72676ab3a5e92875774a2e0a53d7950ff0808d724f0bfb20115888048669cf42

Analysis

max time kernel
139s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23a4c533c51916711458e1d5645d7ed2.html
Size

14KB
MD5

23a4c533c51916711458e1d5645d7ed2
SHA1

c8565d8680111a823b8b605e9a634e98d8aadf31
SHA256

72676ab3a5e92875774a2e0a53d7950ff0808d724f0bfb20115888048669cf42
SHA512

41d088e0d6e462dce4576509ddfaf24f2200465ac08e977591eccfa81135d31c4740d7a5a0814d1147fa1beba9bcda2192de7b1a0f19b90b40463a5e8b6b6a63
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vBmlKt6DvE:aioWD/ZmXg8SZQimlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410587023"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2014A601-AB7A-11EE-91D2-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000042cbc7b59e765bc5eabc87c2d75ee33098c46135dadd65934046987d6b044e8c000000000e8000000002000020000000bb417ffda54cd565981f39e640c48416daa81fa2bb32a886bbbb5b2d9dd06d9f20000000b0f0acde446c01aac0381bb85fd1785908c0877a6d230d3acfda5930deb44a35400000005122c4566de8e1c0bfa24a862554bf2e6017d9c798bfb90f89992a3e9d0b241d098c6be8a33ce647ad82f58ce0085153841184310ab6a064ed8322e1a68380c2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c096e4f4863fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000008a347b7de6bbfb0c5de992f0f270185c076409b92525c52dad35c8483833a4d3000000000e8000000002000020000000f29c577fcef5ab78e688c62f5b87e8bee42616b4b2b076a07a6c927fc906933c900000007e6c13353211e5a5098794dcb89ce8f91b3621b5114edc733523b740bf32932e00282717f81c4ff52b3ffc1999464ab42121162d721097d2068d7482f4470c0a40ca346e136788918528a0ce03fbab9690ce5795459bea638aca59a83fdf469f9dc3c7831853f30994ac2ba461c2afe18e986070098ac3871e43b89df86e4b8eb2537353edebaa312c79c74bdcbacc834000000051771f7b9a25c64f6059658f18eec77049dfe6f994a0e63bc3c7f6dda9f7afa45311b0578412ae98b4a034b489a313f628bccc212a93c97a26653b0ea501f6e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE
1076	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1076	2184	iexplore.exe	23
PID 2184 wrote to memory of 1076	2184	iexplore.exe	23
PID 2184 wrote to memory of 1076	2184	iexplore.exe	23
PID 2184 wrote to memory of 1076	2184	iexplore.exe	23

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23a4c533c51916711458e1d5645d7ed2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6951434871438e0f2b8396935b78081a

SHA1
5b1f1c099ec793d12e5b14c5aa6fc7d1d2e65477

SHA256
3802ddc04c790becf1594dc6fb869522c3499e0799c8a2b67292baa5a451d592

SHA512
af8e3864be5fdf488755d010efc5251d9b1220527933bf1e5839b8fb24630945c036e93a9651d514af303effabfc190025af295e15fe8bf58961dba59aa4f2ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34eaafd0bee9729c0d273c19cfa8e6a8

SHA1
85daab33b0b4bf8516eb212e020d131b62b35bbd

SHA256
b1f51f267638bf493ae8d0bd2dca42f712ef2cf8e3f5ecdd3a66493d689f1e55

SHA512
d8f2359ebdc4da8ee361b296edecaa9e8816630fd4cd6012418a87be755a89ecc256cfbc57d9c073bcdfd31dfdf8ff52cce1344803967a60e1a9437c30c80140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e766829e67688cce5207ff76999aaf9c

SHA1
77b47f412981bace71c6a8c225b4b4a2c6f659cb

SHA256
2063e36af9e6da2d2d53c387e50108fd25d2500dbe9080cb8513fe8325213b98

SHA512
655f2292bb7224924a9943f6b4288cc5738f1a3e16932953bf7840b7bd098ab2d7851203a3bff431a4e3f7b2e23ed7cd07d88b07e09e711a0f9596374848bdac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d26ad53601a450e9ea27c9c52699d4

SHA1
20ce66657ea85ad78052b0440ef444105ed10877

SHA256
1fa43c7423bdc8d9e2ccd63256f016ec4eb5876c5d4fe2109a03a54eb4abedc3

SHA512
59bdfbb03446c461730b895d68831e90c02635c93ad67fe9c4bf25f9eec28201147be3da4e8fb4039ce9a00a8848e1f7698cc8c39508a57f1cf1afbb596d1447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bcebae88384229f11557a2a6d7994df

SHA1
140c280ec8ad25eed525839d8b2909606d796014

SHA256
3c590b205bfcf1fb528b58347c64f351e7239b78d6b6e7953a4f04ea3580f85c

SHA512
9b3ddf3beb4e1e6dca78bff5147395fefb67e86d0ed8825d3a899aceb3d049c20562478f9ac284660b6ce2f023d13f83c0d19a430cedfd8ee2a1de28f1c65a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ee9528fd4cedb41a10f3af37aa73c6

SHA1
03ca73673c24e1ba4c145564aba8c6b5dd67eed0

SHA256
ba0fb0a3a7bef96cbbd7f4044174b27c974f43c5b85ecad22d41138eca57bcb2

SHA512
7188bf2a86176634f0ff16a8636d2cec4c855991b13b34acfd74d3b9893072d622fe73fab061e4296fc2690e35d2d5eca4b8a6db0c41a1bf9f300e25b29af9e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca20cb8b863ade16115ff8b52e3e5809

SHA1
c60a5625c076170c092bab91575107a01930e25c

SHA256
5f8110211600742ca67260d415173f3538fcaf2a51a663d7b169d4dcc8eb9d61

SHA512
1ca1aca4618c689227a4207006571c81a101c53a057c1b080677cc58e2e2baff24ed49ac6cf76c1e91d6710ae005639a784701d50892b944470f3b8c3779b24c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f3e1b37cc5a798fd02df41846bd8ce

SHA1
580909891ca7bd776a8d5981ba0dea73f0f82587

SHA256
c40dd7de337ba08f867393aad6ab0c22ebeab95e8e47da2789068402ef43f2c9

SHA512
fbcb5058daee976889982105f64add6c83853495602bc7b76583352f42cc4c4cac33de48e684aa7ef0729adf78c299aff46fa88e12d2a2e1655941d330384ca9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5e30346ac139676155637bf14482c17

SHA1
c18b50fa7728544a143e538987918df52d540f00

SHA256
bffd35ebb270b8b1ccbfce43b1e7801d9cbc6da9d81a60742c1e8eb7a7bb3606

SHA512
e90a5796a235ca88c545cc390fc7c8ea4ff9f3f8a395d32f0ed38b578bdb724b053b37230da8409e1f07788e695fb0a2f336ac56cccd78da94b92eeb9d4671f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab800C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar80BA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit