15a66cdd3b75e7cdabbe7b7281055f6f47d5eeb7aa582ab504f9c19070e979f2

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b01d93f5a703ff012df0c0556775bd0.html
Size

24KB
MD5

9b01d93f5a703ff012df0c0556775bd0
SHA1

5eeac67a1c78192476716866ae603ee294401a51
SHA256

15a66cdd3b75e7cdabbe7b7281055f6f47d5eeb7aa582ab504f9c19070e979f2
SHA512

0d3cef55a4068328fd339795032e1c737760a6447592dee33a533632e303579ddebee2825a319f0964493578df1ecfba1543e78347103d1ab2bb8ff27d8e67c8
SSDEEP

384:ErB9u1+QMpQl338qWvv7bFdqJ3Jj/odrLRJgkA5LwaOGBr5:kB92uc3d+qJ3JLOQk44Gh5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{162EFA71-CB03-11EE-9CB1-72CCAFC2F3F6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414054329"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2376	2092	iexplore.exe	28
PID 2092 wrote to memory of 2376	2092	iexplore.exe	28
PID 2092 wrote to memory of 2376	2092	iexplore.exe	28
PID 2092 wrote to memory of 2376	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9b01d93f5a703ff012df0c0556775bd0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
80bd14852a17434afa3252d7b9f98aec

SHA1
b5d17bf3c621bf73b44d1bc6d45f5380f8d23b41

SHA256
54742a783a72ff545805ed5498be059b1e2e2f889369996f3a26e24d17cafaac

SHA512
85f11bd52f1efdaccf86ab2cee6d782e4cef8fa399f4a005d037e821f5ed061388b5683f57b07949e9b6290d48796ecbe404e79cdb69afa84bcfb2326d4c4c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3180cf17969079d4c8ab143232fddc5

SHA1
c3b9c23bd4d6a53056ec8d95546992035ccb9841

SHA256
b05b721b700699e82e246cb89d6d67ed1e5dc4c4aa8a6607f6c9fc6b212c36b4

SHA512
bfc87d82e87447e34a85fd830f5656a218befd150d2c40350b0066a70a125f8d6f8b797745e96c6b78a1167aedae1db1bd2feb8a8efaadd10f4aee5f88e33b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce680ae06831cf785672baca2d7faaf3

SHA1
bd86637f0923164769b1f88678c4aa9ee9754392

SHA256
72338699ce96dfc08e8d65daadcf1af3774d259194f2e93611b66c451d4a888d

SHA512
397404a0a1441659038b2a8a527177d3a1ca23214c42792c833ba1b1649c9f5267a577d46c82d36102a5a35803eac43a27fb03ce2f93be43f21b63337e08377f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5452986057b403346b4581301eb0201c

SHA1
d09b12c6d07c850584bd7a2f02c848e6a5e641f0

SHA256
b6199c65af441db77d694494accffe894afe318068d9b2ad843de3ea96fc06c0

SHA512
ad982c684034c454470d1bd935be6780a7e9b072ae2026dd9e9d043461b0093c43a8a8d9752c1596ce75745a34cfa995917ed312508985108c2c156319bef78e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48596af630d0950ee12dc3f9af272f52

SHA1
0cb6804ebd680a229532fd3c6628327210e9f85b

SHA256
b639bf51e7f949f22bda7e301a550cb2efb18dd3c8681fb6782843586e8af40a

SHA512
d9b20ce3b789b64e97cfa334556433fe3abaeb80e2de3c5992aaddd3e5b0770ea74cac8be4a8bc0fc2031c20a489fc3911ad871e10ffb486b97788945fb491e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1f9287d3c1b19d31d0ea88640177c54

SHA1
785064f237e27e51ebfc71f9e3aa2f8056f0277d

SHA256
78ea39a08a52b5c9f68e04d486a75d19adb2e37d7ce061feebd4f358adfbbc98

SHA512
835e4657b53004c6d756377536cc84cb1e205e47f881eaf5720508f0f41d4c4e4eee9d149849e674dcda190413106b8790be4e1d4fff8843aea774cbcf5330f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7c9554b2f41e9d4ff5c850248127fc1

SHA1
7fbf0761b0df486f47e74334ff3f72903665b278

SHA256
643f96f0d0ccde7ee71096b8c1bf3d509caac710cdeba019bf68e5ab12d52253

SHA512
02f640a234bbae17606dae9780d8b216cc74513dc2a691a47753437cff362d25d5b71203ea1bc2845a90715c87b04eeba4684e130357b8c77f7f1bcbb59596af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d9bc9c58a3aeafe7626816c958440fb

SHA1
b2decc289cad9554a03c3b8ae69e0eec920b4d38

SHA256
e64ffbc274d5401bb042be843cede23dafcc2a17aebafb031f3a20896a01cb42

SHA512
4dec38bf412e0ac3a36d206c79763c906ab219cfd03da3e6b746033f9801faaee6c9452e697a84f93c1967fc9d5ead03f3bca0d296be6968b176a2eb57f9aa60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1af1bb441275bbe81c9a42f90bb61afd

SHA1
1793dc05daf3c95a42010449bb09ebd4582adf10

SHA256
6bdd88f6872755f245a1ffac9a91b546ab6bcd14fbd4ea1f8d7ebdc505988155

SHA512
da4a9d155820e0562c71213323332fef4c0ff3fa5ec940c5680c190bb177e2aaf1877081c8a75a9acf04bec93d6f60d796dc736f8b27da70e0c06357f608a33c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c677f1b8c79032e48f079337337255a6

SHA1
a347ed362e40eb0e12e8cca917914013d416b7a6

SHA256
5d396c829a882684b3283f968b157b43fdf54f892d260b32c2fc73a358f105a3

SHA512
25314d6b62eb348e76d53572878c639cbe503488439bee41f13c5c7d98de162a0be035db05469ab69a42da29c50bffcef4ee91fe4f89addf7f69feead8966300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7138436a9e9d2e3a8d1f3dbcb7baee00

SHA1
3008092e5fb06caca14c49efe6411f8aec4e0e50

SHA256
2a5c20f7655f5109b6d70fca54c004bc89c1952a7054ec82b19083a473cde488

SHA512
35eb79e3a08e03a717024e8434e41ecaaa5b7e2e1d754a033b2d1c3305236027cdaf7de548c8c80eaf18256e37404a12fc3bd873781085c462b4e0c232706de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
df9dc8dc2e7696f904b94eebd3a8eb04

SHA1
79e26784d77f20bc807e55d88f3f650066a5f9f0

SHA256
416a5b2ab149d384b5147a608a4ae24f5a37cc01a479e96292bb83475c886a9a

SHA512
dddf3d98aab863d2adc8a5852c70145612e205e0394bb5a4814d5b96ad2963b74f71ebd29910cc164cbb6306445a51abe82672f5d91aa7048cb82e0506982ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1338.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit