c30f255870829ee6d1b0fe40632aab24392e47b8a0ae05bfac04cc436cf14d7e

Analysis

max time kernel
125s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

230c059dd9a89224930f38417b50f41a.html
Size

8KB
MD5

230c059dd9a89224930f38417b50f41a
SHA1

063ea8c2bf829a5fdf78c02a70b98f92c161d466
SHA256

c30f255870829ee6d1b0fe40632aab24392e47b8a0ae05bfac04cc436cf14d7e
SHA512

d5ac72db9b2bfe942ec08402ecb4e5a951a958a8f431873ef05f9c5292cea08002c2965cef0300cfca19ce0deac884a6d75f8f178c8d8e4b27d23f9a8d901a11
SSDEEP

192:SwYakdTFXsi1E29C0CYqi0S5ZM6OVtdyQk6e:SwGdTFXscE2QXYZD5ZM6Olbe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B200A691-AB70-11EE-84F1-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7010208a7d3fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410582972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000085a1fa2833c74aa6bc81027c4608dfc0e16374f7ecb59e7fd133538863368ac3000000000e80000000020000200000002114d627129446060adb15c163872482660c1e31f3790c769b66355640c9a99990000000c8685b4076dc533417759a77db807d72501021367d7264fc4579ef445df6d1a403219c7037f9e0c7911fb57f3cf68ad498be761a5b3be24f22766ea5fc6c99634f8987280fca75f3caede40d11d6e16212caf6bf7a88ca5f9fe06ca29b0959547ab3906bbd62cee2b373e6d4b0f0cadf3ff5d979b517aa6e2208114e1f065bc7db3714c99ae6caf0fe3eadacc5d4ad8540000000aa15510b9a4ebb906583247544f1f484d9ffec2c8d79768f2b0753e9f622f097b9d5df8bdc5ff71291e20fc0ea3e236ec7fd4d54ae2509e803c98255d87a40ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001c92dd2eaea3f4637f7407353be81bcd278c5a37740bbb13f2816a68bb6bc9a0000000000e8000000002000020000000dd496f64d7a959c1221f53c063ea18b6a3e66d9b22eb31622593197bdbe5cec42000000056275e95b497ddf540b177ca96fd6cf77564e0ce1f5ffd9517b6da6fd2a6fec2400000001c2c25d8342c6de2db8dad8fe05e9a0bee179ae33bc519f5081e97b127629d06c44d7288590a84bc5530ea9d407ca3fa46437ab2c6b7d3d4f3a69ffafd09a92c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\230c059dd9a89224930f38417b50f41a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87fcbc05608979b6249c2e7ce4ec52ae

SHA1
5dc5e32542af41a435df431b57b76fc3a8d9c11d

SHA256
385754d5f621974b6c5d132b576ec74dc87bab514722740f7b38b8dab635251d

SHA512
8e80dca547f5eb9d49b7307b9f51f68ac004fc1dc17ade8cffab961cf6f6127e05ba4253a9c105c4956aeba4af8b794f76a5e972a2ed674860c6a74c5f6595aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76c73657758f5966537b90b679b2231b

SHA1
75d08f3166fc62ee621b3786cdb78e4dad53b3e6

SHA256
8e95ed08e6d309f86f37a24480cd494dfc7e03f350abf6e5681ba7c7b5232f23

SHA512
f425968716e5227bf29d2c828589b97de2f2ed9e9b96cb613f32a5e02ee74e69a3be160b84ebc86675c51a074a958a219f022bf21b49354d0d28dd0886590944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ab6e911d1be330c0d73760bde6724a4

SHA1
9000dfdbade73e6f2e10cfd8c23fd14868ca92c6

SHA256
7f5cd8639f3a5eef68ca904a59f6a24dace4410ed51da7e70bdb00b2936f5a48

SHA512
01e4b87f91de98b3e0e35a3a6fba373894206773f07269db5ca7cdf9262e8bdcf9010ef16b49480fc002838ccee3fbd3283f63698d73720716bb2a10cbb762ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8bc4dddd5c5e13f4ef510acd870d7bd

SHA1
bbedd87af1248b7e6b206e84875ceb760888638e

SHA256
b216771aceb014da3ed697fe1f786d5894569cc0de4dd5a3a076ba9ad5fa63fa

SHA512
e9486a2df3257293448e2b1efa9380e3ec273acb35abe5b948b2cb767fdced969df4c255978ba50aed192c46369b7d5a9accb75875613805a489a6e62d65d2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab56495edac78a7f21bd46e0d409881

SHA1
a39acb9e8f49d6a6999e0a835f03e3d8eb3ec3e0

SHA256
120e91e22e80153ce5a2996f7c7826da6cfeb5d4f0c7fc0c2a274e40ca25af19

SHA512
31e764422c3d5845cc1b3101af9c9961a83500e7361396abbcced06347c4033b980a2a2ef09689799c88bccc033065983c98de1913730e4579ae14375c492900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077d7f8c79894555bb880be4f18f68c8

SHA1
d3e4857f0da4755130d438b99c3d0b599ba0e457

SHA256
eb22e9e6ed228b0c25eb44cf69e89ba0e8e0422172bf62a3eb603b7a874891b0

SHA512
d385015d74e9e2d55615da42fe0641186489fd799521413361f848f27c907833a0927005bd72ab5f5a280e8f1262bab03186654233e27b06d45cf34852fc96c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e4740ef47367dbf7035403eb996cee5

SHA1
a3ab7b61296b6bea71941525bdb2545d6c7dbb17

SHA256
0565a1fca0c987c3ad249935c1449bd810f73316191b879fdb7c515841574500

SHA512
3306744d7e3b5ff5726d74daba53ce409f4d028c3fb2373dd61d02903328440d4ff12c87b69934a42affe49fc21e51c8c5e2238eafa98fe2b0377fbe986fc073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
145ab69a0e8421d042d9c0afc6300ef8

SHA1
fca577532a4050ebce2d0a14707ec6e2184dcead

SHA256
68747b4e0f032af9ad90aeb9c26f5793a2564ae4fd6d266ed5522a5472a03128

SHA512
393885040f72e6786394d78e5e0b2f5673c2b2c3c887bb7a2b3886dec11eca5ea87c79205bde01200cf243fdabf3bc7f488a7549ee0329f75becd2ed136b85e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76e021cb63a99c32c0130028317084d4

SHA1
5641e939997bf57f3ce9dafe05093045f44737ce

SHA256
3504ec45178e70c8147ca7e10cb1543518fdbaa7366eabaea29d3c9f46db3668

SHA512
59cd61ca491b146dc7f84ddaafaaff438a955cd7d2148d565c90347607a92c5fbda2fcc0f4526a23e4a1a4c3bbcfe3a2d3d33f03a81be45cb3ed10158c4c9d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4261627a79b1a02b23befc8274b0fd37

SHA1
4117f74beec6a6d87632c451215edc4f097547e2

SHA256
4cd0787fd07deb232950cd9c3625572c0bbabc82c965fd10eb4c9834c6fab6a2

SHA512
c6722aa9d99a344ba7100509c6469d9318bb77bbe62363b3214134dacd140b40344414e1bb2587f34d3f69ae11c549d16ae8cd849e7fe09cfd9a7292d4e240e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ba1da23b3db4a1358b3f20d5c668f6

SHA1
c07cf04ef554d1e6ca18df5a259988e574dece8a

SHA256
6853977e22ddc4faf03dc7f2c3cb78fa9e77f3bf605982f73eab7c494ad58452

SHA512
cf19fe3e665c76875a55516d74fe7ca75b632485ed8d031c4f645c608f8b34b7ea1db2e48d3f6696b023dbd86fdd7d7d2ab634ba0a1da04c33afbbd4a1cfa8f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CBB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit