421bcc1f6e0300114c84eb4455a359daea09014bd557644c299504d5650ce4e5

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8029b65f3dfb6eda188c8e4f7a959775.html
Size

25KB
MD5

8029b65f3dfb6eda188c8e4f7a959775
SHA1

2acbef828e0ac14fb6068688050e43a3dd12f30d
SHA256

421bcc1f6e0300114c84eb4455a359daea09014bd557644c299504d5650ce4e5
SHA512

9d0c6a4f81019dd2b77dea93033f0b1124fd068515d82994bdaa4352d6882431b0c4c5a3172c132aa6006d1c59787c305f7e3eaea1955645594fd40a1dce8d96
SSDEEP

384:xy1R1QREDBeCliOdp1jBDdhEECa6XYa6AlswK8UXQRlYuobCPRrMO77OM0TCtxYH:xy1R1DeCUOP1jBDdhEEh6XYaiIV77OHN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000741dbc426cff8dec4da2d9e4cff497e2d307a3407321ce81fc5df9ae43fca748000000000e800000000200002000000066b6e436925c9465c581d8ee568f11174cbee74da6a76e5414bf61eab75b51052000000062b4d4a0fdae867f1d922a952ea63d8502d44e675da2b36f1114c8a034b0830d400000003e2b38bb44ddf994c505b0c9fc0d739dbd2c39ab3159b9e5acf9b5670ebd52ce75a1cc242260fccb9681621eed3db49baea4192d9d94843a3e9d6bf73e44430e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000084b78feb24d1e322dee1e587e71fa2025843edd64e690a7b513f0319835548f5000000000e80000000020000200000009fe6efd8bf4f6982cba3a528e1843e335a9b0f2929022ec8b0fc6dc6ce9a12b390000000e339c064709442b1c7b18bf94a3621ef79c9ef8757d4da8d11964f511ee8e353e1c8d8ac4957438a1e87487a428946865c6437378e8b832876da19b52e913fab5429a8095af704a9aa2c10a07fa78ea90186ceacc2b4aa2e0f821326c92ea6b26e4f32240668d1199477f96c48c1cbda6f41a6debc82f11ff6eb0dd275b1d084c1b4c6b0cffe22b5228c5a6ad536353c400000007e3d4ab8604903d3fe314bc522c4ef422431b565daa528645700e970958ab1041787c578caa0e807400c7733a0a8bb8c6109559631c4a09ae6c74e2b7dce007d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412703245"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ab022ec652da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5954A211-BEB9-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1456	iexplore.exe
1456	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2420	1456	iexplore.exe	28
PID 1456 wrote to memory of 2420	1456	iexplore.exe	28
PID 1456 wrote to memory of 2420	1456	iexplore.exe	28
PID 1456 wrote to memory of 2420	1456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8029b65f3dfb6eda188c8e4f7a959775.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6441f23026f0cf5ad533a8ab08e2a70

SHA1
0fd1af524d45d54c3c235a8b7c9802894018a0d8

SHA256
db6eb1888c67a42c8ef884b31738a354a0e87f7d38c2d5e3110307ea722682e7

SHA512
d96bd463e97a8fff10fcc838c91e69033447b4db91675ce5c5e44631411c6b59a1a2e29440d3f47f1abb715f4df75ea85b71e9f8be1247243e2f125a2bbdc7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a863109b01d787f3d12b0c63a31a7bb

SHA1
7b9555d22d523cbbc3cd6d636e07c30f5c961b5b

SHA256
65db9e165709501e51b8b83709afcbe612f9e67e71ed59955bbdeb4f3c2b046a

SHA512
f34b52c6d818fe19f1ef127decbf2267c41a91e6b5253e71610e7acc5e6127b748d950b4eda3c230d9965bad173dd86bc67b19fb207aef090e307e81e4906842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15952c4ed0227f0b588133e4fc3cd5ec

SHA1
7d8a6382775811fa918ee9d6b8a24adf366c59f6

SHA256
fe558db21e5b55526835b0d99935877179f66445e79123cb185badd1c701e1c4

SHA512
40f8c1d99df68b14c4c914630a59e6bce00e21bed5ebdaea0d5ec9944905836d9dcf293f074857f920f4456fcd78dcc34a6513dfe14766a3f8285cb871fd8734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec2cb8b81658552a8124f443e552267

SHA1
0851cbf249ab17dd5bf130db6c14b4014116cddb

SHA256
bedabc1a28fdcd15dac485b5432fdfb3abfd6de7239618537c51cf3353fd2961

SHA512
0ccbad1f9b6b98f0467102ee767cec9763eb0d60f807ceba2924f9b892dfefc107890225bf5a223f3c7fee82de3b3bc8fcfa19b09af02876bda84d30c526d8c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0840ddf36ca428c42d855d2c519f7f6e

SHA1
95292ecf1276370fefad4a87d6bb856516c147d2

SHA256
368ac8b11a59e7685fcad004bb9a125e5ed252a1a18b8292bc90d509fabe942f

SHA512
2334ec7b80a3d3e8fbc9afda00b63753c197f3a55d027caa95f3cf7cc9f0a0ec5c0cec8e86191a8c504dfa64f47bc0c8cf7d7ca7dedd89f24c27813dabcb6a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a5112f4386e9e6eed385e12a5fbd6b6

SHA1
3462cd5b7e5f062819caf155ecb4ee5e0dd52df8

SHA256
8a911f31a22212536c02451772e33b32368fccb039b042a067439cbd8b6e0026

SHA512
b8e46f59efb1c06a14e442889943955b5475ca0d18ad41ed14ccc97675e6c1a67d47b5a2457f2aaae3d6572dca74f20b52e69bb7a64a401f4a59f00e647bb112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2520e2131a1f438121a7e3235ecafb40

SHA1
d725fc1db3df141189ce7d9a3d7c915707adfcee

SHA256
a4cfb2687bd23854a6eaf874c01fb2f2c36d6ad955335cbdfc836be0745836d4

SHA512
00f25a2f006df7727942026ee33c2d27077029a8c21c818c98431af3a2ce3e9c6bd5b41c7c5e2d75ecbb8e9316708e175d7ae37f07f54161d82c66642f8322db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de1c9c13273ff52da95b2ead40c56df

SHA1
5cc04feb97e54cca46473d9e56b8991745ef9a6a

SHA256
b387a2e512eff673941140d9bbd26868f16d53bf90786f531b103ddb27814a59

SHA512
8e68c90d3dc5d0d6e5c307675762bf74b748941bde1db59bdc3c8c932fe25f4044fe6be9f241881efb688e5bba2d1d2d92c2bb95014d64e4226cbeaa142714f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c6707e57baebc98f2fe50c5d8d33553

SHA1
579a5ee1c79e219c7547023598c9d20f9cb855d2

SHA256
4eb43a8d45c666a6e5b76f2c7a883c02429512ed101d8794b8e6f6f5d6ac1bfb

SHA512
d5397a8b9ca87b86abe2835965e587e422a41cc4b82f442038e71e7a98239b6db1a714825184db658bd985441a486b5aeddd3986efb67f5a85759f3d10a93172

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7767.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit