9336f6f3c9fe658a261badba0a9c41bbca7b834aaf4300b96f57d56b511cf583

Analysis

max time kernel
120s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

218ada8cb885e6c4032669f7ebf4a5e3.html
Size

23KB
MD5

218ada8cb885e6c4032669f7ebf4a5e3
SHA1

bac989b0c776966dfaf156350c3c2344d124e9d1
SHA256

9336f6f3c9fe658a261badba0a9c41bbca7b834aaf4300b96f57d56b511cf583
SHA512

33fb8fb6ebde554b67ad6dbad0ca86d49879661b81c18ef73dd83cacb3cf61f5756660988290ac78dbd498550c77e73096535813ed5d1f28112450cf2335b7d5
SSDEEP

384:QbnA4ywlg6pz2ltztvukeKXXTuZwmFxaeR5QKL24UTpNyOcn8tvG5nTDuU5esT8a:c17grtWkekipHdCKc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000cd7fc0399507c2b456cbad627822875fd5c6926c3d292e8ee183806d451de8c7000000000e80000000020000200000008fe1b99122cb0097a4b6234ee62ea560ecf6d73535c16dfaf3d4af8b00fde704900000004e5125419613fc0bdd3e25c832d9a3d8767b0a1a662ceb346fe6ba15753b379d50df20e00cf875d687a3708d2dde4ce5a9e62c7e51cd05e1e1094cabcedce86f87f59d42893c5f4b79037f7c7199a83ee0e45be38cbe809492f24e56f7c5a5d19e2e941dbaaf896b127f6965a521f79fca10c993ca4f1ec8629a2911d761c65eeda142ff9ad39658c379d04810d79f4f4000000015e540ace1bce5edbad7a04ea76cef3f900fae4dcf9dbbd3dfede2b420f14d5e8398a54b199c700b0dab4e94873da0c1eecc7a23107dc26663b18ac5408ce995	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410284753"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02ff126c73cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{524CCB61-A8BA-11EE-AA09-E6B549E8BD88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000007714b97468d210fc93644585ca7567959506e749ad454a6464834ebb99db32e6000000000e80000000020000200000009a19f8156ba3a0efd3c01273b853613bee80431904633543ce48d199b5ee97322000000083673ac389dc196704e09833265120236dc12bb5b08edcbcb04a8f32380f68194000000026dc1a493ccd8c798e4347bfb500aabb3303d312c7cba995b442e02d89c061a74c26bf6095466666d167fd4147f5051747ac9cea896b0d60e9dfc668305c8bc7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1372	iexplore.exe
1372	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3016	1372	iexplore.exe	17
PID 1372 wrote to memory of 3016	1372	iexplore.exe	17
PID 1372 wrote to memory of 3016	1372	iexplore.exe	17
PID 1372 wrote to memory of 3016	1372	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\218ada8cb885e6c4032669f7ebf4a5e3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fefc0944a657a69f1f26399ae458e16d

SHA1
bbad118109c84f0e854f7260bf29467bb797903c

SHA256
830c0c6c4e0634145563381822125fbd66a7167829544e70295ccdc04ffb1a2b

SHA512
b19cd69463d39974b663bc464c6498b7e5ff8bc7d0941dc1d722c3fa2eb73076b58e6be5fed37a64267001424a3f9bf078c178fb314d3d0e6bd145d8b81c4ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae0cfdb394425f35f6edc78176215c1

SHA1
425b4636e99d620ab6ff367818d59911fcb83deb

SHA256
3cc09e5477fe6e11b9e5929ad7c067c8aab5c85f00e7278106c287ac7189b22e

SHA512
3e7e18e6524b6cbadfb69b58ebbda0406fbdaa1b74784577570623caad6ca41f6ddbfe64be39b6be22788e559075bfbf09581098fa81ab28b7715c802c6fc635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da5399bc993d9f79cce1ffd3ff971b4f

SHA1
77bc7fa0bbf3ed27bd975384a0ffa0cfc23d91bc

SHA256
b37996d2eec2a5e70bda898bcf3fbbe71f8e2cdb87ecfaff2d8f550648220d04

SHA512
22fe8b05f9dbd910508fc39d3014fcaa8dae74daa744ba3e6d12a1a8276825ee98fb1a677261b0a796ac70b76720082f122c2426e247975f0774a53138bb9244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
021fc4bfd3bb58098f786d801ff764a2

SHA1
30a10cd65d6e7aaf7f9d561ad8f28837f50bd015

SHA256
4e9b3cbbf6070bb26d9e2496086100a0bcfb3161ab68fc45419b95c6ab6d60ab

SHA512
60beee01ceb4bc4f4f9e82dc663f77e6c9d1c1104015e546c0215218ee7ca456c44f927a996774c3eebfb934ef48ecd27f9d76a01ece2cf5351f971a72aba27a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bae94bb9972f3d1f555318ba5b9321a

SHA1
d4db0d7fa8e88db64d0fc563c9fdd77b51b1053e

SHA256
a4edc06f42751358cb975453e27f5017795eb86bd8128544a8bba64e2d7859c8

SHA512
a46af88597836ef6f4e46decb86a382c1835ee154aff4cd7848ebd4bb43f26ead7e55e2bdde13d5870c97b91dd9d2c19cd643973ff9e414017df2b7850c397db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98db057983dd5ba90b6f9c9adf52184f

SHA1
7fafe91e180ecf04205a0ba9884fa5359e894deb

SHA256
2c46a7e78de55b26ba55492aaa5ac93bf2fe0b580587c7aa624488172722a0fd

SHA512
470a55e567dc6522fcb65af8453cc7624cc8e2706fdf5aa7c539c8e5d47d7a334ede058cda318748fcfcc6aa4e4cbade321b92dc8136c3f58be65ee4c2b9e44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7af8b25b0bf58aa258a66d57cbe55dbb

SHA1
354854a6f8fcaa2b7e07fc0cbd77c2a982aca395

SHA256
65a509ffe4fff1ff2b26413057a9ca137b101784a5983364fd63a75aee8d2062

SHA512
67c0b655e9999e72550307f4dfc7bccc816a50da369db10fc713fed90553f6abeb595fe2a75b7595f9886479065527a0521a891d7c0f63f5d40415ea81660227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c9b8735cff4246c3b65f5662725a383

SHA1
d4a930b90f4bff0b6d9c5d14d237b867df210e34

SHA256
4833ad7ac3051e1627b32c4a4aeef8f188f715211c1a56e322e7d7c4f31f1201

SHA512
be4f710c2a0b7b53ec65b7bc7c7f9d53f4906443a0b6f97fe89420c01b80377355d9de4793a3e9bfdf575df4d38411b146a66a851f1030e2702d09e7e356ced8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
847f37953e3415483122df6f4e48e2f3

SHA1
cd2146907b66520f9683a27d1ff901e10966f752

SHA256
5fc8477f9067188fb3624f1644ceed97dbac85d5bc8a58209964630bec1cdc90

SHA512
ae997ff84627cc4a28806be06e5241f59c3f8c8fc67022949dec514a6a1a117ba98179d1e430e3b54fd36bcb1dea00b6e15ba4b26defc4f2d5315ccf3895e2d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10b8ff3bb82071101467cdf443fbc7b1

SHA1
acbec8481b1f92be8d056fdeb8da0a3685cf046a

SHA256
461cd0c37f2d3d2285a8799dd1f65fb8cb6abffda1369d2c1568f5e23f0cf668

SHA512
40c33970671ce51830fff24d3181aaa8ed1f2d09591569fbb4d642690994b8ff0aeff8beb72a80b4095421a02025b0c4efbc9537bbc6d148a1ef2e538ec50f28

Download Submit