dc5305ca716260e52eadd0ca9fc174829777436acdfbda152c9e64bdb142c604

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1461b4d4e17c4cc9c7bdd4c88efdcc7e.html
Size

6KB
MD5

1461b4d4e17c4cc9c7bdd4c88efdcc7e
SHA1

1109cfc35a84ca8074f5c8a4e5fa08ece3ab208c
SHA256

dc5305ca716260e52eadd0ca9fc174829777436acdfbda152c9e64bdb142c604
SHA512

e7dd9885d79de9b22ff2a89eab72ef707b7ee7ca59612214a6809e0da7316610754331db643d528c252550719cf406a8e86702b4d9a58e07bb0330bd29c074f6
SSDEEP

96:IH+cr1olpobSLgjOdx8XkbMsK9bq1l9AIKOZsPPsl9AIKOZsyMG:IH7rxS8SdskbF1l9VxZOPsl9VxZsG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409699505"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303a389e7437da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B18718E1-A367-11EE-9BD1-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000008d5b33750a7279ce8b2b946870f588bb413a17f704d0bb8b8964cf2c78d7cd27000000000e80000000020000200000008dcca7738d2c18e46323c86baf5eea9e2bceb689f952bf89ab3397fa26a6786820000000be695e7dab2f0464a0793968ef038db4fd49e0b03cf9715991ff9a5590e02c9b40000000682f4ff026e3bded38908c25b2a5fcbf79ea3a0d386e11717dc866d72533b8f5517128dd35d45dcadd579e103494c2bc0571d50491d30068dff35e256e6c126a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000079b5e5dfb16673d8ec14e8dd9394f7f07b7cdca7711bcf094df7473dda2f4e4f000000000e8000000002000020000000d610f1a1c3e39aeff4fd0e8b2935b57d2f9fcd45720617067d1a01afbe0b1c6a90000000b6189b492681f10bfd206f134953769d0f581a1513a5e74e4142412179ab55758c1c1254bae12f5e69f78e2a4a9d7f34a40531d702d43e29b56a9c473da2ad5b6a2f1126dadbd09db018e5c309eb85e862053407618bfb45f5abe111be803a4af8a24735798200a72af3911717a0e9fcf5994f66e51bf289e6dbb712f1d7b57802521c027078bdde9b1a573f50fcc225400000008213d4bd276c5108ef6ce1ad92e93e38f4a9c4fd9eca918924fdb7c5630148678109a1077188f39296dab657527bd2d49dddd6244cf55ca51eda81abdad518ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
532	iexplore.exe
532	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2700	532	iexplore.exe	28
PID 532 wrote to memory of 2700	532	iexplore.exe	28
PID 532 wrote to memory of 2700	532	iexplore.exe	28
PID 532 wrote to memory of 2700	532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1461b4d4e17c4cc9c7bdd4c88efdcc7e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b33f15f14f3db1d0a2d4611f0be6143b

SHA1
6363856b5e11263196cb78c5a62417742b19fcfb

SHA256
41726799bcc9536898fa03644c1bebf8cfb9f2c20a04e701939e704339ef743d

SHA512
e3e20b739c5bb95eb9da6c272251b251eba72d3e44e3a324782e9c7574251c71ee0a75fdc22dde78fc0a4b1fa00083eb17e7c3fc1d2e570652eb20b3907bc158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea6db2abc881f88e2b24eddae8ca4101

SHA1
7056e4c5c921c5c3d558e992dce1ca2cb6376785

SHA256
7cc17399ca74449c8cb86cf16199293a853a63c7310436dd28375296298eaca6

SHA512
494ff416e2a16419720d0537616592c1bc357022f8a17a1b984126e62029f45547ffecbf3b8efccc57ac9f136bbfadee4a99edb7465a18fc40e4930da5c9b7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d78dda568b13ad66ddf1480905d13b1a

SHA1
92ef83e2416e9340fca356caea755a2aa38648eb

SHA256
0a8afb263a48c42cf4fa71342d66f499ab2d6e1329f10f8848b39efef2f75d04

SHA512
4088d40a65fc1f28fafcc25af9b095a540d2257e6bb90d7e8e50074203f520572371fe04a5f012ab664e23130ec6b4410d8027d3981b93100d0bfef4ea0c8f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2d78c21118c95b3c47ac8152c6e002

SHA1
06c09b504f1d8a6d7dce24a3a03eb9602e87f28f

SHA256
6bc01fb7e69101a5c65b58f5167d1d0e183bd9b366b6b77c54e2adbeca9fc0a5

SHA512
b78617e7673c81fda71a29458c4c7310da302defd70a8eb4a76d7b3b4f7840bc0933e2620dbc98f7951a57a8d10350f6002c4285808fae36a1683978b7874746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f944210a35ea82d97e83f30dc3b76bf0

SHA1
74f1e7d6341946a4b75953b67150034518e1e2f3

SHA256
3b668fe8ce86bcd65532fad09d3e4312fd3435eac4e9931d1d953d9406059116

SHA512
5f0d47da16813ed90b631ede35af67f4fd0a861fb97642461b411191d258175252d8dc1e347cfd71499a4d7c4523184c60c98bace804dc5ebea72acaeaf71962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05d827e86b276dd739d59d745ab3b8d3

SHA1
372a718e5e6f8208b85ad8894549984dbad63e35

SHA256
6662333552c20932c0447e08dc97a45d0ab6e0c8e55ce9a8144095adc9771868

SHA512
5ce01a97d7bf3ce024c953d7e83d214120998b4e3e1bea271c563289fdf45a8f581f8d2c9598ef3d1ca049dbce7b9aa5db3472274e7d20c61d79fc78cc4a0852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5e7488a662bfe91e70eb28b590d357

SHA1
4f9b0438bc2e58dbf6eabbd4b3cf59d7ca79436e

SHA256
e5b0142de83c41e3d812c7060ddd359a0e535877b156f0bf357458ede9644d3e

SHA512
45f2dfa09dafbb670548c95f8cac94a8532760063643a8751a00aa6defbe54d5ac02fa22d2fc2258a332f86f893590f6f33feb61f83a69c8a48bcf97fc3f256a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a74b7bb101e2262012cb4a043846a4bc

SHA1
11140b700ab6f87b130cd8e565404e6b282171c5

SHA256
ba96b73d4b448efb08f622a254ddc50b7c355dedfcc29d7763090018a6b253a9

SHA512
04f117ff51744f185a7779bcfd0cf9f7e52397df1cecb56555b5f994cc5cf4bfc5b7e7f2bdfa8c4a6146a93548ba336794d1424308cd5dc5686dfb88a633e85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7D4D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA807.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit