999df3f99b4219bf7fb17ff297ad8dc397e3fc9ef23e8198cdb3d35d5f0d9b2d

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22b589be00bf1ea08beb7a914300c577.html
Size

12KB
MD5

22b589be00bf1ea08beb7a914300c577
SHA1

43a1d9fe3e1bbd75172a1cc705d5bf322b6a7299
SHA256

999df3f99b4219bf7fb17ff297ad8dc397e3fc9ef23e8198cdb3d35d5f0d9b2d
SHA512

20f203d8e2808d08ecb37eb54fa43ecfc871229718d36346170a0ba5f1e29fe82d512a92b7efaf82d301c61e3113b6c1365c6caa2aaedb2adc90b4a133ff4eaf
SSDEEP

384:y/lbgXDS/M546b9EMAeQ7adKCHI4GUTvIABcoSF/G9Za+fDFrpKmxGURzZ:elEXDS/M546b9EnP7rCHIjGvIABFSF/Y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000039f6a0f50178fa9b2bcbd9b000b877490dec365983accd77b636087a61ad1dea000000000e800000000200002000000032672d8ebaf2c0aeace0d37676dadf558eaec641bd2a556298d2c7b1612013c720000000c173d01d6b9137a8b94b4ebae3a14ec3fe9cf0099f30b842e2c777bf1bb12563400000006794a5ac5c69f3e607f9ee8377fa8df836d4b901b72c5e8438cd99f76a21fd81304c3ec47ab645f64938b0dbf20e171832098117b69bfe19234e586c45de1c42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410580634"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009b41b7781fe4bb815df89d834622bcc0ceed9dd4a662d0ace134ddc0295e46c3000000000e8000000002000020000000d2acbcd018f3cc3252c0313dec039f8f142cb5b46d02db3495a56aa98a3afcdc9000000017c5694c42b83ff54f477e7ae40a5fb9fc87e222030c23237426375a938fe4f5b7ddbea9beff70917fbd66d8484df27f32adf1927d6b7ce0c6cacfec31f46ebe14536a4a07c504ae10fc55b0df83a3d7eaedcbf86600e5bc018668930b512e4514a7415fd421df17b5009a2c729d111a5c1033d85e8de1d155c6837157f94d2974e3f28770acb5aeff15e61ca867d8aa4000000097dcbb112e5b1ffcf71c391ef16344f90992a343bae3a33082bed190e739785989ee4c84f04b71d6abda4a65a8a48e1308eafefce5ba2464e6037558764d7f1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B7EAD01-AB6B-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102fe015783fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2292	2296	iexplore.exe	28
PID 2296 wrote to memory of 2292	2296	iexplore.exe	28
PID 2296 wrote to memory of 2292	2296	iexplore.exe	28
PID 2296 wrote to memory of 2292	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22b589be00bf1ea08beb7a914300c577.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1de403e09e46fc283c899334f1ff6ff6

SHA1
4084eeeabb1d871d3092fe76a7c1a230ab568531

SHA256
e3d0c5164a851123d8c19c77325b62e7d75a70e68d063be77ceef27a0f4116d1

SHA512
04841dfa43c4d6cbfc748ac1e52c9822b47c2a8ff7e0b3f12350ec10e2c9fe6566d1b29e4d6ac2cb07884de3f4301eba843d85b3c366751d977349f80066d9e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d536bb693e27f1fc8a4879ac3db99eb

SHA1
e3e8095d6bdc8c03395b08edf73f9058ce445458

SHA256
cdadd88927fd93b906dd4daee89b3b307879fde1c27c3a1c7b38eead2dc86148

SHA512
fdfa76168fdb90e3065c3678c25321a901e16930aa1de2567e33b54b6fa1163192254a241bdbcf6d9a48971cbf8e62eb66e8980b85289f43f75e69e1420a62af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb216ddf9d1e511d25aa2212b57f881b

SHA1
5449480a02081c72276b3762a6944151b4d88a4a

SHA256
355495856de66bd078912bd1ea6c098df4edc81487fb2ecf0981b5fecb028ee8

SHA512
88476a9ea82f98ec266ec91ec1fdee42c13280e71c52091b7e6956fe6990d7f3c5849294fdd095cec83bb26c3bbf7c875def0ab05a4a5415fa4dee8381b87c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a66decdbeff4b6193e10c015ba933de1

SHA1
364c7cddca7ef8c9a9e6d572612d471a65d41b09

SHA256
ffb8a8f0fb54acea3f87ec99c588705594ac74366be544d70bd5fb78ac7266d8

SHA512
da7ff7fd42749d1849b96d057c3d91afc675752ca380d818a4dee35c9607a901e0ea72f1cf257fe54c2d2a583e2ac8d10907d9237ac93a1e7932c8ba912f3adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cee85c00b5037680d06f5202384f120f

SHA1
2e01d4a5f1e68d1e449f3cf7a9b3a8aa4733759b

SHA256
fc0f6aa1eb634ec40d4c57cba4880d8cdf429c8ffd7e0417bf44f8ad190881f2

SHA512
26faf813044897d1a91c2a73f5395a019a8d44da63a63c135cd8fd70b2abd71cedbc85e119c5d1644da9189507493fd5c7379fbafbb6403cc1dee92ec1efca5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6eaecaf32b429a0e21e0c42cd35814e

SHA1
c0b57015f22ce07f6d88acc7e2f0bd1f690aa2d7

SHA256
60495b0e0d77d0464f297f375a966b27d31c3435ab82fbdd33cf3ce958c94338

SHA512
0d4c1f36457fcae91cfc242d6e2ca12b1afaf80523d1ef13f3e3e37155e11cb0ad1eab8113dac9184c1f5e71ac650e92220ebbd6345dcee1003505837e000187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49de5301130856fc9b12278d46eb4878

SHA1
c320f4ae6e2b1809f9e715ed1a8bfce37bb8b3d5

SHA256
c0c4eb50271038190d6fa7c6d1706ea85f251d4961fc118b79f7fb67d188f7f4

SHA512
13fdd989a6382ff87cf622d31b7e963fd28a429545841499e9926da15f4e68e75f4eb793864b15c40d0d0dc98982abc5a5ff2d7bf65bc9a068b2a4c0841818a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d74f7d931f7fea1bbb673261042f7f73

SHA1
53162f56eba9babaaaf677de3e7366ae0d7da0cc

SHA256
4ba00b5f7967088eee6500e006f7847de512293ac6f0bd761db47dc4c331352e

SHA512
6e7edc8a6704885d4798e151d6eccb5cb90cff88bb2f1a30a1e047dea48fdd6ea2c394012d68b8f235851e11f6ac76762f34763165380b2e59a566863d5b2eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90266f5e4d8999eaf9d2f3eb1bcb5c19

SHA1
289a6b76a7d122e9eca5ce6c6e14d0c1826a5a1a

SHA256
d59e5ff7da9715b6c92378d140849bc94b421138cf6494bc2724de1e060b24c6

SHA512
20943dddd2824c4c9cd3af0de38eece18bda4393c310c7fe52c7855745600f830cb87a956a75faa5c8bd4bdcd23fb7c0bcaea07c3c9430f5853b1be8666e8a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaaac8bdf5f1885a97c28570bdff81ec

SHA1
5e77677ee4a9f134d7d91b7b4fcc798bb7d1f044

SHA256
7f016ec242afa8ede10f3927b407912295ac3135fe058915b3aed85a51152ebd

SHA512
08c48515ec75e5bae6359b999e77a4b588000e5d1822241aa0a1345cb888d52e6bbd589e87797a83f4c06a0e3901e3491eec157bec52866fe93926b85c3cd078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e0ce772bf3ac94d25dcf5573c5cef6

SHA1
febeaf54c9b5932d176f45f8ff6173a5b0fd5440

SHA256
7d78f28f03cdc949887764c25e15650e0a139ae8e9303277af3df69f45785bb0

SHA512
869a23ad3d0f8aab4d8e70a9cfab158d2e695e6abb4aaf93ef54f8e7d47e593ede7dae9111c3bfc45984878b06f6ca40d32570216cc735293b1dc9cb2da1556f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f97b93a459f621657ed885d833e463ff

SHA1
e076a0cb1bc5bf9211bb06c57f2a0b0a71ed447d

SHA256
6303895fe5a7914624fb226f7757b91bf3523778356625120758a2412eabe4d3

SHA512
a2797fe6c5268a77dafb8ee8af94725173c347bdf7fcaa7dbbce9fb2bbb2d749f391fb429276aadc26765b471535108a25d2886548155a44309a0f8d4121e420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7041.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar722A.tmp

Filesize
45KB

MD5
cae17bc9c5d74e0e1142b20a7889efdb

SHA1
cfea5f7d29a7dad0a1a25daf18a0cd4cb79cac86

SHA256
4d74c7d252b593f92d04a5538ff5688a4ec720ab664ac723512fbcfa3f5ab691

SHA512
42ba66aa767f8a15ce38f9e72990fe41e4fb2d7266e4334be0bcb7db7ac7eb38e7f3b424bb4fc5583197257e9fefc11ab19285f0881a054f338463fefb483dfd

Download Submit