f111fdf97827e8e425a8330eeeaea521b0aedee6d27cbc3f5c207e990f12ab71

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8678757123734402966f96fb8ec04af.html
Size

601B
MD5

e8678757123734402966f96fb8ec04af
SHA1

1084aa6869c889f2d27c6775b988a8f32de649b9
SHA256

f111fdf97827e8e425a8330eeeaea521b0aedee6d27cbc3f5c207e990f12ab71
SHA512

56167a75766e52fed020c746af338cbe99d422b595d5525b3be34320be5b1c73151e5bb284f3d6a123590a5bea467eccb31aa056ca7730efba977743e1ec21cd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b044a7671d35da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409442205"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A44C1BC1-A110-11EE-9610-464D43A133DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e24e402a659b967e63012102b515b344591cfb46cd46ffae456e6b2bc3cddd22000000000e80000000020000200000006f7addeedfc6ea85bfdb1de9452e67d484886cd0b6ea44c243bb57331688fd319000000037432487afbdcfa25f2e1da1f6c3249fc9c381f1d62096c66362ba52ea79ec88f313417930fd6ec074a84a0faed9c6d17763a8d2cf5bfc0532624178d7c6a0241583a1fe72b0d885a82b5fc06b8c35ea8caa98bf0aca3dc61e1d5f4b7cfb29dbfa8446743f1ad8cf2271c84ff203d79e9b63297fbe72806020a7a6ed386279869664f74e392d6769adcc49bb29f05d95400000002fbea675c4edfc6b294a635f809a47f994032826b922718d3cc30cc90476a632793dd6284d7a574f89e1dcf81a8519bf20c9ebc4ab76405463b22de6d6dc9068	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008d29d78d2785f4851096c0a9d7e2da96cb27e2007759d726538c0b72b8a2bad3000000000e80000000020000200000000d4900bf25a3b36d02682a484be2950fdca905054b76185a1cd3c04e89a034182000000052282713e9d905b7c749861b11c3a8f9da2e30c25dd158e773d7fdb3bef3e2ef40000000e2f7f8b7bfca24640805f484769cf6f9d23b33866426dab48beaadaa68a171e9dd94544dba2b303cf04c6bc10af7acbbd213cc8307bf1120686ba2cf6cd316f8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2744	1712	iexplore.exe	28
PID 1712 wrote to memory of 2744	1712	iexplore.exe	28
PID 1712 wrote to memory of 2744	1712	iexplore.exe	28
PID 1712 wrote to memory of 2744	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e8678757123734402966f96fb8ec04af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41883a14245232828d1f32518eb9dad4

SHA1
1d79002801c23c6655c7d272281e4060b16b9379

SHA256
b9425f33a33170da043c85ce6a590a258c008e90d79f467683ff22719ec79f3a

SHA512
fad51b0df078bed6bb9daae6095434c1c6c5d60aff43dfa8c279c0fd74a2d5fb9813f29dc36a802db462df4b7ea29b02bb639da791b933c668c920d89765c84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d10b3985133a9b1104bc5c73be0b70

SHA1
5b9ebd9095159aefa1e8bfbafaf68abf1876ce4c

SHA256
1dd5f1aabea77c4e125ff6177aca0b05d0887794415038a97d20a735197417e0

SHA512
2b559fe91dc8367edfe3b49a1268f70b36c5a9aea7e934121410ce2ae37626e1dc9fbfba97c59f938879f2e603111bbccc23c7690f4e4fa13f8dcd64c19797fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94660b11715848062f17bed839c37d64

SHA1
b3f25025fefc19df6de869be0726135749767ec8

SHA256
ef9cb0319e8dfb54b4449532e3c767c585c55a621417301511b6ce40ecce7614

SHA512
a5726dd5c2332864b3339a02db7894429313121fafc6e7355c9819135f42af84d9550001124c48cbfbccdda6694f814596874fa3da70267b467a8f7c883ab9ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98bc86c459d2718ac6482f0051dee4c5

SHA1
206b371a50baf545c9d8af565ea37e177340d074

SHA256
1939df84003a5fceca4d49b0253e6bcb4a10cf76ffe58c9d0060ce7d06c92351

SHA512
5875dd2779ac23ce57933f65ea0fc8577ad7b8eda2c33c3ea356465592800135bcdeef9122f43923c027ec3a749f1e6433b89a7296df3f11a414207b77303960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df974d3e3d96e5d581feaef8c4866ef1

SHA1
ac4c32302ff07a4bb64be207ad34f6ec89cc8bdf

SHA256
e11be332f7c4ef764bc247ed9f6bc25d9704dd862166e470a8851025362d0ae8

SHA512
d1c7101e611cfc0cc357d9653818852a4bf52869d314b9d1d06c27028e46b95307f93af028d7f6036d2c1bd0945e0b9041efc21c28ce9eed6c0ffd190a25715a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a1ef8fce020e594d180c3b48fb291da

SHA1
dc15192f62e9b283db2fb3a957b4f4367525575f

SHA256
2b8fa9cb9bdeb6edba61386ea88a113804f96b0b8655432e3491bbd3a8dd5f22

SHA512
9a39b26eff8ada5247e4cffcbb26ffa9a50a2ec290108e1a94c19b45dd8536b9af6b654abffbd1d0f20340e5a0e2491ebfacc25f4dc58e86ca6c6ab8db450d83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
231313e840b6663311decc3cb5d3578a

SHA1
428c0d685aa7dc5195c89905f5feec5ac054999e

SHA256
cc8fbffc464883292fc05989d53df01185e77cd8f0cc717a306f2e647ce99375

SHA512
12e61bedcdb69feefed58aa31f3c40badef70a48e2c8f3e9778facd5f4e5dffe33da9571f42dc831aca19963aed370193464f085eb08c780701292b4e136db5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b167bbfc23ced18f78a7f81fd4b150a

SHA1
a9d313f9d56d03c916768b87916a8df2d3abe535

SHA256
9fbadc32dfd5878e77606e8311a28f7bf780518461464ea417b3d5da4e9ac7ba

SHA512
6cd31e424f069d5329a4bdb9ba61b960384ffb26d81f700d581743dd7d5929cf80f9d152e7da9c35738b698022aa5e36ea547b96d56e34f3668f02ad29c78477

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C91.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit