0525dbd5941b81ec7addf84073b9d43ec0670107bb05b85219ef513da0979c9d

Analysis

max time kernel
151s
max time network
167s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b09ea26fc527cd5773d1bfb6f306137.html
Size

33KB
MD5

2b09ea26fc527cd5773d1bfb6f306137
SHA1

ad669f0f45a1d8bc7fbe26f081f703c1c8360468
SHA256

0525dbd5941b81ec7addf84073b9d43ec0670107bb05b85219ef513da0979c9d
SHA512

81c0b0e50c3836b734e6278ca9f902a5a5b7e5a99b256e1dad60437915838a65c98d65a3b8f3c127cfdff6d24fbfdd80d28f77e57793158836aadaf6f88f187b
SSDEEP

768:S0YBDIwjIfIMBrZy1r1T1E+A8NAKkxPWrAsJ2QjTC0IgLOw:S0EjqrZy59Q8NAKkxPWrAsJ2Qj2ST

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000dfec89ca968635bccf21b2588a2c03b439a81e4a54068459e12ac0190e1fe0ae000000000e800000000200002000000098a6e480a8e0a834fd832b08ba9a8817e93b5577793a400b040e96a5d39e4cd620000000beae49b38b4af60d3676f13e78185bd45607fe514ae7313157835061a7ab266c4000000062089b349b494391cfc1e7cd4a7ddc3d3484d6f2fa22ef2b041bf207dd79d1893284bd375db471256ed422df7b6c807a72c194d029140428e7b002cad5e2db9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{236394D1-ABF5-11EE-B187-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03650120240da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000087fc62fe0ea5238013a38702a699187d0e000a8550e50763a1f381fd47d21fe0000000000e80000000020000200000009563f9d9fa2da5bdf543c7902f61e5f5738eab488175c7562ba0b3d85b43951690000000c49e22b3dfc51fb3cd474e3cbbe918acdced6978c6f50f17f5a55a44b9a8ddeb028e009819fd23e85550227a249d1129db0e6470a627bee2e20cb310b9a32cbd029c04f8438f18080e79701697f614eb1501cf0be8bce60f12c9cc44fba0f5a5dac5e35080e2af2f13bc16373aa13cd5300a672736d3bf70f45e36d787d78a8862c6b4cc675e59743ba7dc6ff61eda7f40000000387f18712248a5ca683c88d55306fe262718af96b5ba79a1cc7d35143169b6cf37cf3a494f2e5cf8e674b56f56b1b0878e0ebd005f10b5a570cfa36d0bdb24d3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410639863"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2780	2928	iexplore.exe	28
PID 2928 wrote to memory of 2780	2928	iexplore.exe	28
PID 2928 wrote to memory of 2780	2928	iexplore.exe	28
PID 2928 wrote to memory of 2780	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b09ea26fc527cd5773d1bfb6f306137.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66654c33eee532b6da3f17658967b2b6

SHA1
0f62d24ea2232b905b82d6f29b5aa867e8b146f9

SHA256
b6fecb0f7c0d910b5f771b9d8631eb221632fb9a8c450d85f03d245d8a4c02f0

SHA512
fbb535083fd4417ad3660bd38f7d2ac11d1f97d93f5c606c6c783174e8db9d3c9480c8cee78a3a7d057f97dffdf503813c91bdd6e9b7a0397fc7e91fea7d6d7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e1550ebb30620741184a4c532b6469b

SHA1
f616ab3300a0252d3690a99d98d1efd7b7b0bd2f

SHA256
180d0dbd98abdcdac583c5ddd69cc53fcec3faf3e602f89ee9f4370a05a7514d

SHA512
52e3c343ba410657e55002778b7c65a270d5556832680e8ac2c9d3a7c634aaef3ecd656bd6be05158b1f8ee43897ebe4062144462e60666004d5564159c1b468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6a200359139c5d59b7aeba6c0fa41a2

SHA1
d7d45767ff330bc11154b448ab0e15f2a2cae3ec

SHA256
b0ac2195b98b1b53f9ae8c08aebecc6625bf1093d11b7334628e1a7f0b5a694e

SHA512
4fc10cc6a892b6b9945dc1264252542fba2abb53ffd579b7ba982ed6bc7b46ef582345fa46a47861212c2747492ff5bf65a5823c47adfbaa3c57596f41c2a7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce027f71ade72fc37cabe39b5bd6f84f

SHA1
8ac3e18928e966486fe7882f7daee6335f2a615d

SHA256
52a58dd6b9e9e12d75f26b71e87adb235aafd3693be546a317a5edaf2ef352a7

SHA512
4f6668ad0a07216e95a4d4615dc23f6ca74df475b76dccba510c4bac3f4a0c6c1fffbaf07d5138e2e789b16a6c616d4f78a117783e35620e7043129cd44c1ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
672c8e96323918caa85336f6e2f40be9

SHA1
828abe578217b71fc758645dcbb3ea85acc11aeb

SHA256
f2f24e3fa60bab1f158fc30f775420a3dc43f1d7affee88c76c351672765e363

SHA512
f93f4b812bedec54fff8eea8732a9913309f9d90772486764dbc20b855ad33bb5fe8dc67dc8882b793b8c18cebfe8769723dcf86ff210640c6c9e599aecd60b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bf3a64e7c896388202150f6922df957

SHA1
ef81846e5f007a5220a92e0d7155b32f43d0fd10

SHA256
fcc9be3f1754c9402dce385f0834918c87256e25e7d67ab16affe149ca0358a0

SHA512
cc0214fbd65aabee3283be3b0912be42bd354cfc11a3c39ebbc07bf72604ea84aa1318421ae347f65c5e7856f47d72ee5cc7966b6373d425c0a87ef2f8f459a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61724062d264ebdee8313a527627bdbb

SHA1
683f90d5393cdb17493340dc51d1746c7c5c3ed0

SHA256
d25354692998877979b654a7c66cee98914dd40696e78d648ce5b2ce02b11c41

SHA512
c0b9e093d19f764fc22ba63a5f64dc68de1090fac658467b1878018438b7e3398929ca5f7521023e42b11deef4f6d1251e5f8c447b5089a655e24b96b3b801e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
766b333f8d184146502d7036ce9d2474

SHA1
e7daea60f68ffec9fb116b98118d7e7f2eb4ca82

SHA256
beb682be889526cae4fafd38a690a5be34f1e6eb26d76dbd5f91aa443107ad0b

SHA512
45e22ad2e5888329e213fb4239246ca526f42d689d8a9cce2fe176a7705f8f869edfbd2bcc8a1ea3281519493ff28fae29657f87a6894a869c71083f4a90a622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d6b8784b2e648a5a765e1b4bd623fb

SHA1
97f5ba7ce58d506ab90293d0e665ab627f88bc1c

SHA256
b524f3426d44e0f08f412adb474d4fa4cc25696e8d5121fe561aafe0ec9b6807

SHA512
c3a1b46ef7d8536151d9eefb2b8a834fc64c57e01713123725df1d596219728a8bd3ced4db9980b7ee3879aad8ed1dea8417fb87fff77ce211ac463461cae48e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddc1b381af0d1efc03380cc5f61cdcad

SHA1
ea6198579c8eaf7a4ddd294211336c4298ae49a9

SHA256
fa05ad0609ed9bac48aebb11dd433b2a768b2fb774c530e5981efa9f58b0d200

SHA512
dbe991d31bb74cdec0a77e88fca458a5431e72717d6168b03eedb9b15af8ebf5e6f1aa2fe3b479f054dcf7e83e16fbaee425457f166ce96c7464c7817ff46ca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25858a1621ed04030ff6bf5247106276

SHA1
b8f43ba9d42d3d36ae38b822d48f761758a266aa

SHA256
036874290742e08fbea0c609839209ff74c1dfc5e45dd079c740b9bd8f0035dc

SHA512
2d3da21ac83514feb2ff0a35e9b632b2055ea0bebb7700668e88b4e6344a2b8f98b7f9857b494ef50033b1ead9c76bf779ee779e4d1d65aae383ad8089eb2e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab65C8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C65.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit