133ba696e84071ad15f276b0db718e58e931b2ee1b9eb5b70fcd1e35dfa05f74

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

296a53e9a0ffad63b05415e6bb510db0.html
Size

21KB
MD5

296a53e9a0ffad63b05415e6bb510db0
SHA1

cea486d06798f9248b726943944c5e937d05b37d
SHA256

133ba696e84071ad15f276b0db718e58e931b2ee1b9eb5b70fcd1e35dfa05f74
SHA512

a57ecd4f820cb249deff5cdc1b83aeef7a3a3c8e3e948c783bf490874035a5d599deb3042fc26531203382500297643ec9f309d936037c82a5c00dacea114798
SSDEEP

384:iQ79VXstrcd1049WHwtKW/hsLcp0JWnHPZkz6AOm/osBojbqvHZ1:d9VXs1cd1049WHwNhfJkHZ1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE0BB341-A93D-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d8e4a18b1d8ed80ed7ef55e7db5a650e7bb8c920d7d636ffe52a72eded759a8a000000000e80000000020000200000004e54fe0d47db5047e40b01ec937fa23d7516eeacb69830f74727336494e510ca200000003b998e54a1080ae171ea21d84b90ee0e9aa5edb3c72cd80b2ad02f2004bbbc1e400000002b709ca99b82301c711abb516fe12af9a43207d0f2e04cbd4e93852af397f07f68d81eb56b70169e48cbcb9ab458557e7ed9eabe3b7a8800371a2288c0e229ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d96ce00b2915f2729c15967025855a6cdbb89f30281512aab017f67844b509f9000000000e8000000002000020000000caed0f499ea67e730dad9cd6435160cdbebff82ae83c082595d01323be78dbd3900000005c29653a3c59bb06b3a823f8ad1c20f78f30f76ce6dfc873352a834e02295b019005c0b1ab5d5117e5e7bb7ed20258c3e075ac799b085de4fa595ff8a8d2dedb281f2841fc9b4ea4d364f35f0c8fa43ffdab3bb0f29e63dedf2be3506a2a3d6eec24f8b14c7e5bd76b36850974f08ca5d9ea82c9b4905d60b8a647432e19a15b7e561bd70d3afbf4e8499c48a5c82ab0400000000a511121bae7e3c7abdb5455a19692bbd41d28e17ebbbd385a6b954cc1d3fe566727c5351430badcfdb169797e828e68c4bbfa0fb98d66bb27e3e25a02b6ceb6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410341250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700208c24a3dda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2996	2440	iexplore.exe	28
PID 2440 wrote to memory of 2996	2440	iexplore.exe	28
PID 2440 wrote to memory of 2996	2440	iexplore.exe	28
PID 2440 wrote to memory of 2996	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\296a53e9a0ffad63b05415e6bb510db0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
643c884baaa74dc01a67ecc7f4aa82ec

SHA1
84ff362583305215d3bb214302170bce929e62e9

SHA256
2fed74420b7b25eeceab897efdea018ca939b97e84d10b8c6af9cba213d8bf5d

SHA512
58881efaa08141e5c02783ad79d7705bf33a1a77edae7b75871e7339a5d3991a14db8fd539f0cb8995e7b4b849d6a33f493fd9c9f85f8a2f25e6b992a726d6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e69ece33acd64fd9906c48a53c5ed376

SHA1
d2ef0bfcea304c8985c62dc6d7b54afa24fc4972

SHA256
d717fd8f2ecdfabad209c59711266bbe9242c7d9c96fcec8fe69e5a0b9536924

SHA512
637cbba8bb8f79ba864746eaba4b19d6bf7572d6df55070c7d40549b09a4562bdfe315c35f8000f479c0070b07224c570473f6cd1b49e361f10656b4694a596b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a506331b47df2b2b685e8cc46250b2b

SHA1
9789a57cdcb75a8e2fb0a5462a8848b59419e519

SHA256
c7b503dbd19199b3dfd1c29423767d17a92b6b86d50a1d144a3216b91bd3796b

SHA512
c78d2f63b79e1c34f32e95d061860f40a504aeae49951000035b44a91a599f5c659949a1a5044032475e6ba6273f87fed959c2f6b3ead26ce8a454b9706cef42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77af52e57edb68e3ed3644bf5cf13c4e

SHA1
1d3a52c155eb6e349c4d11df15c7b1ea9bbefe7b

SHA256
12be48dcc480793f9c8455c8a6a39735f2ba3a3d2e0808eeb0c6fda5cefe511b

SHA512
26268e34030e195ad7d83b5432562a2fd2f7c5d819e4b6948ee7a88a811d0a9b4f261b5bc92f04ddf14fe4c26cb4e6e6789f6343f5463e8a61161752642c06d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cc0039c53e2d1113f9a91d3215ef006

SHA1
23e353549763fb1a857a961542a04d630026ee94

SHA256
45e6a00445bb8c4f6690a932c352fa137fddc52a5dcc9d89dead2ca224f53a06

SHA512
7c879b93b7fd2143d0123598aa2c359780d0ba21ea23af440dc417348c15d94111fedb9c284d06a76f88468ad3a616a55f344cbaca1bdc09508a9d810a9214d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d330f532aaff4b57773bfa825933867

SHA1
684619d41609d86aa59b6845b78c5f9b8595a536

SHA256
61f9a148f22c0b6fe1359c2958ec6d91a7b67fa784f0ca2e37063545aa001f4c

SHA512
f8631846708352d8563ff3793b3d84688c28cb2089dcc5d96d1a3788e814e9f13542609733de674a608dcabaf569df2b11d7ce67630949cdf36b061d7ea0c526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94da84efb68c82a7fdabfa51113309fd

SHA1
053c094e4a71019e575d48887b312237efa1d8a1

SHA256
f6707d3151dbc86858589a2e4ea261a24f21648ef73f6472b6441edccef709a3

SHA512
ea9d448d1c0b0898cb70f36727c1f49ed3f9cfa98ba2e28fb3a58f13ef465cdfabb5d52c9e6bfa40c33bcc2bc77b4dd63582b5ba3d5fedbf110084eb7cb4acb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e37f0cb59f933461c963b2c463d42ccb

SHA1
e554de62a0049a0fe6c6f00cbfd1365e98442115

SHA256
d228ae667c26b3e8796740d137527d9d561f394d4bc3614b0b6c5f3e7ee3de27

SHA512
b0b2c35e52d8829c5b56ba902899e91f68c4901814393ac8bf571bd7ed83db3cd5b6cf30c49b6a7eb435f53483bf860704e7ce161a8d9a83c6fde4f960baaa98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
906c13ae26685022e88bf0d7c6207ed7

SHA1
86f8e63a68d6760dc3dc047e4f51f481f60a2715

SHA256
e5eaf4bac354d548670befa211783c0ec50aeb4339727e56675d58e1fdfdc1d2

SHA512
b83c7335a1881b5330d1071cbf38e2745b3b18cca42a69be8a6ae80138eab1015e08dba9153a5786aa89e3fa0c70874892978768309e1822e1100a2f65a34a44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
418fea84abc517e56fbe7456790d6c1a

SHA1
7942a879783cc040967099f5b297421b09164375

SHA256
bf1be477095c6e49f28854b0cfcb116562fecc47a87376ba8a59316eaeff39c7

SHA512
00f565d4c67eada42553a7c39620a7d2db4f9588762f200ea587824e68756df674f599b9ece2e98993875b2895c4af025fdb43d7443e0e4a94c3a5a1f34a08d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e6ec72364fd65663e749045a9562aea

SHA1
2feded7ae20518fad956f7c934b7b6f881792399

SHA256
c8958d08a5caf3f82d0185b57f29580a2afa49b1d8788f93d4b1a478de745c5b

SHA512
d32bef4b0ed727571b01c31b1393ee7837057b0384ddf90274bcd2c993c8c69dbb809298003730f5c66bd162b1508d175e5c3a7c6dc266597f0648a2a492fb10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
725cd558077784928c5c2954dd92d1e5

SHA1
80cca7fb114062049c6aa2aa91a2620bf90bf2d3

SHA256
8a6b250661cdff6bb6b8bf84fd500675ff8ab4fd22fb835d6f6e3384d835bd74

SHA512
c75df88f7024d813f113d9ef6ad24563f107d6c7dc91edc37d388681790be486b15c4eca9c2b02b890cfc29f1dafe5bef430aaa5489a0bd5883618403f486738

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1F1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD1F3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit