fb15a13015f0e5c4bdd7095d1359a959a7dfdd9739e96fb1b2d8c62ce296f4cf

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e91c91126093ad3f01170013b511137d.html
Size

121KB
MD5

e91c91126093ad3f01170013b511137d
SHA1

087ee9b8de481986f2f14c1450893b49eeda6458
SHA256

fb15a13015f0e5c4bdd7095d1359a959a7dfdd9739e96fb1b2d8c62ce296f4cf
SHA512

2f64c5ff1f4998b11bb05f2e85f740446e4f33a95776f338537719242971bd332be00ee3dfdb5e35efa773508c468c2cc407acaef44b19549f75d8802643a159
SSDEEP

1536:wbIRIOITIwIgIiKZgNDfIwIGI5IVJ7S/AFd4u81Jisbzve9pAuqqASp+SEFq925U:bAFdO7IxaTzlPyy0S+95RXxvfJEgFaYL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409442461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C6CCF81-A111-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2376	2204	iexplore.exe	28
PID 2204 wrote to memory of 2376	2204	iexplore.exe	28
PID 2204 wrote to memory of 2376	2204	iexplore.exe	28
PID 2204 wrote to memory of 2376	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e91c91126093ad3f01170013b511137d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e96673527b55f8aa2ceb9a90ba850ec7

SHA1
51b279c644df00808d203d61b02bb75a0db7fb28

SHA256
913f312b9387bd697c7531722b583f762136c8a772a33b1f08eeaf6b8a317517

SHA512
bfb5fa49cabb1dd2b0abf68981b751fb1b094706824eab195923941feabb9479b649b402c771ae204fe22472743b43bd167a26b006d6caa8525982146d1b6b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed3e13f23ec36449689563303a43730

SHA1
aa32c651ce6f28e3350508a296503c429f78848a

SHA256
13d433262493efc3c2dba307f0b633c7a99c01b782c8089c5d3eee6dfb741844

SHA512
2c94961f6296e3b3dea5993210cb8365a0becfb4b053cd0731afd7516ac10b434fa2e34f949eaadbf409419914e707d4ade1a831be4392f1aa8e546db1d37a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef4e6e502b2f761b015e8aa1352a62ca

SHA1
1122014906dcf723d72bc0b873810ec250a233cd

SHA256
bf99eb4c3d690cc31520bde6d4eb101154efa85fe577a1bbe6e69d14442f1bd0

SHA512
03196154ac7a1b734067ce41e1a714643349146e83a33ba3ce604a56b19a735798495f5b83b893df233dd8c8d3a20bcbace0287f294c928b1cbeea3b3ee4639a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9babe8f40dc17f362ec6b26f1e2f17b

SHA1
70268da97e2dd26877a2f8fbbddc65d123cfebff

SHA256
25d738573eabcc5f8f32290d78f1c434380955cb3c9fbf046125198acc173768

SHA512
30b48126a47ce244b875ce579ce5e5016acfe74ae6f9f1e0139672d2e7a95818f7efb60faa583823d370e926f8a132091d7f80a022567d1461f32c0485c3884f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca57297344b398cba5c9a14ebaa257a0

SHA1
711748e6e3559c10214ee3d3d2110b1ab524dedf

SHA256
d0776d53d2cd74fb4ed59210d107c5d24d03214c9ecce3ecfbae38628aa768be

SHA512
a0fbc74ecf55f87686ec91060c4c5950e4bcff45cc48e5fa8c97fe6f407cd5fffffef0b2e7db9247a4a4402b8098f4542a13f6888879bb5d6cea759126f7927e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2003e6738e55b2c05744ad4475d4fb

SHA1
fa6d29919881fc244cd86829a19d28a626036529

SHA256
98efc8afd4f64b39ab26df1577162650891701cb7c843ab43f8f4f401036f187

SHA512
49f8449a0716aac78fe0c491452c79dca649c0a63251806495b3b33f2b9142463c48b808560fe39f23f747492d8e72b5f0444b31131720c3faf413d44f277514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9bb4fe712254acf80fe82d60b476b6b

SHA1
d5b7d32dafaf32102e8579a6751d2d21f7d4a980

SHA256
a96b5813f909b8cc2ab25bd500f5067e0bddaf4a46c12f82b6eaa7751bd6b641

SHA512
81761e79a230a3d48555e767be16a8417d3eed4bb9dbda89e13a2e604bb6b7564c0b24b151a586ad88a10ba0bded29aa345586c9ffd075891bfe206eb5d97067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
075893c1d2989c29479bf85b73e03f8f

SHA1
50b9018e424fd3b904e53cb45f12dd6be4328635

SHA256
3de0bdb87a44baf9771cd92b50aa5a08b8ed87f0c5005d5e15c9e2f4f5e111ef

SHA512
f206f75685b24bde9461bc9f03aa0f40cf7b6e43cb50e9c6ddbd908ad42898ab74f0baa515ed8c71ad98e18859b273cf33446549a6dc8fa0e4b0bdae304546b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88d74c8bd3462da9cef731edd14fcb18

SHA1
7b8267e8b60ecfc336815ce6f48e81b0950350bd

SHA256
3748984867552281afbe03f27ac51b330f22b314c3c9845514a8121e5e6ec368

SHA512
6787c5b2f62783ac99ad285fe4dda809f76dc649b76784b10100ed20bd55f99caa65cc221ce68a3c366df28860d9c2eff885bbf034dfbc0adcffebafb9f4eadf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\jquery.min[1].js

Filesize
84KB

MD5
05e51b1db558320f1939f9789ccf5c8f

SHA1
c72c1735b4d903d90dd51225ebefb8c74ebbc51f

SHA256
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

SHA512
ab3ad9a98fe431508461ebbf8029bc536f34d16cfef8b4c62b8a62b56fe2b30a426e3c3186c994c2578bd585da1c89a9b421c6d2f27053b2f2ed13b0dd9428c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E11.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E62.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit