ecc5907279c3b500718f4cc1610399e6fc27e589b4744a93e7faf2918e37fcb1

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c397c212631ed51c928172e0db6ccac6.html
Size

14KB
MD5

c397c212631ed51c928172e0db6ccac6
SHA1

a67505b2ef6acab2a617346a412c2263c9bda3ee
SHA256

ecc5907279c3b500718f4cc1610399e6fc27e589b4744a93e7faf2918e37fcb1
SHA512

bab079145de829cb368b25b1bffa9516cd4a61ea723d62f7a0d0bc363720e04fd1a7bea9098672940badf73c868f75b1993ae2f9404c1c151403a4223161607f
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vimlKt6DvE:aioWD/ZmXg8SZQvmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000008ceb56e2d64cfc5af86cb1e97ce61ffbd576197124b37aa72427d3c70c7f6372000000000e80000000020000200000001e347f6b12f72de57121854b5992fb6841c95b197e3038ff63672f22f649067090000000eeaca2d33994e10f41116ab56b8d67fe7099bcf934d2fe203ee79406c3730608e7b3ba0c01e01dee970176ec4b16b59537490a0acccb256a84e2442f395d27d02615f4ed8dde9cf6d0efc1fa6dbd07e18f7d5ba13aa76b5ed7c458410906dae5661bfde52d92a5c54512e8c131e838a1f79e5150dec34915530975047735eee323a3c3d78d1426c49d12d157430543a7400000004f4672394d9a5e0f36b80d2d82dd370638ff626dfd0f8b5ae4d051c377a7af06ca05eab88defabf4d48a878a831490d70da807310e202d4acdc155b6c9c141bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{853F5241-A0F4-11EE-AA86-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7059a7590135da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004568c8e8468670d22305e08b5160a1552bb2f124ccd86640cbb637b97b5b5f9e000000000e8000000002000020000000a9f5a34cdc95320ddbcc18566d0b7617727d9744ea760410f184638667828fda200000005c80606f5b66dfa4f22cbe4897c085cd6f769e155572cf56e382235e5dbc982540000000f954f527458d6b6affdea0b61168a2fc3647b7b32372a7c0e8830c119b59897940094efbc09816140efd6e25234a2e83f07f52a7f0ffdfcc737aebf2cee3ae02	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409430123"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2088	1964	iexplore.exe	17
PID 1964 wrote to memory of 2088	1964	iexplore.exe	17
PID 1964 wrote to memory of 2088	1964	iexplore.exe	17
PID 1964 wrote to memory of 2088	1964	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c397c212631ed51c928172e0db6ccac6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29a8afe55fc247195ef7b16eba06575

SHA1
582a8081c47189486be634cdeb48e6096d928917

SHA256
583ee67ff7af93b3c56cbe8cf1efc1b062c7f0ae87d66365249e43c8e3ee6911

SHA512
2a23b24aa9cee48f665a53d286816e7742ec1dfac6b0aeec017ff8838be6f50e2eebc4792e5569d6cecbc7538ff2800d82127e6f4ea9ea9225b84e31812a9070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13a57001fc005dd7cd1d38409d461e62

SHA1
fc4429929164ee1af7c9bcd3e45a68692ac97147

SHA256
f88e5b3ff716a493be28ddecfc4924d48e03a5c91d39fb539135b609923a4d9d

SHA512
82639e8d01dd042620f444b78a5783746ee168165091dd5fd53f94eab56cc84d1e64cf6cb3181d0a321a94ee515c20f6f85be63ae6dee7824953f60e0480d956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
734fc282509e97d35547182bdf700da2

SHA1
9b339712d004eb9120b884e6d924489685b23bbf

SHA256
2b63122e672a7954004f3794267eb8476e0e0b7d1715d71393d9fafc8bcb021d

SHA512
5bdcff13019a98a85ec2e56625125422aca0c7bbcc411f0ca7c89d9619af7042021a20d2736dbb7338c5765689ee19a4b0639ffa239d8260fb04286fe7c8184c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6530a856af2c30dba28f951e0393394a

SHA1
7ba78846bb5ff268abb1596957e3dc7213d5b58b

SHA256
e7f4513a8a2adbcd9a8c537b98cf209974758217da3c514e3993b74886a3eba5

SHA512
130dbbd4047c8c92c8198c070c71d1b9f783b36b7621df220d8835beaf7553a3205ff170231b1039b68b23755d782ac394c4e1898ea5e3c218b34bcc03da2c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1bc076fcc975a2e86e012975a41ba5f

SHA1
0fce1caa0ecfe7087bdcf0ffd260be2821cba473

SHA256
9781b8655274466601d9b6673648e87a83da21106e129424718af1e45f503c69

SHA512
e18f6ae37905ed36fb92aa8834d0aa5f67847be6b8a2758a69f505d038e6cfd56f784380ec4a69784413b19499cd5720362d3219f3881c046832a38d992bdf21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175040b29e4ceff7b33c380c94822709

SHA1
5b9050809c0d46a08b4d412c2280bf02a5c0e11f

SHA256
086cbf085a072b720ab704c0daa4a3428fe35d2bd340c56a9ef932824a0303ed

SHA512
f30991ed09d3d2abd60bed1d3d00237ae0b7a2df1cae124576d080b408217bd681a32d5c66e0eacbf17203446e5ead129a674f48920059724c44b5ba434bd908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f371252b6b13cd2c6f48516d68efe0ca

SHA1
11c62ea9c8cab457011e64a808d2b764c6a39ef8

SHA256
4fdf9661a4562742242969d0baf020461a39a8f05267c8bcde21ccd828d87119

SHA512
62fb5406fec90772488716b78528ef10328172aa9dc2f98be0d6c2e3e4ea0e32b4c85dc824f3cfcd9041c6ee3febaecbfdc6c81356cabfd1a4dee77e46998f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f26a83693cfc503c863bb7c0c0141fc

SHA1
c9d87b5f893a128f88ce222f1a7ef8658c39eb10

SHA256
b0cf381297ae0df52ba9d64172628fa03b4417dd5f290c2eb84f21db656db299

SHA512
dfdbfd15a4ad1d5e55e19e2f34f4e1c7430e35cff3e4007c7a32cfcddd12de8d38f834f638af4480f764c5d2c6e80d7cd8a0dd4ee1a172f3c637fd0db1b80b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b2e0fa4540ed55a3fb1b3d765f015a

SHA1
570f3cba8be53f0958838e4ac54938da8df88655

SHA256
8009a2cab56c9a25c03b8db0b7abfc0b40eb03c0f4c6d9cf83d4bc9e82fe3d4f

SHA512
739d3e9780c52ea4144b9bef3aadc0facc2b15028263a054c8900ff2482402b695729d4ec3ca0c0a2d342464ed69ea0d96a083ac1ea0b65b6a5207933f1d1354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a46e94c0d555ad76526df39a7532b89

SHA1
830e806f03a9ac11b6adb137f48ea25426bb5b3d

SHA256
0a60e89a12061267b4b9ed7f0f0afff8483f6cfed8d7a41599d7bc213df23fcb

SHA512
9e76fe16f39e72530a0089737dce9a64b05e0e725479c6836ceb5c918051ce6ae5965e8ff9ec8ed5e76477281b83442a3ab96e84b0ba9a08a470d8569769992d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e0883a0dae63124bdf6af3290a132f

SHA1
3e1684b4589b9ee4ea9b7aab248f6800033fdc1f

SHA256
b40e40c12206d9cf9b90f8f236024d060fba705284a8b4a76b1220c8ef261a1d

SHA512
8c8dc4896eee71d0c490e4bb2752897bef08894c6f95cf7f27d950e57db78914eef076f94e292d0c0ed16261a97df077bb13ce865fb0c2dcd150b17c343be3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35FF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3691.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit