c106c306f039c824e2e29780e8fc982045f6ab68148fd0ecce1208b58d176457

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23e0e9a02b780c04d102a570403cfe56.html
Size

109KB
MD5

23e0e9a02b780c04d102a570403cfe56
SHA1

e5bce47daa19f8e56c34f661215c643785638159
SHA256

c106c306f039c824e2e29780e8fc982045f6ab68148fd0ecce1208b58d176457
SHA512

334d96f27a7be2007c543aa3bf208a7b43f175ec4f7f3ba2943689750cc45934b537ebacf3f677ee8d76f28f414568ff60bfa79ef3d2f9f4a95c446ceee06095
SSDEEP

3072:KLjC5aFf2aKlWN9SQY4ThzEgHhTHS2uOFs:KLjC5aFf2aKlWN9SQY4ThzEMs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606ef40afb3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35B23BA1-A8EE-11EE-A2F4-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410307030"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000af9b3afea3c925283fbbf75e93efdf0efb59a53923ce863a3f8059f1ddff01b000000000e8000000002000020000000f85c0e7eada11122fc298150dc700ea06d95637626a0e3bc973767bfa59f5166900000001f623a1610892e8bea8b4e08dc915a137e69e24f2c83e12f6ba215fd853825ef8b617c9b7ee991ede0af2f885d0632b5f8438d8442285bd5ef05dcd482151e06fa0852bdc832d4476774d03f5742af053f823558c74ec79f980db10eafc9e1f5502d3b4bd857b91e318ebf735004f8c4769306486eaca6000ddbd2a5fc1ef4e28b6a83c3be181bcdcc8740fbaa569c7940000000f1bfced8bdf67f0beae422b9f19d8c585c0a541e00f79e01b0b4c01310ee7545d356a14d7268b9b847441e1797c70c1432f75d19b302287473e1d83a3226c9b2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000a78731691cdc6a5149419c44bc8544c2d0e8005a45ba6a9e6d4e6164f42e5ef000000000e80000000020000200000001177b2b7480f4bb3e4ff495145b9c8555613bf57b29a27a394874d5f89c1cc292000000091aec314ee0ff6bf9af08cac1b1e47e12eb52257176c3c0a9d5bd18b03a6fc0b40000000dab87226f1620231859d7e726b775ac5859d5aeaec43a191893fab59a7e54cd92cdfa82333eefbfbd230f477cb1e0bd77ef8bb0e9d12ab1cf372c036e63a323d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23e0e9a02b780c04d102a570403cfe56.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66ebf4b26f50601eb4524eb59f6a8ea7

SHA1
ca905f90c22e6f63682fe9c927ee58f41a49de96

SHA256
8d7c1630166db1554fb7bb7ddb26c425f44599b23d62d29efae5548bcd25e8d7

SHA512
b613aaee0bfe3af28343f741719b3b1d3b84d09433f90d4d6404aa9e4ce19954eafa0013add3efdfa49d19f489ad796645ed40cdf9d6ac63363170c4fa614f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26bdb0bbfeb36c92a8e04074ef4cb0c8

SHA1
e2f1d6aff0098b16c7bc3cb689f2d97f06565818

SHA256
9fe66c3b7fb474e73e7427e57b5b6bffa7c884f08ad4051134d655f9d1f20d63

SHA512
8ae43a73f17be7071088391dbd4853cf21681d37627abbf9fbf07772d7004a1cb5f2b04c7ae4b79d543b0cbd29a85eda9ab24e6c5d21ef9e79d0309ab16fd5be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98f647ddba310d69e246c50ef79918dc

SHA1
b4c8944abe15b6eb0fbcada47c4769b7bfa3eac2

SHA256
76b9bb1a406093e067537a254da595bf11b3a26439e4c57846fd6f5547c79ebd

SHA512
c1307e3bab03790dae81106fe853c3999a59eb3fda6ed39b3fb152d63cb0cc219db2579be6869ebf5c4e2e22037f8f682d463a4ede55c90c220fea9bda4faf53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd1164ece3078006a934e885953e67b9

SHA1
b1ca21e9b0ce6762a9dd17d9f2db4a1b0be03d87

SHA256
2a34f501f54c3700e677b7e3d5c56d93edb223fe95fdbae73470de15401356f1

SHA512
8d530716cc0da50d6f32f406f19087212651a3a568c2ce83f3113f74e18383c8fdc29f63280e57fe16f9a3d104987125816dca9476b135877ed6e64917be79db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a32ac53638967971828f059fe884897

SHA1
657978a04d6e0a82845b34c9d4314a6bc02474eb

SHA256
7e47883b73566ca7b277f11b4c86dcfa80ea6af2c4ae5aaa1cb2f000880ec926

SHA512
27383da743b81f8ddabb3ce8326ce8e856dd1696af8e03019dee4ed8731f256b583d80d052301e23b406d825da8854836283d70697964a48d510e118396dfcbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2ebbe3c382f2875e1105949c1ca260d

SHA1
a1ce72060074c6b4722fe12f197ed27f003be7ff

SHA256
834ad9981a353c9e55d39c2ad2ad535220631ddb6a070764dbd6ace446151be3

SHA512
7d18a80c8b4891b26e358619e0bb2f6042eec714cb2d6bd36dc701aaa9ccdf52f9cf81938700935086d8d403b47bd9d91103451c2e09f13e8b3211805fa30b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74bfa435f5cdac5acf82e7436dcbf946

SHA1
558a4e46d746577f02f8f7c05f0e12c8108a1be6

SHA256
4ff257098ec49d99b0bfac4094f076365e4e005f4821b58f845f8238a54df0ac

SHA512
ea37f25e37730329c1c7f86a7168d7cc53f6d43f3c66ab061445d8a15f78585e8bb35921d27de7efcd4388dd678c4c90cbcd7f70766a89c073fa33144d61cd8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b47fcd30553d443177fdadb222c3054

SHA1
1483dbf9a0f069b652d32486d5022ba167c316c3

SHA256
457bd40c2632efa7c1e79335b330d6bfad9cf1e3a015e653397c0822ea3784c5

SHA512
a0324c332dc2db0381a185b0b745360a82097078f01bd26003e5e3111e086ec3edc5947244f0ed98ddf74f0ad206e7ab82a42f56faf613ee899c25627cb5d4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a612219a78e170540e4a1e69492b7c

SHA1
ceedcfcf30b8d48f19833394edc30f424e79c9a7

SHA256
f1f29fdb7892e8f89c38f29df6d24be99daba8c5239fc90c65b5cb4b7a9d8961

SHA512
1b30c9fd12c76239398cb1ad15ae2716327b7b6ec606fe1cef41cb57e7325df377b0bd4864d423eef55b79ca543232f58b93fa6a6e65c638707bea26ce51bae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aceeb6a2503e4ec68145563bc5decbab

SHA1
c589012a5f81464c512a326fa8e7523a2c3da382

SHA256
1511d2e7ee7110f3f3302c1c539b2ff0f2eb4f9941028b0772eb826221643753

SHA512
afa6e225f20b78fafcefb414b52d8f19630593457201972887db4519ad17a4072c4400ba97196f6889e75b52b273042ac0f3183d540877fe648a50a942d389e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd1034dfbe27c73c1ff24d7a2bd32fd2

SHA1
10c1519ced68badf3b5514ba8d2500dba2bdfc4f

SHA256
58f6090c1a3beeb79ac18a6fba76b8371b9c1bd650ebd4471924fc9254381083

SHA512
474b70db00e853af241b22506a4e782bd242073e3499dafe1c3d7607bab8b5464122a8cecad5c5655a77f7db6ce4b756fce8d643ed5c4940df9bff6feeac35a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4ca775297909ecdcef83c29025d3f10

SHA1
08cf97890940e2d4d3b40a09cad56d1a547bb8f4

SHA256
87961b8d8758b139ee77c77f9c1715a4fe9cd19bb9306b6a0f0c04c5b6e4f1f9

SHA512
141a52cf1b174e82a3859ed80847c7ac962ac8247760064e9435af0ad10885b24032b1cb96dc98a2d61f6528100027239a3961f1ea282e263fca682e9710030f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7300e0b50a1a59b7b6404d0c088fe08

SHA1
156fa8de680c143db1b337a9f98f49662756630d

SHA256
fb8221a0f560e72c4014108582e23f6682a3345b9cac93e02a499001b6d245dc

SHA512
ee969ef8dddaa6dd10acf80f691f42c7be1d58d99e79f87e69f97ec29d1c69415cbda0f070466dd8df6c829e40c29c7fed92ca7dc7f02837084664b043c62907

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar912E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit