e171921e5984bd179ba90d2566902089da9954667cff8ee1ab362b3c02929897

Analysis

max time kernel
12s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13efccab62efff919aec7db4edffc132.html
Size

17KB
MD5

13efccab62efff919aec7db4edffc132
SHA1

003a7a8dd59156de480f5638abd39a8b73d4f7f0
SHA256

e171921e5984bd179ba90d2566902089da9954667cff8ee1ab362b3c02929897
SHA512

940847d592b6b51e1a6041b92fbb9a1b315530eff8f18def00e335114cf9e4df6cab27523800d9abac7e2a5ba4aa7b133baa0603896b7ac205fa0c226c96ae05
SSDEEP

192:Ld6qYNPMMnIooSG0/idPKKrM8ak0/WzcEY38uNpx8ikiuNphVa6eyS8:LMxr+Bf7oE4ehVa668

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05DBD6C1-A362-11EE-AEE3-EED0D7A1BF98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2892	2424	iexplore.exe	18
PID 2424 wrote to memory of 2892	2424	iexplore.exe	18
PID 2424 wrote to memory of 2892	2424	iexplore.exe	18
PID 2424 wrote to memory of 2892	2424	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13efccab62efff919aec7db4edffc132.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb36df99ec3f9a41d00974cfedd95fdb

SHA1
41c7a8f32492669b5e2080a5053c7ac5c4408731

SHA256
024ac6b43c55bb37624d6f294a3f2e734d569b3626fe7d8e26bb22829bbfc8b5

SHA512
2b93d666cf69e180aa95e8e646f8e8c3621a9aafa8345a1dd7dc353d072a09be90759d45c8098b13f170b7a4775f44b9b923065d6df5448976905875b3665bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dcbfccd669c504a56567661c29b54d8

SHA1
8533396eb073614ebd06924aa9082e9b4e86c3b7

SHA256
96585c94838b61c56dc05d5d58fc7adea5b9112a5991a0eecf268ddaed523b5c

SHA512
b5f71e7ac9758dee018ade46c4f06d7ea3573ec11d0bce3c0a5abf82d34de790031f43c3a299994207091a9392552fe0ef9b60915aebd0537f57c0fe09d7709b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b45dc781df0d7317ef1c3a823319cffd

SHA1
e03bea1212cffd1e39a89de9fb07f2f657b61170

SHA256
75cd44f4cd1718eddc1599a38663585d2f20a55344961a37c29f38b9748eec38

SHA512
6026a563c0da4a3abbf1907538bb917e98daa7e8ded9fe81d0207e81d07cbeac47293cf700c5d1dcad4994437795d9e58b1359d82f733ca9b861224ad488649b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab0dd8e61671fca2bfc6304ef2659f6

SHA1
099921ee5b5dc6aaa4976f3ae12b389bc64319d1

SHA256
aaeb0f45b92d89c4d8661f19650c3d877040297e06f40d6444fdf1d02f87d185

SHA512
facbc21e16b9ab93e55df32a02554a372586ad2554cf5349b5b1865d66819c763a47a963d5717779d6f4ef0968c5fbc763b557cef8a1b9dc6b2335062981384e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83b77428c4a942a9faa62d958471a818

SHA1
a2231e487203e8b0545e27fb68c72465b4212eda

SHA256
4224751883bf749665796acfeed53ae096c0e7fce0276281bdd4e3f6f3c5d3d2

SHA512
908525b684de44675372b95af389a44476a365de8402662427ecd02fb61a5413123a4b42614afce27a12c074cc7a4b8fa5f85d8a323d5d764f48770d29613c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de526b8900b10f98ee62aeff66c3f295

SHA1
8dc88020e0a89717320dc325d172be49fddf348a

SHA256
5ff38d4fadbc7bfef4ba9e23e0f0e1b87e10690f93544bee362af17b2bbc5c50

SHA512
9472798d0f061d363de185cd08fa20d2564b0b4bd6fa66f2cd02ba512cbc0670ea7cd6b1ed5394cfbbea05376ebb724cf010aa06a12d05b3aa391a1dd20d91e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ad5f5fb3a2aad0640f7920ab4a47f0d

SHA1
713067912e74697f6e93be781c92832da4874b66

SHA256
ce8007a6cbd769ff695a99e8aab24908df248f5848d001031d855970a7a62276

SHA512
5db5cd0418771b0d24acac837c92046e6af5b4b46b5ebaf8656d1c460fecdfaf71cd972dcd1f65113a16845def32f2ce56e8a9869e0d77b49a825015b2877afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5c6ae50c6e81c7f41e2a344ec2b45e4

SHA1
180d88fdd2725dbdd91cc0fe11a2c06ed3aae003

SHA256
786414ea2764a3f3f3c7427a97300d9a76c0eff1870bb28757e0b88970901949

SHA512
56b289d95e97f2e63a511d2692b564024647a072ac38d09654f752c57a30afe45615f2730cbd76361c699e2fc9ad0d116cf3376d65a41eaf03e9407a11dc1636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1a0e2b1921d3229c19c3706e8957b0

SHA1
b6c9ffba46a8681965d50f3a8e81f5dcc9e19648

SHA256
b8cbba8f20ca0e26161e45008d67668d0412a9bd9b6aa98a474b538d357f8e6a

SHA512
c75ae178d72ab4ab1ff33c935ca8c8a144d6ca016dc5ca6b8bdbed36e53ecd79602778b3e61609db81c22c61544743d81855502af4cb0ed7f8d74271e2fb0a01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7774.tmp

Filesize
53KB

MD5
c06a6a8323566ca20e46020717f9f670

SHA1
2166303347e7213d13b6ada44c66bbc4a6d402a4

SHA256
8be06b3173980a3fa16a2e9e4c4fcb1412007d20c596da1f0b77229e115c42b3

SHA512
0a60e57c8e13e323879f9b6d5d43574cad10629d2d88d8cb1da0131431873b8129cb314747da9e66564708f18ffcdd0c67bdbcbca8fc7187e51893f57e08de0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7871.tmp

Filesize
101KB

MD5
78275cfeb6d8d3b9076a502c593dc8f7

SHA1
c80da7b0f0e251fe9a49b627e49bacf8aef6de75

SHA256
c875e7aff09db4a4f19b9cc0d581d666114930aef5a3872cb9c287ad3705e33b

SHA512
842044f3faf4341ade74535cb063d8098196cddcc53c068cbcfb40436a4269590cd56eb787e800752010c82511bf136ce7b799991dae2e01f82529c4365655a8

Download Submit