ec27315b0c9394173b4b2589f96e350a96e831cc7f185fdd0387c148f0267be9

Analysis

max time kernel
143s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aea248ec55b0431b615443439ea73a84.html
Size

2KB
MD5

aea248ec55b0431b615443439ea73a84
SHA1

fcd5540bf5093554297076930fcbd0adccbb5d7f
SHA256

ec27315b0c9394173b4b2589f96e350a96e831cc7f185fdd0387c148f0267be9
SHA512

a86a806ba4d91f5cea88fa2bd3ddd23785755fa4ae1adc112840ebbb2089187ab34abf23019db43ed96069c5524cae192859f261e90e404ea13bf78c4ece9729

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000eba424b351eaef2ba2ddf990a1483113a112dc40e6f2e77930b55c95558d77c9000000000e8000000002000020000000f135e88a6194c2bbbbe572bd93d2caefd0d0ae477cd8c5538db368471b72f6d7900000001c04ddef1911445ea0b1032a59e8b8fe94c7944e5c8a1336f1f6ef47eaf6fa1798c13a8360556cbd05ae0ea81c926e57f884a18cb35ade30d48bc539692cf2e2d20c7819a58c9b8e8ec92dd24a38e719cb7320785df532eb8543b0e82ee8275cd1ae932c2ac44d431a78cd80bd88a42cca55f354196bd8000e83024572b326354a5f1eefeb26ca11139251291d5743604000000044505fc7c8bd5471af6f8a2e6766e256a260017cbb69a8c36c7a7d62c5ba2d0482fca93e6199d6bc0932ac8bca67a0f80f35e850a79e14ffdd0387d17970771a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A10E8951-A1D0-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409524668"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b74b127bd60c325944184878949f7fba83cd3d9188fa564b468948ac43800ef0000000000e80000000020000200000009d12ba98aa0c068144ee71223acce77874da70ec9cdc002133e7f1f87b38aab92000000064cba00b994c4feac64994beddd4618e2bb11e660aeedad6d64140ef1b74205040000000ba3a912ace3a45bc29e322bb0a3136b00f77a90715e8e7a40c7e6103417274af506d48c57365160115565c98259e6cb1b6fdd680780496159e169a7c653b0d84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d40776dd35da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2476	2652	iexplore.exe	28
PID 2652 wrote to memory of 2476	2652	iexplore.exe	28
PID 2652 wrote to memory of 2476	2652	iexplore.exe	28
PID 2652 wrote to memory of 2476	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aea248ec55b0431b615443439ea73a84.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35eef9d04c749b6cb420bf4965cc975b

SHA1
6b92e655e17da99eebf143fd120aa047c77d47dc

SHA256
2af5b22a55811a4d2d156da2bc0e73cc8dac15f6d4434eeed8093bd1f22c131c

SHA512
e9be0ab4ebc46ad76e4a02bf78fe427e2176704a849dcbe25bfc3119a48f6b086bfa73876d7a4c57622feea6d190b1fa939f6d5b8b743c94f8156f8ed9561922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039b46c5b9aef448828883f7cc2969e7

SHA1
8a86597488c3d6842794a2df6c6279f3a1dbd69a

SHA256
9813e43e93deb7c7ca031bce29e9cde22cdf050be79a1447d03807c0a35215d7

SHA512
1591d94494faee5608747aeae5d9a4a9622fce0d8c19a239294915eb4adef54599eb56f0430f9e0ba7055202ab5332d2d487136e56b139bb95aa922fa722c2a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86a8c6140d516834fda708ea529db6da

SHA1
c9668e6d896ebafebc640a441cb920e4106e2993

SHA256
49ae5564aa8797bdd8f2093664bbe2d6cecef49245679ab5172686509b61486c

SHA512
d8a17cef2d765298b6fd2a16ef0cac3abc35f145c64c6ec8bc7fc5fa8d54b6983db3463c49f2e409bf7a841b480e7389e9c1521790940ec9d69d58b2ba63a565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1744fc0c254b9774eda70f63ac9e17cb

SHA1
2ffb9f592baf4bdec582ddb9e764757859fcd78a

SHA256
67300e9a45258705997604d34ee52b6b6d2312af64766bf5bd7220a805db2bf9

SHA512
8d6aa20538958e8ebbaf97b286ab3af03629c46f1c82f672c3f5ec0056732ec79e23b84c3085f025144b21974e2279ce9cca3a588ba5ed27703bd63ca15f12f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eda503a2f111b67292a959c7fb80ea59

SHA1
d3b72664aa529f915c786f1859afdf7222644132

SHA256
c2b644a88ecfbf0967bd9f77f9d1ee0ac7b6e181d7f20f591582ced9334559b9

SHA512
1ba0e79d3c41a03bed3e567454d500d32c107e71c6cfd3785cbdc2d5a7bb74a05f54cd72d7cfa57f7d42326f0a6fdec4bca2439729c6f2bdd8fca81b7fd2457e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d1f5b2b649fe11d75238fdfd0900b40

SHA1
3c997fc1e138739032e765cabe722ec099caf89f

SHA256
8a3c100e9773425fc7a71ce1c6e3c0ae17d3d0103cf17bec87dcdbcd3d9b4679

SHA512
8e6f994473fe134dd6cf8a832d1b9609aaea04ef4d2987305881c4fa1261f5af185b7a32d54e14e961e06bfb39dad07786625758eebf967ccf47d0e5e8820406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1711de75004072c9f2d66acfdc3b421

SHA1
35d7679f406494bc7ca860e6ec4ea4203ae668c4

SHA256
827b6bf19869b579fe6c9346396dae555f1e28d664701ceb5d3d267778c2b290

SHA512
fb50f237d5826639c664be7a566de3f33f33633bf4004f0f4f5288e50702f7b3e54a970a3a3ab64bb9a899b21fa71c150f8763678ba11270eb604bcc446d8bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dc631bc26a2504af3606dfec21edb4c

SHA1
06218835101b678738836a81c98a9b0597d9b380

SHA256
9962cc8b5fc59a80a2ce79b1f832dbea4625d4031edb240aa08c09878384a7b7

SHA512
a913763d9b5868998f93c057b76be48211b3f57bf952a3d3b7b1ca42e3910c22fb9ac1a3c27a4d23b5e6f8bb2088051901cf98a86cf28cb1c18a38559316cce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81f55a75ae86748d4eac68949f3d7db4

SHA1
5057c2fb20a4e12fb7806c3c6838e3e0f915b4eb

SHA256
59a057deedcd6db5e96e3680bbfd6dd4585af4a592af637748641fb4e2152167

SHA512
ee6050b591bc5cfa3fe87ebf0a9c6b4bb4f06efdfde28529e28164b2729d309be48a8e2ff6cee8e702389d09f7b8fbdd3efdb64125d8dc9749a183156379637c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8e951264cc5b31022d5a00f5d78f18

SHA1
f8703814afe4706400a3c8d8519c678d87dadbd0

SHA256
ce63de323ce5cfea20192ed383b8c78117a0af758669be52240e8267350a4941

SHA512
60386c8e4116ba7471e8a22c7222b702e4b4f0a20997f6cfd5562df57d51a42b2cd8993ca871808417833dab822caa1e5c866d8f30c5e03326cea5570940ee81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6F97.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7094.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit