9a19277da002af0f883c51c355275537e0dcb7d17248062a860f13d5a3fd82ea

Analysis

max time kernel
0s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f944d6ac3bc16aca858d228486b094af.html
Size

2KB
MD5

f944d6ac3bc16aca858d228486b094af
SHA1

efa8d9d4a4aeb3db826d4c9f99fabf1c8d755068
SHA256

9a19277da002af0f883c51c355275537e0dcb7d17248062a860f13d5a3fd82ea
SHA512

a4ea33246bef717d2764aa33bdc288723c3ebc5b50ac7b3f0ee3f3b87198211b8c7dfe942cde13ed5d8efec32383328bf23f153ba06226f33e24fb8718c71bc5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CCE2621-A11D-11EE-A140-5ABF6C2465D5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2852	1712	iexplore.exe	17
PID 1712 wrote to memory of 2852	1712	iexplore.exe	17
PID 1712 wrote to memory of 2852	1712	iexplore.exe	17
PID 1712 wrote to memory of 2852	1712	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f944d6ac3bc16aca858d228486b094af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
11KB

MD5
5819509d28c5194f32eb8c3ce426761a

SHA1
bf8c1878e16e3959025e095d0bc06ebfbfa7623a

SHA256
c50af27e70c8ccae46966dd524ad847a197d8835d9919bc60e233ff87db1e05c

SHA512
9223e652adbb8350112e64d3e43cb5792887fb0c15824cb5527a48b43689d1baa9467b3408cb2f015e6bb26a55345a4658a0d218650c69f6b1041a53316da7cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e5dcc297329c35f0c2e47f3c5924af63

SHA1
a5375e3ea7a74e55f72e371e9d968d43b9d4c13c

SHA256
fa185ac9482175d4d9e9be8ce87a13122e3c1d4f913b245983f1e155f46d1d77

SHA512
0c7175a03688f49b91e05fac3d1baf26ee79f08a9f563a14b8345f9cda178839c4ce570207383a04f07bbddaeeb8cc47e1de4534722784ee215e8960b82fb7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ca5ceeba3e746a08b658dc4d840b8d

SHA1
53388fdfffc7718dd954f8512d9d4d6fa891e03f

SHA256
8c1811cf1cd515abb08f531a1bcad2e7ffd0adda9b1a09bc8df69303d33393e7

SHA512
7209944f66022ba1cdc770daea67808bc05e3491e19e989f254653551898a2a50f74962dbcd381198657af915eae8554f16bc3ad52e2207b4b35f8d4339c2747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a11ec5e54f1ec8fd4b7afed9ca0f5378

SHA1
0cf6f201d972d838fbab892ef50ab9991537f071

SHA256
f3d5952fa62fceb6b58ce27bd541188fb9d253809f98dd285f4211b4aff789f8

SHA512
417417ba0eac556d97fa4348981ae6d898de38f23a46029f8684bbe2385d291eca9831c671e23147d02767b239749daaca2668b829667bda5559e30fd49f8fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5270710c7c8defaea32faef631b10ed2

SHA1
70d422ab540b68ed2cc18ec9cb6fce41e86c5b5a

SHA256
b854521ac12da02179a0474219d0833d2f2c98a7fc76d539b1a04528b5e624fb

SHA512
4b3e5168ae733dc4df4aa0b3ef81ab4dc538446340117d425fe186b72b3d092b3427ce800dcc3d663234620d613e662d0fa9d57091f8c827198978e03f9c706a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27a534b2145ddcad13a5d0d1e786b653

SHA1
1edb19d11a377d9680f14cd5136f7d4e4c4c2969

SHA256
15ceabc1813da094138489e7adb61c637b216354f4eca0accc852783baac2192

SHA512
ffcdbee4e4c3983c57bc7142fc6c9389f1272108d16a3e0c075b83b0b37b7347eb2ed0c0122f7413657ccb8e51ad99383a530d44dae0564ec134fd96e271aef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf34d6ce3db0071f5ddc294df25f60bb

SHA1
59bdac0acc58ea3b1b19c533c1c4c352ca975fd2

SHA256
ad9b6a87d601ac895fbdef95c7280cd5c53309efe32286cef0186828ea2452d0

SHA512
f2acee6895b676cd1f426b87faf54f26ec4759e7a5c2f966cdea345ea970928db5f5201dcb8933ddb4dd2956bc0818381c9838226aa82de614f875d4ca9deaaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcea9a05e4ac8974b7a9dcb8ca59e302

SHA1
bfb0326239fb7de49874ceb6c43704403307c83e

SHA256
647b05d804bf50edd5b835636248df3abe9e96060f423eaf74d0a01360b0594b

SHA512
2a7bee1e8014a395b953f9f58f2a2f07be1852b898e3208a666bb7cce2c6acc085b9ef1b4eb4416f78eac88886e1116c6ac7b099e7c874cac149e14e3945a65f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ee92664401149ae5cd8ce2b042e24f

SHA1
e69cfaf68ff7a5c62c18ad6476857be1f8a6dd33

SHA256
cb9383f99ea05ee215f7431b38525a82104c2e4b613faa5b81292b2c924852f9

SHA512
7d670991b2d8c7a832c40faf2bfc3f81066dc3a6d7695fabf43375a3930bb35167cba3573e8687aee76608d676433209eea7565292a0b2da8811722c500da596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
83750c63beb5c3d8d6ffc2795f25695a

SHA1
4491f20714f2ef1994c7dd0097e027af03ad7b1b

SHA256
b74922adf0874746ccd8366a7e55033494825fe6b83034afb680073f921beffc

SHA512
06f0e69adc6dc900cb4af8d8461c6d6ad6e12018e05966e210720b2e37056f2835e4f73de1eade405e45578d20dfb7209f7666dc5b9c8f6d09255d795254c352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3662.tmp

Filesize
37KB

MD5
0384e815379f99bf5f6a6c7443c20d21

SHA1
627c15acf6f2ea57474f7acf71d3cb6c5a79224c

SHA256
87170c86f701e87037591996357a7fe46aa9495b4f0e2c2ef18c5048b0aeef10

SHA512
5fe5b13cea552a83b0ae4d9ef8d399fa3f7952fafb1bfd8db9d4c0a184d754c50f8914bb66b9d034b3fff1f7ab3b95eecea3f429516cbab0d17fee490974b70d

Download Submit