e0ebdc6ee97db618a6f13b4a34a62b8512bfc15ae4561e22e084707733e14a3a

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1bccbe88dac603a2d0029ccaea5f5ff9.html
Size

20KB
MD5

1bccbe88dac603a2d0029ccaea5f5ff9
SHA1

a82592d766cde5bc096d30f8ddb9b1de5ae2577b
SHA256

e0ebdc6ee97db618a6f13b4a34a62b8512bfc15ae4561e22e084707733e14a3a
SHA512

94dd8725b7c783849403110456e8cb6a0a8ff1eff94f554ea3edd293671cc0c31056a8de94e594b6bf3bec497534950fb3f0cacf9a144225baf1ff20ddbdc556
SSDEEP

384:ItEJlI/Iz8f83Yd4p2l+aYkVr0cWqcbDcNaca/cy9McP4cMocAAcHscua0QAHy8E:ItEJl0I4f8c4p2jV4cWqcbDcNaca/cyv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b17761a1746367977bcdd08ab41280f71b560e8fc9ca449b5e311bbc87264fde000000000e80000000020000200000003b2f64e9f6ee2bfeeab1f310885b3ffd4f4c85e40753a96fe3fa4fc2e5fb4e90200000007deeb69c4cdecb10d9b4987943b31aecbfabac45486dc68dd23d02d53c7ffb1540000000e96e554d1b64e728286781f1ceeba2901daec819fb13e6808e3949d9a8333b9b93ec99359be90fb944fad7f9cdf4b57d58b1a4b1bf2d877ae738e2ed5d40a283	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000036d0dddc714ef96bbdeb488987d9d34be8e27da8de6f46d8f721abe0517a2817000000000e80000000020000200000009d05711679ed8bebbddf48f84ec5b70a1d9ebe8e449325076a8b1c335e3ce4669000000021f9cb6e94fedef6a8bee7c12ffa73a385307fd161038dde569ce73f9e4ce2f8bce743781a4fa8c47e38e4de19e09780270f374d816c99bbd73bbd798183bda75dd16d2932e467585e503c1f04ffa67b62f25cfb73da0f5bc9b3480b19ac7d262e36945c2ecdda561fb0d56b799d417466150ea031810f713cb21886824eefa208ed77c2b7fbbcf17dbea3197be198f540000000c7201a5171e07ab0f1f9729b301f4b46edc70f51072378cdd741933624091653885b5ea9ab0ddfd2d132381fd1e31895cab05fccaead7d29c6ccbc1ff9dc7103	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410504515"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f8bcf5c63eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07D654F1-AABA-11EE-B59C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
1456	IEXPLORE.EXE
1456	IEXPLORE.EXE
1456	IEXPLORE.EXE
1456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1456	2252	iexplore.exe	28
PID 2252 wrote to memory of 1456	2252	iexplore.exe	28
PID 2252 wrote to memory of 1456	2252	iexplore.exe	28
PID 2252 wrote to memory of 1456	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1bccbe88dac603a2d0029ccaea5f5ff9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb61f6f99ab5e33297dec493b850fc43

SHA1
298f5b02deb7ecf06292a6959dea34079137dea4

SHA256
85cec21de7a37708afde57c504ff196e640b5e0435a8501c5c172234024d179e

SHA512
97bebda48ab8b1f8caa82931c1acef5a8f0b8176e6bfa6a4c29a4dd96e8261d19dd094bc2251100ac3af9de5680c03f6c9f1504dcba52a7a96e8b10dbcdca7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77107ff32a493531e3e7deb7d5bf048f

SHA1
98cbed21bf555416edea8a82576d67bec1073476

SHA256
51892edf3de875fb8c20b8680554b473fe47c68ec71c57e129e3c4d163b619b9

SHA512
5c61f515905af8c42ea033438c0fc421c8a91ca02f1b90423dca1bbae978d23c7bf8c7fcadb3e1fe487056baebe5d4b0be1f5630f88e7d9d3b6b737671f5f491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
536579dc1cbb0fa633b24385c54c28bd

SHA1
c2356e0fa01cc026fb0189fcb25b5d9af98a5af6

SHA256
e164bfaead158f3de69829481411743339c6c8567ef32e1468e5aff3ec58c051

SHA512
6cbfc4a8b276442e5b1bd461739c601842e1a00de9b194840c0783fed478f2171a7f6ff2d04d815f15ca4212fdb7f33fb38727cf1fa3d708d9f5ef97e7349e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37628757e466ce4f5d57423e697d66f4

SHA1
1e4146b5309d876d378c0e3876431606f83a226a

SHA256
7da6246ec1e628fc8c27f971fb751c8d8a5640153828afeca4f76759f1ded03d

SHA512
f7dec1899f849a169b78ce873d359ea77e00d6daa890c7131c6736a908c9a9083c38ff75c999775a872b80a358edebced00aef96b67965b10a3d97d5e4c0cf62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f6765fdef80a75892acc78b09919d3d

SHA1
cf7b74697d0b7a2ce3c2bebeb8ce58ef6c961ba4

SHA256
7b96e8b3705ee738afd3288c5459a50d16f9f4c239d9e762e524951c375fc361

SHA512
b555daf016a83d9dc73b4d8c505bfcd8a464e2ad122da9a298101d8f3b0c884f797b71d0b8301bb99b8f6be7b77c5f6a6f9bd49dc395beca6549371738a99121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b60502bad7fae07a86d58b8ae5032d50

SHA1
88c4b333bfadfc862376d4efbd95bab1d337a9d8

SHA256
767e9fe89eca711c79dd7b730b18ed952ba108a0317e5a246223927ac293b79c

SHA512
73d59769991cc4a1fc3041a71fcc6938ec1ee25ffe123b86c79abd0297582bb9d3a71f603dc5e1e2034799b438d7f2369f61afe48637a06a1b9c88d313dc1d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f0a8e2378bf6568d8daed2f61495294

SHA1
cf61121106dc397b03ce85ebdce0490dae7ae0ad

SHA256
5dd0b5de5646bfe1a2f985c063514ee0bfb1bffd20bed5e9b7c3975d0fdbee1d

SHA512
00b8c596955d76754a7bf1038c8fce20d1d8a17c9b78c10f89aeccaf032431e5cd64564070f80c140d199bc9d5068e2b68fcc9a058727c3db169af974858f3da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
941edc2ff5753a7d9882a0b2660e55a1

SHA1
d570e096c8a4557da8adc372e56ad8b618049426

SHA256
c2916e5983fb617d22b09c01afe8b2b801a61f50d5f488776c79d4c0b4aff9b1

SHA512
a0a08384a9bd163097d56ba689aceb5d142df35383435f2fb632522fdc0391deb5db19169ffffd1eabb2a2326b7d0824a7ed50fb8e1c2b1322d6557a80d2cc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b6d8c582f9e8cfe33b50246ad389ef7

SHA1
122296f4f87326c2aa110b48277f2dd616ba1df2

SHA256
8bd8cfbd188f7de2c3a0e0198d2298207a50224bd8547317e96f88e446e904de

SHA512
96baecd786fb26577f439f2ea486a86fcd4511abb5df302c15307d3bc4bf5a5d62818a1efd7ef8bf3edc1196790a1a55fcfed68f7867a1ad9e0c35de15738a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
673f7a205fc7d2ee6f98ba8ac8616e40

SHA1
0d85e6063047ab2aaa2d242ec2ffbd93367c1adc

SHA256
7475f1ab606d43efd04e2a8056a7af30a937d37abc23bdfd1e0f83ad4d4e3f6c

SHA512
00d01d77e198078ce47eb387018a334f2a08b7f82801395adffcd27bf3aba0eac0b09d199cd2882289a0bbdc0c689728593b31b97bbf88799ede7eee6be85a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71858fda0b48ddffab4fd5417111ac24

SHA1
6221cbf82ddf7a5b5558a964e4529c30f05389c0

SHA256
65773f4aecb0e58936dc86d8a88aecef731b9ad25b707f21358b1fe05ebe381f

SHA512
320a2c51a18ce7d990086088a20e34084996c26bd9fe664e7bbce95a6df9a17862d8b5792bf08fb7d8abaefaab55fcc9374a6a1dcf457e4621fd9a8eeb8bc67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd03d0564bd9777154c3680c872e703

SHA1
c59ba2454732c2fca222c0bcb543389091859197

SHA256
2a14f4e5bc7a6f124e256bb5642e92df1499ebfe806a24133c367606139a434d

SHA512
50007d81a9cc9787b89ab362cb5fec8f297d2406885e9c2db5499c76fb87651d1cadd2e1c3ee2b2039af65ff5d31f35609300c5702d2f23645a2242c86fa43f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604c12a65b5c822decd3997c47715b29

SHA1
f3986fe7aab931e4494283e985ae6efc55fe8b6a

SHA256
75435ef2e690668241682a7b7ac5ec1ad0e9325c15b8f272b60271cf5873c6c6

SHA512
47605f1cdd3fdb78ddcbdecfd3c61e906b9629a56c81a2e2656bc15934fff729326e6e1f689763ba5ef746d7a9bd11ff78937855c20a8cb8c06c1a6ab25f39f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB54.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBE4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit