e408d01b632f9c0213534f467516c20e99109c88dbe8e83f07d6ada4e023e97b

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

135a584d9b680386eafec4bdd8db2437.html
Size

53KB
MD5

135a584d9b680386eafec4bdd8db2437
SHA1

d80c6aebea011bee43d5487c172769e7b929d053
SHA256

e408d01b632f9c0213534f467516c20e99109c88dbe8e83f07d6ada4e023e97b
SHA512

c4b3a676ff6eb3510476755ed8d88d63ffed70f8ab7e3d4388184cf093356cce290ae4c04ddf27911613aee028e850600d04d379ca8e7a563130ff9664196868
SSDEEP

1536:CkgUiIakTqGivi+PyUu5runlY963Nj+q5VyvR0w2AzTICbbZoy/t9M/dNwIUTDmz:CkgUiIakTqGivi+PyUErunlY963Nj+q1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c053f9506637da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63B6B841-A359-11EE-99C0-56B3956C75C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000008fa6b8588fd12a8a463eaf3c2de29aa21120d9ded87f7e38a8d28a5db6730046000000000e8000000002000020000000561722fb6c5a5fd781fb96b5ae3555ab7c9c9aefe7ec47e29c7e643675a9857c20000000409c610ccc5ff12a9fec0e242d46b0246ffe06c38898a7cf44ed1fe349000720400000007fd72531e48687f37e8d2a8ef514aa5696f39104b4814714cc471083d03721609f6fcb930402766aab34be66861be4514726a1d49ecbfe657ccbfa381a1a5368	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409693357"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002c6026317c3f3bb4c49f8619db54b7251fbdca7fbabbdada3ccb526a7c6aebff000000000e8000000002000020000000c88a4478062b737290b842cc62d42cf8bcfc69961578cf0591423175e8a8c8509000000040de962bf8ed1ddb8a5008e0ebf3a1a7e3ef4c7a962ee33aa7fc433c8d06b067a050980b8ca00cb1b645631688202844511084da17b27548a858a76c2dfd85ed5a765b9438d8873648938b5b64f83d11731fa882f39a95141cca25183ab1c14247a326ed8effd600a685ce8b7fdc1e7b5f54af4094b2af76107641b1fdbc750a87932cf09794037c3c8d6aa24fcbf0bb40000000167468069c65cb5fd15eb59cd92c7b77417448f34fce5157f400a310d25046e2cd46cfc43bbcdf559c3cfbc02366b7e63961a3b948a1c6b70c44e5abb8221486	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2724	1888	iexplore.exe	28
PID 1888 wrote to memory of 2724	1888	iexplore.exe	28
PID 1888 wrote to memory of 2724	1888	iexplore.exe	28
PID 1888 wrote to memory of 2724	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\135a584d9b680386eafec4bdd8db2437.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a170f578b9240bf93935c63bac12b64f

SHA1
8dea6af681f3dc50b9657991d657db52bb042251

SHA256
0b1d1bbd68e99e8bd6adef21edc160b5e220cd00290f23a349b9ca95d4929518

SHA512
3343e1297b5c8d0a9be504a22adcd024a18a5379e3c1e4b9c969f85a7d42592a6fe2add0eadc06a6c48d8a8db5921114db7e308de30ea8582df56b9ff0f5069f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62e6b2da9ef8ca6a29490367d66049ca

SHA1
00f0c97675952c4970c2f9774b6f1d4e16d59874

SHA256
7108baf5a87a483ffcc5f210a39508454da1aef6a71f99aee6c1becd8b5f3212

SHA512
43528c0c0a82893402bbf66b3d8db88897fb33efad39c1b8469d7a934ce3e21d5bc0643392a34b81b3fe86efbaf2ec128077042f5a4a1f56b216afc04594f184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5318bd0c4120813ce6b488a18c62f0f4

SHA1
97c1d456bc9c3aeedae59aed3fe17e4a0383a678

SHA256
340f2ae4a15d07db445c41e26daa7aab2518f259571c5ac67643087394a469be

SHA512
cfefc138a9950d9874b37eb3e857085f9e5ce95762222d37033a557a7731e56f244bf198252bd69d464156d642a7de00ff7c3586d4ce896337e771e2adb672b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
448efdbc28d56d0a2178909e349ca494

SHA1
57afcb3883ca554b5d85fe3f434ff66c3c999d3c

SHA256
18e38e8e9174d11afd0f708f693103c450c27119803aa5b178eb8050c71181cd

SHA512
a299cf0e7fa37e35e3ce8c73124942a4a381abe953dc471fe71d099da9392573628bcde6f261d2e2ab086faababf7c72a3181d44dd9bd37786d7fe36fa508ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ba9848eb8ec45d7d4b12517951a5628

SHA1
3b16697dfb1c878cb0cc39846329741c6e360308

SHA256
79fcd19474378e3316418913704b1874865a6be70584ffbd51d5627bfecc5bbe

SHA512
54dace71e59fe8831cc616c9cbd8f52f8ee4601eec77ad540d0ea8fc1f8ffcce19f570f4c1d746aeb46edacd60c305d960ab76293e6c90e78ad1f1df5831de1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fb1fb0ebd5e9f8a1b7a4802976f4c4c

SHA1
057dffa054d7cdf1b005774a75a18a51c47cd677

SHA256
f9a30bfe9eba007577170b511b47562cba3ba3346b9de51e49df8fc9d871ba9d

SHA512
36dc0d288a5e01a6d8c1b2cc12b447168731dbd57659844af06a939d834d5fc7362c654881c3de44a0da08b99d4fa2aea60ff90ff7ce38e59c9548cf31534b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a51042122c37033cbd5233e7082a1bb0

SHA1
eda1ce8eef8c40881692e13b313e982920b22225

SHA256
bb10b6242074c21c32cec8bcd7923d1d5360211bdc21d08f49fb5d4e5be84227

SHA512
ab9905bf3aa87ec39fc5784f39d5a61df9eea669bafc4380ae6d87c2cb7d0dc688a41052fc15711b494c490a273ca470911a96e6dc76cb672e3268fa4a35bfb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d04dcb8ef5f66d8c178558a24b26e34b

SHA1
d2fa66aa3f8235b20f20f45c6b4e5db7bc84b2ea

SHA256
f47699b250d5e752e4efcf658e6c1958253637a6f5b8163ffb59af18c624301c

SHA512
a3ae92e52d7775df450158825f6f3acae9304975b20ab2ce381b3550d7af0e7d9767b3438cdae7c52abaa813fb61f40cf25230b0c1b87c29aca948e403365d59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71fb47cf70d79ad18f5cdb5b3c3f9409

SHA1
b1a5fec5398c9c5f36a674006bba4ebc34325db2

SHA256
c5c8a6d741c63d552b5cce1691ef8091cfb6cf2b0a053bf0dbb94d7ae335e2d8

SHA512
02adffc4783651d63ad41084a79c83888499a6df99a3f86f692d9beff5db7ea0bba84ef59c96e07227f57151b279a22587beeb795d13a1b28bc7a80e01bf5aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBEF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit