b0770ebf4054dde2d194cf1b29c0a7cf7085dd8e1758fada499a09eeef121926

Analysis

max time kernel
124s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bb9a25ddcb82a313061a59888a791e0.html
Size

121KB
MD5

2bb9a25ddcb82a313061a59888a791e0
SHA1

784c42b4aa22678119c933226ec65aab607089f7
SHA256

b0770ebf4054dde2d194cf1b29c0a7cf7085dd8e1758fada499a09eeef121926
SHA512

12c2279b5bf6f9131b95126eed6ca4ca2ec15cfe7f386a45097717486b731a6437cee97e011c6edac96aaade9484e9b9c81e1bac5bd7269200de409fc8407180
SSDEEP

1536:oBXgteUeaBHOQThhfW1EovJQhalLOVn8U8G:ggUlaBHOY7WtvldOVYG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000008d0ea7d5b49a3b388179120486046e8e158931adb9581ceca134e00a9c8d1e8c000000000e800000000200002000000062cb365b29c424a5b0188c90b0fdd577dbcc591fba1053c048c822ae144d4635200000000bb0a1522b60105e02c183f816127ac56cfcbe8b3a6c49f9bf061c2f3f52adde4000000025dd6b3c570647f83abf75997378d4b3244656c45cad9def14339b4e7d8bca39913ff41e02114d571fc743f1ae7002d28052f3a81083b5efc1441462d82fe5f5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000007f0269df8450315d8629531f087b06995200288d158c0c74f3c90ca81233c57000000000e8000000002000020000000150ba80d7bd603a86c39cd080e7ecc295101cdcafcc14b0a53722015ee22f881900000000e2f1b7d9a697f9bcfc9806c55f72f22a55c1c50d6cfd4a6af521d2a3daa2dd16aecbeb54ab9e91f102096f0a57925df5c1454591afe36aed00ec19b29f05e00a36290aa59a47c9832e9432814233a4fb8c1dfc61a27811784eb933485bbca1bb0d8c958fe77d3d1e6ab36bd1fbdee7d1838787b5dcc9db2ffc721bcef3cf5ca4a6ebc9446a8c8c209f9bf76301ec0f340000000ef4f036027290befdc94ba625715921df7f32a7e229384a4eb73d1addadbb58b931e4bb68ddb3e86ddbd71ba31e4dcb23dff7ac6a1f821dd8ebbe728d16bade1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410644439"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCC06E51-ABFF-11EE-A623-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4058a3b40c40da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2128	1516	iexplore.exe	28
PID 1516 wrote to memory of 2128	1516	iexplore.exe	28
PID 1516 wrote to memory of 2128	1516	iexplore.exe	28
PID 1516 wrote to memory of 2128	1516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bb9a25ddcb82a313061a59888a791e0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584209c7cf869b85d3cce19fe01f5a0f

SHA1
d54426f16f998e6b4f58401d50e2d437fe36ae60

SHA256
ea39b91d27a4a4fb186cf994cad3af16044b2a213c705b448bf196fc6fda3fdb

SHA512
2f54a30adf9e6af681e6814eeaced2d7c55391424521e1a23fd08df390764b124ec95dbb2d16497006d7e7846b8471eb0df02410ba6b3750568ea419b12e830b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0a9e852d00c3e05a7a0c348762fc30a

SHA1
244e7d2082cbf8c8cfedfdca0e68d3924881447b

SHA256
232ee62bb3494e435877fcefd7e7d9f95b3c104f1e58cb211de22588c5a94ecc

SHA512
91313f2ceec655d3fd06611fb6bdd65e5a152f2d914dfee665d55dddcff5eebacba8d0b959caf76ed1062924ea09c6a20d2db3ed48c8999a300bd56f94a6cd13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9e1a677d888ca9b462e76f68f3b7105

SHA1
c8c7ac1899c445a1d03f11fa0911b16c22b88946

SHA256
8e9a0e099c2604c0bb2898e0f41d179515cde32c6906ecfeff017287d2b796ad

SHA512
5c4bdf4e48eab2e76d65a62dbd9fe89ed9616b338c5c8a9a239b77f51bce31309d4d91f630f27cdbbaf9a661e0859cb122e51d8c82368104085c9e8cb3b5e59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee1eff799ce5cbef86aceacd5f77c326

SHA1
fdd5bf7b843dca55b39a60505b84e15a8c8ff2bf

SHA256
45a14ba5bc020514c74b98de08c0228b1a84d1ca2b47598e7951129c0b342c53

SHA512
96a0de492dd887ef0379690a16cd7b430fb79e5b8fb512c534a505ccde9a33364acc48de6ed5dee7bb1a738a34d8b03fb3d9d92707f8f259e485ae0ad5441088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44b3269dedfaff0a583aa3d3fd2eb87c

SHA1
820572e97a60c7452087da64b239d1d680f859fa

SHA256
2602bf5c408c728846364062d9c8d2f05220f5e6a47ebf52070c029bf9908395

SHA512
a657b661e9dae37cececfc6d20277391dc25ad6322793ae1b5eb02dedc989d2b83550ef8e8b1e83c1bb674a6bc30519ee35b4163afe42c085663ddb8fdbd1bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410d77d7f54364089a91c178897ac503

SHA1
a46840b5f96d65927998043bb0322bb95e1212c1

SHA256
63e53e594e8f65968f7e22a4fc2cfaa40c837d5cb882e61f64f8b2e4012f0d71

SHA512
723e0005f5c2bd8f52f3ebb0d367e83f1e2de46c25a602f10b3c1a59cbfe21b9f4daba53dd7971c7524b83321fb8c3932c899c80455c8b3d1de6563c5ad7a37d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
927d09474d729069155fbd43f28ce1f8

SHA1
adfefd605eaceb9addb99bbba0ed882ea0df446a

SHA256
fa105d0c289c2328d21b764b2be5e1ea3eea54e4f66140d8605e478a8607a7b2

SHA512
1386b66254a5644c32570ae67646958bcc0888217921b2472083e935dfe6f9982049d6836be6d4a3aecb9005bff90a4e751446ccbc61fbfc5d989e77434b5686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da1d9389fa4d0b00a1cd4862205b96af

SHA1
b8684749bc28e3fe92c599ebd4b1e7910830318a

SHA256
a7a51755d0cf76f3320cca093a48ecb18d6938d753deeff864e64bdda796ef23

SHA512
673d6ceddb2c780403a4bfc777ec9a0c5a920e087f44ae1bf3f2bf0d4bed10a82c8b3863b4aec54282676d0e68f62381a5ef196c4b1ef8f73e729daa77abfdb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A67.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A69.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit