ecff6ba1540c2303ff2096f56bb870a607102e363cb272989e1605947dba7597

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17ef087d406b320d13268fb3fe54e61f.html
Size

32KB
MD5

17ef087d406b320d13268fb3fe54e61f
SHA1

d8015fb0a7f8652a8524f2ff4d53521b65e6d98a
SHA256

ecff6ba1540c2303ff2096f56bb870a607102e363cb272989e1605947dba7597
SHA512

5bb75e4c7f33ce2351c79b716f7495c424c42b24c6fb4e463e4df3d460cd137f6d4a05ddf7ef4a90cdb2270bedae7dc394f614ef35578e59efe9759c1b11cedd
SSDEEP

384:Z4r2HBpf9qhOwg9DLsaELLfhgLoqKLszO0hgytjcirTvMCsb6qmQAABbi11/C/aI:WCBpKAB9ibw+faa9vI9lg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409719387"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{014418F1-A396-11EE-BD99-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2160	2496	iexplore.exe	28
PID 2496 wrote to memory of 2160	2496	iexplore.exe	28
PID 2496 wrote to memory of 2160	2496	iexplore.exe	28
PID 2496 wrote to memory of 2160	2496	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17ef087d406b320d13268fb3fe54e61f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e8648644be625d6d4f864dc66f4fd56

SHA1
c755669caf757f76d0124847d94cc44b0c7f73b5

SHA256
10db7efb5ed61018137f0f39f230cdf3f209a8a10fba05535bd325ad9ab1218a

SHA512
8c0b866f63bf3440bac2bf1611b3d5aed46c3ffb36b015ac52b11515e4512b8cd43fa0c292a636dd62c797f3073fdaffcf1e64b23e98e11ad3a41aa672971bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
221c4f207da49065adc57b5e779eebfa

SHA1
2ffbbcf151b7b5672bdaf4953f7ad67cf8e36729

SHA256
c31239908608e6ae9fde64c236dae1df2daf4be567aa1258446ebf9ae76d3db0

SHA512
0287c15cf31d769647804ba41d92f2b67e3504b7bd33e12637f00b8c1fb3411b76885bddbc463748674eebd6fa0b2d282bbab52c196317437fa2c8269544a59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a25d91f7d92f1e88d5766d63173f4cd2

SHA1
a5556029e6b437b090d6617727dc3138aa874961

SHA256
de229814bc7825217945ee4f80f6add827d422b7818909c5501288592e3ebcf7

SHA512
6c7b9a8b783a5edd77a3c5e93078f62c52f0c9ae3b078968700c2b8c0da37092cc26a806836f5ea8d8ddd1ad15561a2806d4ded4d563528554f7413143de1b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23c21d88f361f7c1e972970042246c78

SHA1
641205c3850345587ba0c9720941247b6024441f

SHA256
f4bb3546d96471c14ca00a4d739ed3b70a7921b636198a1fa51c7e5de1f1c2d0

SHA512
84a8524dcd559795ddd88bab1b26d89fbdf048358b5d4299d3b606624fef3dd829f64ab3e8a87260100591d068f561de46dd7ec6959da68eee4d4f2716963658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e189dfe0da488cda5cd30c50d446a8ff

SHA1
cd3983c26827714a67df77730b6ed59e70b85d43

SHA256
8bbb97d2e6b1f7b4b5f7ab32e9e1f2b079c7287a3a9e9645e944b8a6bbd0914b

SHA512
7450c97735fe190d40ea2330a4ae1b56c81d96005c8a613f7ebb94a4710425b03474ec0f3e05c3d83492ce2d8cf602ebb2473cf98f03469ec0fb814b3a38c56e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f462d132c5d6342dc14836cee6d3b564

SHA1
63694b6abd3d0f7419f6c95e3c86c70ce9d0e9ad

SHA256
1445bea2760482089e1078f32da7b0df538e83578b2046d04019ddc16e2a3685

SHA512
bc6b477441cc4a4308c389072bb801190db2f7b649c704f1f8be7fd9a69a506b968f4f1dcd91b9872b76873b10a23ba21f3f870ec9f90aae7a71c1c5bdfbd9c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48fc0e39c0cc619bb5bcf3fef7a0d4c3

SHA1
aee23ff8ae7316c40d5d85275219c38140d78386

SHA256
31b88b9112ec6a5dcb195e47c0685a562ce12f8dfa822555cec16f0c73d0c9e1

SHA512
09d50375bf013680517617722ef79f5a49ecc71cd0aef2302c82670aa6a2adda6f26fb0ebcab1799f95776e87a6ec2e0c6e8211946b328251b84aa897626d1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
916fa5be610f8ac1597cd825b1f3bcab

SHA1
6cfe72f79114acf1628c41f02795143cef84f7e0

SHA256
e15414dcbb2f38a50c325d74f758fd18091a234c1fefdb3b3d3c636c7e8d03e9

SHA512
a69edbb39c7cb661150478c39deb6b98fc0835fc0c3d7722d88fe78e54b710235b32281b2dfc2e4747419826a4a8acf59e1303479e710759b76dd0516eb6b20a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cabc6e705ec8d6132e57c547b6e1d4f0

SHA1
f677bb0ec822ebe5fbfbec133036ce7f19927292

SHA256
4d885eb4aeac39b3fb9e1feea6ab49f288ec77b3c962259e80ee578beca2e310

SHA512
ddf49fff8ab62b8af4cea8fcaef8217a2b503aa7b448b4c2692a025354378c6589c38e7e5b3508f9a1559e51e1d3f983dad9b80aa452ae3534f6664fabda9c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CAA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D97.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit