aa10915e72cf995bcd4d3601d50c90f15b66393377042544ddfea349c6192f25

Analysis

max time kernel
122s
max time network
181s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_133_fe2b2e1beb6dcc9bafafe08e09402dba.html
Size

18KB
MD5

fe2b2e1beb6dcc9bafafe08e09402dba
SHA1

8826b3701c770ffaf1a5c57a9b238248e0682327
SHA256

1e5298bd3360af691a824f02b8cc00075d1cb5b82e5d7f182c297241286f8c57
SHA512

774c089a01a8007cdd586b9a2c7583673ae09f87ceabd7c4f14d18640bada7175bc4cd0fe436bb08514c6f76a1320f6ac016d27e7b7ebce9374d937596a164f3
SSDEEP

384:dX8Tll8o5UrPKygWrms7Os/p9xQagEO8hS:dX8Rd5NSms7O6p9xQag44

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a4555685f9d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402889752"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C97D431-6578-11EE-A52D-FAA3B8E0C052} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b000000000200000000001066000000010000200000006c437ce13daf983acab6f8d19f60452a2d3b68881b4cadedecd216de23199d69000000000e8000000002000020000000e998d834f2b4738ad4e11a0622f093370c8539a3227282589b6467d4139283692000000066fdd2aa66da880972b6e6a369fcae6b2f37433645de873d6b8a1968c5cc913f40000000d720ee900f197078f3d4ad0e96845a78b8d020f2059e9c9c20395513443f01fffdaa27ec13c98eabeb15d26f81b06caf751450fe3eb69e8724fd27141040418e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b0000000002000000000010660000000100002000000087ea326d958de83fdea90b741e22a784def564b2d2e88a3159c9de99ddca3b12000000000e8000000002000020000000e9ca61ddd62b1bda2c94d78b7eeed7e71a1d43f90ed81cebcf99b127bfb00d55900000000a651880dad1cc425ed91f138c71a780e1aa370e51e405cfc517a45ef2dc516818e74b052f686e101fd43eb971242b4a45135064de5ea664714286ff8a54ff1bd265cb4e3eff2691c1e646a140093d1952e4c3817e5e90180dcbb0d7b11389f8a113ee4bcda13530c8bbe7dbd278df6989bb8fcefb3a44441c5d8fb8a10729586772b200c9f60c0af191f8806e5f548340000000df4f08c90a9f7f17a428dd55f27df9cee28ec8a0fc0270e8bf80566c64328a2d65ab0584ea5b7cc16d75a2047cd20a213203e9d340bf9df1ad9d72b805fe2099	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1840	iexplore.exe
1840	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2660	1840	iexplore.exe	28
PID 1840 wrote to memory of 2660	1840	iexplore.exe	28
PID 1840 wrote to memory of 2660	1840	iexplore.exe	28
PID 1840 wrote to memory of 2660	1840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\_133_fe2b2e1beb6dcc9bafafe08e09402dba.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3842665c5367c162d6cb32f16dc8d6c

SHA1
52f7190bc313acb6240a7d121b7983e2ae7130dd

SHA256
d8811cc7fe848417535b8bb540d078aede10e290c651dadadd7daec5a1ab1529

SHA512
5861bf7edd26810ffe41e422fe170636c103145c1973f75ee5795e260079f0d142b3aa74465c4a25accc9385e361263e7a4756167bd1600d40675247b12591ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d8b0efbce925da6e3e91390e2ccf59c

SHA1
25e263c8b48543ccedb3935e51fb09b7678507f1

SHA256
c58ca37d00be55db6857bb9d6acfca307212e7797c9e4f21f505fc622af7a329

SHA512
a06fe8c7ea832d06088114ba6d1cb7b445c0dd45d2f3bb4f2a61d1dc0d8daacdc3fce44f8059eefc50d06eca29cb6a7461eddf4b3b85938e14540ef985d2f61e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d864b37ee22f41ff7bc4c3e169b81cc4

SHA1
135482d05a3cf588e1ca363e2874e3a0ef9eda33

SHA256
f6d1fa42f9f0a35f85ee73af8f4010445aa70d5851b569d60d635b3c00c1d3a8

SHA512
c1b23daedaa581c3b6b5810c07751a7e03ff65f2e10d523cec907aff971dbd123dfe4d7dbb5aef91c95996440ee22999806dd52f373c987df089cc5312d3c15a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287836caa4ad034d540b944f36981060

SHA1
ceb4cd43c1e814eba5df0bd42f8ba3bb2edc07eb

SHA256
650b5b3a4622d089c449dbc695daa34540be361fe6c9b4e63576a3b1abb17576

SHA512
cda2305767a3c66354514e586bfdac068f58c75995a0375bbe03ccdb6d6757bf37acd6ec7c984e9c16bf2e62cda0451bb668d87310ff7fc2ddead1c38c9fb70a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19F9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AA8.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit