8c38123f82dce07b1663dd9b9b94e14089e7ccadae69629d10b6ddd27850cbed

Analysis

max time kernel
144s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8751587e74652628735ae8a4a2d4106.html
Size

46KB
MD5

f8751587e74652628735ae8a4a2d4106
SHA1

3a9e04108f2a60d02b27e3896685ee82cf5d3c79
SHA256

8c38123f82dce07b1663dd9b9b94e14089e7ccadae69629d10b6ddd27850cbed
SHA512

ecd320a9928b468c0c98ae343a30fb628811c462b17e9cf7b566b8421cedb1f6ca2a9a229ae4894d02cabccddc2eff7410461bea8166d43b7d35a49faffc065e
SSDEEP

768:53CIRIOITIwIgI1KZgNDxIwIGI5IKJ7S6IRIOITIwIgI2KZgND2IwIGI5ImJ7SUu:kIRIOITIwIgI1KZgNDxIwIGI5IKJ7S6K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d102da2935da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000007172ec6863607cb9dcdf24a0ed15ea8294ee6ed4f7573bda9a66f83eef0b2e7f000000000e80000000020000200000002fe6ad730c8faeef39a22be9708c3defc6693364656cf50813a55b583fce060190000000ba72e32cdd46fe8118c7b62c739ec3c79d3b91ced541f5d5d2bc4fb579f9238795076e42abb58ad2ccdc3a388eb3d77e6a3804c8f55b3b1160fc1b674033d0b3254ef721de706f5d4bf4609dfc9d6aef824c6033a21ff735e040b6daf3fc23e6529116b665bf8d72b20fc36180988ccd5ad970089ded3272ca8d5b584c744cae9ac6a830e92b15098dabce7d1a5ebd004000000049f10123f9a35139b087af62a6a59501d37e96e1da4b6f66091b5f25656ce30115b35555649b13bb1b951cdfff9d4a8cb06cb20be3f653dc13b7b73ac08ce6eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ba65968bf427b844e046dcf1b15db475c99600415ee60a0c562cd417388d34fa000000000e8000000002000020000000b8850da922372614eb921afb2dba9c3f3a0be8c0ace471fd614f866e77cb23eb20000000f1fa6b752ced84e550211782be9a7960600ef22445811da171e585a663fa9ce340000000ab9fc6c2f2a5acf2de0bdbb10f8206a4b8d839b849ca9a93d170e81e8c40dc7bb1ba89432262b9b6faec901fac32532e98bbacc895529ec955bd637955c91f0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0448BF41-A11D-11EE-9BAD-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409447529"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1060	iexplore.exe
1060	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2912	1060	iexplore.exe	28
PID 1060 wrote to memory of 2912	1060	iexplore.exe	28
PID 1060 wrote to memory of 2912	1060	iexplore.exe	28
PID 1060 wrote to memory of 2912	1060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f8751587e74652628735ae8a4a2d4106.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c18f9ff0606132918c32dc5809cea30d

SHA1
48136cb55606be35475a64a497606d2f523e55a2

SHA256
a1f8f3af0fc55467a1ca6a0f546397c7a9a8d889b1a2e08378dde197b62a0fdf

SHA512
c7b2bf43d78bf71967fc6c0a70a676234c5ff64dea54aefb94890b0b67a27a994230db0d9bed492fc8163b270c85e0b56019bac9609b1c99c2dda6f170f5adc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c56a4f34afcfebb5430cfa2d52a33cb

SHA1
bf67182385466263cf9b7e15c201b56f2d593b7c

SHA256
f4440898823a40c31dd280dde224c6a74b295f49b3286d5d853ec1af9fc55a49

SHA512
5dbed0f81edefba1d642fea925215be1f8e493e258bd2c4ea26a97e3ded3cc7e05154c6d35d97d3e8a8e69fb2214076d9c77fa296e82835ece9a518026d43eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
996b830b0d7fda096d7a2742b33eefbd

SHA1
8541ffa1378f13ad02887f45e32870b5667cef5c

SHA256
19c3f0b7ee045fb66f45828b5b54201472e688d85d9cf1032f87f258d0198613

SHA512
99b155557696deea07759418477da14795caf24602275590463a8949a0b0f1a56777a7a4ba2c6dcbe1e34b38288c82fcc6ced595d75d19fc6dfd9bbf3e7b5111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26a981990aeef4a79a879fea91c7d2eb

SHA1
9455e49f9416e27397631633edf5ca42f5e2b0bb

SHA256
5038722d00e9460c96a2fd25a21b08cf0f254f754f781c9f78ddb84de539d926

SHA512
7f344911c851a6f6efe12281fa5df54fd5e1a1c6d9711f7cdda74fcfb3e562c5ac31119868ecf926567acfbac8f13d2f6b8c6424692190973074d3518af82cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e5ccbff40bce9ae743e6042664c207d

SHA1
fad183752320e509312234497999caa3ab2e424e

SHA256
ebe0813ade44fdc78c6af4cfc9832873bfa8d568061558a88e019f1929fcd244

SHA512
17d5276cfb8adb396cf0f80f31a73dbfbd9231b13c2c872f4dcea205e41595942895e68d0f711387cdc6c8bbe2192b1ff016d78521372688f495df458f8f1203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f4a098854f8959dda23ef89d3d09a3b

SHA1
76f0d39a52b2b8cfb9a55211dcb954373123886c

SHA256
8b76d6a96a7f5268a3bc373028504c6cc1af974c5cd913d29a8efa4ec2aa09dc

SHA512
ac204e5289b265f433222d21dd9c9708fc30a2de75e4e01d46448b6fc38cbfbf2cb77f56ec419bc8ed97caf550b3c11dca0d622c6c0db3861a683b63ea60d0a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7196f07672ba3648ad3ce9ee2ca89690

SHA1
d8a07dae33e7ba1cd7f4fd87242beb6982171670

SHA256
aea0fdb810bf83ea527d14d635d041b280dcb8daa5d1a592a78f41aeda2619c3

SHA512
671193147d33597aebd6f8941e41f91683a42d706673a1c71ec1c1190037b6171b507d3f067173428fcfe3f0020f3e2de386ee018ef9d8c03ed1c57538f232cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CCC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E74.tmp

Filesize
163KB

MD5
9c315d2f6492e792689adf658ef2484d

SHA1
22c9f87e3bd54dc3d7bddd330ebfd66684b9b067

SHA256
c79bcfb8f609680221d1c5ee810d2e999516388d6dd8b8753796534308828d70

SHA512
d99149c6e83805585acd69acf12a196a3dc4ea0ddf9e23454d0a3f7cde3f20c7fd40d9340f16831eb9fd15580f1a38e5862653228afec70cc2f9e72d45ae5902

Download Submit