e8b304f467d2d71d86479c3cfd5b1f65ad3896d658f041c5d29aebf955152c8b

Analysis

max time kernel
143s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

680e924972924e81367daf1fac0e2e90.html
Size

92KB
MD5

680e924972924e81367daf1fac0e2e90
SHA1

cbe65b8bf5fb4f47b927221b0f536418c180dea8
SHA256

e8b304f467d2d71d86479c3cfd5b1f65ad3896d658f041c5d29aebf955152c8b
SHA512

c54004ff0742029c18e9b0ffc304b5f8be328b98cbdf9b9fd7e7f51dc2a153713051be9ad1f747c1b4c95b02f133221014ff4de8f17d7d0c7dec868363378df9
SSDEEP

1536:gQZBCCOdc0IxCOXDntoBf5ZQ2ve14IKU+da1aT8rR017J4drUTHR4I5x9uogjXOx:gk2C0IxfoBfDQ2ve14IKU+Y1aT8rR01H

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000fb1ae8e336f57e9541febe2c8e6c6b405c4b0aa76454f27c3abe98f0e4651047000000000e8000000002000020000000163b7c6404a985455f8c121607701f9c622306327b155561cf30e333ebccfd4a90000000b6e08d5fb30a96f1bf9c61d430bd8138501291d7ecd044fbabee1009687b61d820a1a567da12d2cf653c42f2efd79ebdef97113f6ed1a6fbe029f5cf8099d5ca357e0ed89e9d73011306063a6a25ce94340a16bc7fe8876b3ee849ddcf6a47759038494ba30f19369e00b327b1b6a33b7c71a07d42154751a85ecdc8458d728635b2a414d5b512fdfabfb3a74b628fdf40000000baad287b6644d378def980e7dab1cfcfa4d6133fb96695701a233a2499c67220666f5c21136605be9a8ff65003a6e07c86216f25a558f4d46f9b97365b138a54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60265ab1f14ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA304011-B6E4-11EE-B735-D6882E0F4692} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000005c4248295e8db0d9fbeea24e4e0b5eab5cb43d746d930700c78089c6fb3a1517000000000e8000000002000020000000f7f19902fcd1eb9784d45bedd51d7c09da7772ef48f1a75def3e90bf05b9fce120000000ff3ab76432c50264ff5b5dea6efd1277fc98007865d03dd335fc77ab29b973ee40000000b33d6e8273fc8abacefa16eed296e25c82f2d0ec8cdce06e8248d06e2c999fcbe906d7a02b68bef86dd4810b8c5e28c5f8abcd98f6c62b4c62e3e4c00574fd39	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411842324"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2128	2984	iexplore.exe	28
PID 2984 wrote to memory of 2128	2984	iexplore.exe	28
PID 2984 wrote to memory of 2128	2984	iexplore.exe	28
PID 2984 wrote to memory of 2128	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\680e924972924e81367daf1fac0e2e90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3473fda90f4c48e52d3db964436850e4

SHA1
68a5fee6a8b29d793e9c3f2360ba31693dda24d8

SHA256
35f28eb4446c5a7ba9cf6e174bfb6a524c225fdedd85df640200b5a77414b19c

SHA512
06994accc0b3aec83f525b1e52e5449440b8051d89a8580f9fda03896a357c4fe92556d08c008a537df909b6c0e69ec76d1c2c9058fca9bc46bbe60141cfccc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f3d9a788c9754cb6ce3d92cde27403d

SHA1
872d72c4e9981edfe17d5eabde3480f4ff694aed

SHA256
d456eb3ea37757245ecdf1942a81b951d971f7b4b0bb4c148bc608936891e4da

SHA512
20d30dc688e1314529452028f7114235b0aeac51c3f0de67773e9ff5d88f7cb8aba7a5d197d23b69b3aaee86e9f7392f18d49336c97858cad74a4282831382b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e334a288fbae2f9be616d8574d2a761f

SHA1
4c17bb82f83289c30561b7ed6f72f17961d2184f

SHA256
d8f8076a5bd2890a159bf11bd590bb737c794a41cb2e31e8e4cb43f550b87b1e

SHA512
34b95ce03f2bed8ec3ab9b7f85131eda85f82737e7e9fff9cecd52d3a8ed7241545f0dd0ed0438eb24a4549df5713da650cf7b732b02a79299b5652a7d250254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ecd174a16b99c0dc702d38a301ad503

SHA1
b185ad0b3d76e325140e2bd016ff47825771279d

SHA256
1e1fc5fe15bef20a14becb22fb26935d8870850728ea187ee9b419af876b3359

SHA512
8d7adaefc689f7a34635dd34c3ab88fdcd48aa1e664f7c6b93cf6093c39cf3400de98443e2255aeb268f486e0bc076968bc2fc16e32d053ff33336569f01c4fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d01e2cdd0ae5f11e14b59d93e8881887

SHA1
2466ef42f220e77e6f04a36be82b35a4f41e5f93

SHA256
9bd8952c64accd98fc131d3046a4fc3cacb927c41a5c33769b5e9d46e7bd4d99

SHA512
4c8dadd79a890cd0368ded83269d7fd56b3d3963592acb071e337b42b4416dfecda4365706a81b2708fd2838cbaf12d72f321823acfbd3666b2f8bc27c46b390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76857106565e828b78857e13304cb2c6

SHA1
02246992ea61a6f73aa04d0e0fb85eb099eef37c

SHA256
e478c976e16e227a3a3e667ddc42d31affb6ee298331693125e14a263b3f0ec8

SHA512
a62cc771fb91a394c07d4c3b9e17e26d9753eed68f1eeb61ab59eb4bf49fa56102c4893cee4c79c749d54bae8fe8baf1e48649076089193ad62962a1d1ada2a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a023c052a4373ddbfc3222138fa0dbc4

SHA1
942fc052a6a87b0c4712cdf27283324a98d8442f

SHA256
86de2c71b0ad41219109a7737d7097dd0ec148dd5a126e51f08bc0d57cfe55ab

SHA512
10d3b8bcf181ec40bb9af0aadd931610150c3742d850c35e3b1dd62e9cbc3a041663cedeeb3091c0a3b10849ac37b16fe68e7dc67dd435320492d74c5723769d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
569322f59046457753d48691b8205706

SHA1
69ab6a09fae463805aaca501ff505b17e36fc421

SHA256
012ca51edd5a401d61fcd94b4927bc89396eb592e753d84552c77414d836a53a

SHA512
5092e5e0c4b3b0648441315bd27cd81dd6fd145289b37f2683ed727e3ac622979063474e0cf6a8591f0a802bf3cbea2b0223f248ea4bd8329f965be6860b36a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c74b7a478a02c1f397427cc37a8258a

SHA1
3eb2b0a311294197e4e1e7e63b7ea7ce35d8661e

SHA256
c78f6a4776623c7f22b15cf0bded51ac8eb1832ab9971bbea4c2f45cdafbabaa

SHA512
c9a7f666be5e5ce04ecc3fdf759f06b3489b246d07d4f1d2d9b3ecc6a19b9ba06668f8138f206d834f287ffe441f7a2f37c31e34db4fc7f1168f2fa4f69db0f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25d699b956e49aee0c75aee289332c15

SHA1
25888c52b2cfc2e1e111eae592db02c279489d35

SHA256
428cef33d109f74d9858de70760b279467ba1b07412f0ee7e4c9a4a330492278

SHA512
92f37e2523619c3fc9fbebf3495981c553d840cbcda04325fb7ed433199e85bcf845d64efa3810830d636de427812e89185ae1ca9bf5620678ea6b64d66f39a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d344f295e4d07c6cf726c92e66fbae1a

SHA1
352383ba67f360d903ffd77a440de26baf6e1415

SHA256
9b8d5be34dde84dfff3e5366176d95bf758bf9eebd0628e6613df684cda36e06

SHA512
18016d8630e2ad8e0e0f2093bb052200c545c0bceb57b2752b020b14423f9b4d05642b48ece0f26037024edb12ca0e49c5dcc5972e962b6135408c21f4c7f7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CAC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CDD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit