e7b7e9652b53fed03ed909537709e962c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31d6969d9c92a3cc3b4e6069e3108aa4

SHA1
ec788999ccf0565202b2ff700ee56414664cf100

SHA256
d72a07fcaa5c724b3a6f43cde841e0010634b8a84d5752e2f7c7fa715a650503

SHA512
afd92ce10cb5d9c1b55894afdf5eefbb4b518b7726a20331585d5f12775b3a6c0b3c3e3c9da4fb73e76cf5403637960d2be44be4dacc46cde967d2b812305b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
956a1cedc71c711e1fca011c599c7561

SHA1
4f93473c0378e5a1aa060f2364becee58b76fddd

SHA256
ffdd21fe9f7d879f9138466718dc359c244def40d3d8f3e9e08ea1f345f90468

SHA512
d208aea5ba6c590fb3c0910f087f1e13fe5b422574681f626dd767e1cfd2ab272fc851b9337abb90b516510db5c01caa73e5b175f45bb9037b56b65975dac9a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36e3b4cabf5cbeea29a5979ae0f6ec2f

SHA1
7f44dc057e4cdf9f9b1af137141202b59df2aeb8

SHA256
7ccee834c744bbb9ff6e33818f45d8b9fb8cb705d3cf79f05a7dfa12f7faba3f

SHA512
2ac9a7d1357ab014358bb3881b4a334a83d37c886a032732dbafd345475cdce373bb37809330411990160aa99b64b7497b34fba581cf8e71e63925f07dda39ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7894b50eebedbc9e9c11566baddfb04

SHA1
42a456ff97b5b98d341cffd1937502632d3e8ed0

SHA256
c61e2287deefd54ad5cb0938a368e6ec43a85e284409c2bd3a7641ecd3a40e92

SHA512
bdd403585863ab511e2998850a91bd979d4ab84fbdbe8e5aad7cd94f34ad5a0eaba3589d137c2bb40070b33722f05c4b220b68323d3ff02f17968a4a6ccc4f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac111fb14de19abffc4fad2b79453dd

SHA1
51e06335cdc37c69c3419c35036f748ca7f2c693

SHA256
396a9554cee1f214d0dd7ac139ea0fa71d21e47f953fac8381fb1bd0cefdca18

SHA512
abfbf1602c22bce604e9fedc6cfdf78ff96de3eb2e0715361f6c5f838b43a1fd7a4e8a456da591cc587f9692aa13d8a81a3ce6e0603593bfe54eaf69154f413e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a2bc665c2d1cecbbd35a74236e2792

SHA1
3edbed1460f04bdf494eab98e2135f8ad60f853d

SHA256
2fbb2ed206ae2e57a50177e6fac7678216719cd3be1ea139a8f3365e35b17ed5

SHA512
3ce633269a19cdaae5cf78ae53dfe933420dc246b2059f02385f8bdcc3ede5838649b61ddad78c4115ad886c240526a0b1affd00fc4dee07a6b22d80cad3abe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c876951ad7fb7a6f1cdf693b21d1dd7

SHA1
1cbb652c9b6b466a68220fdad2725654587da46e

SHA256
439b18d96e3a5402f2df9b8793088bcdaab6b7de79d2d4fc5e1c06c1bac07f70

SHA512
32fb4169ed25777b309bd0fdd607224ff5d59ce8b8cd839ee771f7d2a06932ccb9c84c1c8eed53a1771630a53683e88687b09afe788b01bb5b8be4d519c02319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
988fbe3d480227aecc564a2fa076810c

SHA1
f825bb55cf2725328919132d932a43bf8d1b1138

SHA256
0a4365cd32f560c19110db955efc6c2daaec19899b94faf16bdab58a893d0be0

SHA512
215aec00424fbe30566f25c5f39d6cad67e81f505f716a876e1cffddb8b91ea07354d574fbd57c0422e7ac88fb3d868fe9d11a12289645c135e84e14cf51a116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7177f38322c9b826c6533a5947b752

SHA1
527d6cbb63ead6896eb0f5504bcd546b62442823

SHA256
f75c765cfc8f889ff77a5eab0aa36fca9f402423df6fbf2d9546cca617a4ffca

SHA512
5f5fe8a3a6ea880a3ff9fca89f8d7d23f3e8ec430d798dc73aee1d492644bd55ce527f259e4d2a015b8b33284fa0eaf2b19b470e93a0a0668f99569fd89eea7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cef6123be2bb56f4f0c3d44919d6329

SHA1
bde545f1638be98d39ada7b7ac9860612415af2d

SHA256
e5a819ce554116621d95ea13ec1b222ec168a249798f7279ea533423ac49ee8d

SHA512
2a804989c11e95188ceaf6890a46bfbfc38099520250213b860aae272b80617ce6e062548dc41e1606de7915ff45b7d63d280e9b9d3506681df157224adf3834

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB129.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1C8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit