d8916a4c27650620c2b8b88863f4cad5fe6dbbb3b3d01a585cda1118b732b83b

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2806b6b0c9158bf20e2fcda8a2c99086.html
Size

235KB
MD5

2806b6b0c9158bf20e2fcda8a2c99086
SHA1

f0d475bc73f76ced64355f7fdce3a74d7d702568
SHA256

d8916a4c27650620c2b8b88863f4cad5fe6dbbb3b3d01a585cda1118b732b83b
SHA512

38c6eec3d8aa6c040177dd83aa84a4b9b98a7c0af6e798d55af3825e0c05122f202fffc1e0b8da28ed2c90c0f0607ea4a599d0e524e23d29a6ee24b2a4aab006
SSDEEP

3072:kyfkMY+BES09JXAnyrZalI+YKyfkMY+BES09JXAnyrZalI+YQ:psMYod+X3oI+YvsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0097425dd53fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000066f1232b5339ae968262d0d2c5330098317865b1def68be352a2dfadf456be81000000000e8000000002000020000000144e7086e1a9a046a6ca73f39397aa089b298fa7c8fa80a13ada05923daf28949000000066b9d105f749bcd9068e067ef3aba5bf8b536d77c8d1cff4055008a6fb5124ebc1054b8c0306ad024765a023dfab908d219c142d7e6e8de3c69b33476bd313f0d2297b7f2f2d16d94f205df0a5ce66f54a076b74a642c535cd1f0303789882b07e9b870e7dcce22f773c52a7718ea4c5bc2dc34839aaba11e2d5565e8b5ff76d8b7c9ea6b7973740b3eca03b4d77dab140000000496762ef7a329fe7a64fa07e02feda708b1abc74311df04dcd05575a1fbf2894454783df9d6a3dbb30ab0165807736600136fc545546b1dfa31a516e36ddd4e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6EAC2B51-ABC8-11EE-A7EB-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000008130909cddf372f4ca7513122cbc21812d6966c576afd18d950be152879c0486000000000e80000000020000200000005689a81c51dea3f61be9d82a20efa75ffb095fbbc8bca77aaf6b6a8a39d134cf200000007e0c76040da688e268d09ffae152bbd18a1235fc07364e008c23edd1e2ea2f35400000003ef77a1c44ecff9fb80a02dac844386c99609005e0cc0caa694ec89c24517eb03e16f6c80081a9bacf54624662f1001d55f7fa1c1349eb815b5e6c9b0a4d47fc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410620655"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1256	iexplore.exe
1256	iexplore.exe
1556	IEXPLORE.EXE
1556	IEXPLORE.EXE
1556	IEXPLORE.EXE
1556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1556	1256	iexplore.exe	28
PID 1256 wrote to memory of 1556	1256	iexplore.exe	28
PID 1256 wrote to memory of 1556	1256	iexplore.exe	28
PID 1256 wrote to memory of 1556	1256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2806b6b0c9158bf20e2fcda8a2c99086.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
806f013255441647e9a8aab3f22ed3b3

SHA1
83029b21a958f800c0416cd23c5050750be87cc9

SHA256
bc9c6b01f75a71eff0a1b8392e28878a44f9298b1acbf93e0754a4a990f4f8a7

SHA512
2a7c7013cfd312a4701c42fdcd9fab10f1f8b4fcca0476fcc7b5002a28b175f53e7c04de03d2eddf6b73e420f2aca25ba22053fa0de8f9a38d9b13d227f92285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53eca588858cc09b8ec0bd5a6809f1d8

SHA1
cbf40b61f11b50d55160aa7be877e43e024a7664

SHA256
7f69358de2b89d9b8503e1e2d9d43ee8161733f39d034d48d05353179d0a0a1a

SHA512
0118def00b30dc29e10d8c055729aa3fe7d062fbc37f60716ecc021b368ee9668850346fa5c15f8a5fc982f3ba0932d784221befb815bb6bfeead4b924a22b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e04dd071caae1b6fd51a565147b5f38

SHA1
df181413d3df175dfde8167d2e476ef41bb8aa89

SHA256
61f4181e5fa65b67711e54466c0a6064936676ee581213de386fd952f38e7a5f

SHA512
0fda75bf6d3d1d494bab4c029692747cba17f96fe38e9b45ffe6706e116b73de5fe1cc15d29524fccdb45378d17adf22033b26b4a32a1d9e0d226523a325b2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c65d909ddefa2cda10e8ab0280a9b5

SHA1
65c35bf0a989f688abffec9aa779392184a20426

SHA256
140396a281b4250810d4a6f76256a47def4597a7e39df18a99bdffc8fbefb267

SHA512
9744044be5ed1f13efd01ed123d7b28a50beada370eadf02aaade662de70159f3ac8e1e816ef7df5ec7aa54c8a6a963312189611ff5e7356644f84ef89bced20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9830f3364601d7a3e70f1c136697379f

SHA1
641660251ac8cf2a3a343ffdc46a8c6fcefeb1fa

SHA256
e1ec28bb4979f07b16f178788102ce340a594088b785262c5680113449ec831c

SHA512
ef28869ae2a00f2da81db6a5632ece81ca4c8440faf8e906c07f802935eed51703827aefc954ae722f1caf865de3cd87928580e0a4122e7a0a448bbc4630f1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
303dff505f3326089122ee2bff9cbfc5

SHA1
c5390dd18254db59cc4e4517ab88af0667d7f000

SHA256
3610ea64fcd49151a56e0e1b2f2e67e85393fe6a6c8cfb8f45220f7c6572ad8e

SHA512
ffa24ff5762ea0c1520e42290fb85f2931f08f7e3fcdf585d7850ec4b31e5ffe04830dff331dd1964840663de051f64af4231259eedd5ed8515b797bff570386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80f439a9b8d070c2476beeba20d57a17

SHA1
00242d07782d5c40a8dafe48b7874266fee24c30

SHA256
d8123a774ecadcf5f9e93d762ae07fa7316742fd6b6111b9d609f280ede8259f

SHA512
f6304a2c9215a051966874ef59e400d2f81d8ad56a6e780f62de04e43b5638d81f0507ade726fbfa5add6cfe1259302022f49ea0b43071a579ca60ea152e531a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18508b6c70b29a0811e4db559f0e840e

SHA1
479ffa597bc184538f9ae76890c8c399bca5aecf

SHA256
bafaf9003e0ce30ad4e20cdd3f3393d76b145c3da03b249fe9bbdcaa994c78ff

SHA512
074f4739b83295f445283280506b67c5ba331885dcea2c7deaf03ed2f92bd6a3961bf14006fe2c062dcf1d0c47dd07b281e26a013d09ed6a884f6d2a425b7f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814392a0b0cff545714bc27a1e00fb0c

SHA1
ead70aaf73a632dbc51b76dcccc8bd95b7d836ec

SHA256
513c143afafc24143864ab13f91a7481e76723cd024ac88e5a099ab16bc2c2fe

SHA512
f027d4ac2f1d879849f5b948321abf3d344cf151d9b1e941747bc094c7ee79b7da6e9720e139a021e8685380614072e7449827fe950b478a63ed7ffd61fbb4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e0394162c23a69764a693e293d2a117

SHA1
d2b2131b5ad8ff0635395c3a1c26fa60c2ed6979

SHA256
0bd9cd37202421dd034f9a79eade6d7207e5cf681d22bc9e0b92e7e9b77b1a8e

SHA512
e7414347d19c9d644da9cd39a693d164038bc3ce61ff24426bef85c251a5e03f522d1fab49c3cd6f80b9116a0992c57f57fd960e1af7465b22deef649b2025bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9c4c0984280fd4de21a2c56ec68bb6

SHA1
3354e1fdf9baafb939403e9fcc70d8b617449dc2

SHA256
1bbf7a9ff0745fefaa9fca77ef744ae700c2796b50e266e3ba854c80716cd627

SHA512
61ce01aca3ac10603c1f979b61210357a3bf4c29635235a607e84249979902166cf84e376946e3e7d066a6a5bb22a98b5975887c72db389829e58fb9af69f997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27d430f3838e40fde434f24fa45f946d

SHA1
bb4e60c4ed6019acc45be38a0d7fbf2ab9e4c02a

SHA256
f571a19924055ec3073c4700567d3e0f53e15a0fc85a972faaf39d4a0e9e740a

SHA512
eb4f3bf7537259ed311f4fe809488567e1ecda2981115deec859f869eeff55667eb6b1bf071b4982110a3441458adb03d2935710b11963cb0d885326d08daf0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9164bed6efb6dd920991935402571e03

SHA1
969d32d496b0cb8d414b8be570ba8e9e91e23ba3

SHA256
8a03594eb2b3e662f2168e9d4f95d759ca69e392d25660041c599e31c2389173

SHA512
8b9630af0b0737f600ec4d5517277aec8d27d0b8edf8625bf156c950b4521e69b1400e5d4d1e3dc0563c9f5b14fb3da0a32254e3ede448cfb91cb744f9b69590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af9e69110598624abba22b35854cdf9f

SHA1
6a12097e1bc72e6361f609bc00ed5c292b4758da

SHA256
3791da11d8738d4b6575e2d917db6e05c8624ed3e843043d9da2bb9a5890aa13

SHA512
07c568abea741ada399ed7c57c3c851d8e5669b0a9e92ac1fd704eb2b21a489a23837ecf2486d690300f64c27bfd36e7d9df79f5b143043a360b6d07944f0a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C8.tmp

Filesize
120KB

MD5
1d9a62b80e870ae996013ed7f4f3e18a

SHA1
4cb76d647fde5c16f9b7c94cc079e3292dee3e79

SHA256
9140af2d99157b8f9b33a607a3f1a9c4b91b38bf1b25cf7025f35248eb1b20df

SHA512
6ea0a7cd04caa79bc127c873684d8d733df69537f1278e6ab9e5178915c2dbb2ef0802b7c712bced5e57d6aebdf5fbca7cbdfd6f1072571227d80c2ca321b7a7

Download Submit