eefbbef27a16daeec20ca689516d85edab3b46ee024e4f2921cacc91e4950689

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13673d3f4d7658ddd875e2ca1996c9f3.html
Size

1KB
MD5

13673d3f4d7658ddd875e2ca1996c9f3
SHA1

b3e46493516b4814b791d73a798efad4ff7fdd18
SHA256

eefbbef27a16daeec20ca689516d85edab3b46ee024e4f2921cacc91e4950689
SHA512

e9dc88ee477cc225dbf23aaac85b1f024ece205d0e910a21579fac409ea132bfeb1b4918770e92ec0735cdb3fc04abde423360fdf4deaa6cc91c76dbeb0a9629

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08B3CF91-A35A-11EE-86E5-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000242e1ebf7de1afb4b02c548aea96692c28e4df2f8feea1f3cf0e7de75d11838e000000000e800000000200002000000068cc3bf5a0ce9d3245635a5305dd0c73e3bce59254bb95655729b7c23d535a7720000000cd3c60d8ae2773b871fc23f67dced4f8a7b941dc5fbf3c72df2b01bde88220334000000048e6f894c7cac99f86e4ab3f68ab48678a506a3acca7b076de56451a20722ca133451a95524dbcf591a6d1fef83e5c29525f2ab7de1982f33c6560393bbe0999	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409693631"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40646bdf6637da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009e8232e08b456c1a92ea64632841b574c3766de6b72952dcf7d0889b0f104bcb000000000e8000000002000020000000e3e35bd28b7b433a6b5eb8d09d34d54b5abcac32811e199d26e20952d1634a1c900000008ae5f105eef5c049f3cd85069016ace094e199c7507c02b734bb03ae78692de4316b5a3b4d9d7c86d92da4b804dfd8626cb631de220c866474c6a0e3b6c984afc38251d2cd5cc98081cda34fe3f87994a039e6a3e76a90ec2b58e0b280b26f282f41a56b2ee544f63512d976bca1c8b8c411efe5d4bcd2c1b859bd01104b18d5026fe52de9ef215e879484d473eaa0ab40000000fdffe5fe8ce9f22f1a3521b352e99f933d6818d4bd7ffcca51ff7c8cfee0e1df692f313b3508472d4c3c2821aff8a09755d5ee940700c975b6e80ec5a5ac4982	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 1728	2808	iexplore.exe	28
PID 2808 wrote to memory of 1728	2808	iexplore.exe	28
PID 2808 wrote to memory of 1728	2808	iexplore.exe	28
PID 2808 wrote to memory of 1728	2808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13673d3f4d7658ddd875e2ca1996c9f3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19f5b71b42c0620771b61500e759b909

SHA1
ae9b4387365f9e23147a98e0f41baea174821681

SHA256
b37d80e299e1f7d46fda2d2ff885bbcf5bda2cb5e7139fd9abaced5111844b0f

SHA512
ba5dcf0dbea450974e991a7b9bf8b3fbf7159f88fcf31ee8e4185065123667fc212eb1b1b510719dd6ed28c5dc21c42ecbd7741e8c881e1b5b0fff35730e85bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a066ab7c0fbf0ad9e9b684d185fd3c1

SHA1
99225a9474d2aac220e2cf5be3140891d99f1a53

SHA256
531aeeed8211911fa0468304dcdc6e3583cc740e316f6be6f0cfaf0164cbf274

SHA512
41a5b3115b437efb8a00c17875dd96572fc153aa5b27a0bd9c01f23f5b7eaa26e8f1fba653586d12eeb26e29f3a79d149662bd25e7c67755163d40e59c4634be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01cbfba261d73de8857ed3fe91c2ed6d

SHA1
6f13da4ffcf03cacd4e880b3929450a14a59c083

SHA256
3dc489a42ec4ecc571ae0d06afdb397db1169ccef9b93d18e9d6f2817b6ed85a

SHA512
43bcf212af03be2d3d9b142b22b08849a661358f11dc14c5a877066750cc947a10711d2132aa14aa3c151379050de84c3f550845bdbe07f5115e489f2c58590a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4265e2e1c30cf3518fd56b9d0c4e75fa

SHA1
daf54ffdefdab15b94238dfe0f3359e790d79b39

SHA256
a2a1d16a88ec2d01d630c10723119ff36078b90f5d43c12f6e68c05d5a307eaf

SHA512
7fef894e6960859acc49403d1ae3023b453649d99c5b3f0da4dde3e906bef9a13255bd09d196b0d3a9ea652310637861aa895bcb0d44195c257845f680fc8546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e3c4a82a5e03b4c14f0a5168ce3a0c

SHA1
4ef840e173fa2938a03313b5f22eee62c7a7aa61

SHA256
5cf19429bca844926848ec0228dcad727f660ac08c4895af9377b24965f9dfc1

SHA512
d19af9920c707bef0b81158f75c4c4d5c2da5b75e73a1d9ef440da47a03426fee84388ace7277e54118b6c99b10f4b653d117d5726fe95eb1b8fccce84f49bd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed065112be3bc1940d6552456f8970ba

SHA1
0a5fb3da5b035eff372e500e134a4f54bddf8b2a

SHA256
0a8f3b523840a7e3f673b032bf152256ed9abdbe37fed77a83b1f0c4532e8aa1

SHA512
78255ecaeec57f6c5fb7ede8bfa84adff920192e1d9d7026527dfab9d1938f7d9c88aff4c1315521f5a670dcc2a766a54b03be503d5a3f1770e25c2b9d9da70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9da82eb97306da3a7007612ccdfc2c57

SHA1
1edc889193126bbd4157a90f5f19f2e7b79ce6ef

SHA256
4002fad1819dfabda96026c6d05213b9840653d289776c704579dabe894fdcc1

SHA512
5c0aaa4212c4d22f94663cd6f4214f6ed333b6de3e119d5916eb4db0c27d200504ae6b2e412d1743c92e0f6dfbb90246abd4046ed5db6b6f1b511be2ffc955d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57353e7e21e92990318506d1046ff30f

SHA1
4af8c9b9a8358a39a60af702469ccd65963b2caa

SHA256
b4b2aaaac3f311630c9e1087aa3acbb421abe02f8c0526dd77973c4fd0ba0849

SHA512
2e198ac232642df9e2c4bb7cb7cb0eada9ad8a332bc3549f5f9c9a17f117acf67d92d5361532f36b373f44f00d75c11bf33f211cdd28dc444c866ff4872c98f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c12e8e22ddd6df90b67b8dc208374f9

SHA1
6e4bac5514aafa805b72064a489c6daafd7124ff

SHA256
145028d04c2092d523cfbf023e4558a83aa0acf67b22fd937cc8507ac14b0b7b

SHA512
827df37dada400544e1efd493029195ec5e663ec5bf01934db5dd7a2bee56fa3b6d68b5d7744a042fa552e321d90452b8ee8128192b73e7ab7c02e8c844c6c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921d9d49210daa805779bb7f7085cfb9

SHA1
0e7ad84404fcef09c2e113e1bc34496ad094de95

SHA256
ccb1a357761b6b3fcbaa72361e88eeb34ea6db42e3b64e372dbc11d676d9c3a7

SHA512
1e9a21aaf589f6f53e2d94e4771e455958f828b2b9d0fac7b98f32e158787a6a56904e4c8f107a660689cb654423a81b6ec48eff01e356402d2154102d4d7ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
938f527b50ccc712097cf08d494b6363

SHA1
24cb7545d3463a4fd5aab84ae27f9fdbb5a8f60f

SHA256
13bd8d221ac5e823b4c5e2c94dc56e8d967405da2895960ce280272381f4c66e

SHA512
b0ec2ee23c6828f0696f7852484b97278829b936c25c598f1e6576d2ebb1a2bd7708d881ac3ba7537cd45d1fd0121e9671e963407452bf8e0ee0c531a24029be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c747fd4e6d54f95675bb3c84408662f

SHA1
97d6adbf51988bc8198a5638ed608f693d11e817

SHA256
0c6849c72d16e7c0119f7a171442113429bc798fa692c8116ea4c694d0f5d0bd

SHA512
3a663823033314752dc3e587d1872a3ad4a0341e39cdd02d72d5c1881bdef4ef3ff4d99264c6d9c0e889909bb7f7e40392439ad17530504364a15cacba6b8f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3037.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30E6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit