e5788b803fad8191a7afde3247cb182b6ef4b3a714ce85864576f0984bef549e

Analysis

max time kernel
228s
max time network
258s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15da5b654e26bad1811b671c116f35a1.html
Size

26KB
MD5

15da5b654e26bad1811b671c116f35a1
SHA1

55d9550e2bc58bebcdb8dbe632ef29ae0cabb0d6
SHA256

e5788b803fad8191a7afde3247cb182b6ef4b3a714ce85864576f0984bef549e
SHA512

df25544e248573dba14f17131f9ffe8828c1207337d08134a679c350b04c1a8ccca82a51eed6571f302215e9b3c4c8b4fd62ef39ea07eafdac4d06d21c4dd065
SSDEEP

384:ZdlIcsts4iQGTHLyxPlQetP9/FTGfbnI46m/gRTmzguLZ:1FYudg96xLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECB49261-A378-11EE-B311-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409706914"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2952	2076	iexplore.exe	28
PID 2076 wrote to memory of 2952	2076	iexplore.exe	28
PID 2076 wrote to memory of 2952	2076	iexplore.exe	28
PID 2076 wrote to memory of 2952	2076	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15da5b654e26bad1811b671c116f35a1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d823b5ceb23b38a4a3247350951ab4f

SHA1
ba0bf50daecd07afc4578e337fc5d4f3bcfe306c

SHA256
3ccc06234664825fa6b67a3a25583ec927c7a6126b69f1cfa4d422566d262cd5

SHA512
a72105a77e74c39385654881fa436a5ee47b4f52c7dd7e5d04e2a4426df5af8717e8a3cce5473d46507c759064d3c0b39dcdcffd18549ff87bccc07952e7f8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f3cf2259f2118bcad54f0138e1c5f95

SHA1
212cea4c0e58b641b596a333241cd2e26c20815b

SHA256
72c5da25093b1411b3035b3ffc3515e58e73a1c5a90fc3baee412d6b1f3a51fe

SHA512
2c9ba570651a8b6913b94160804aaacd0287f1cf3963400cfffc65faaf645f7375344d131dc03a17f75da9f5a6fabf818a980b5511b4155057f449641e8d2952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c4685fe5f11945562a2718f0821fed9

SHA1
2b029d161238900d62c0f56ea41d0253e7ce4160

SHA256
0db5fccd209719594b3d19098cd1a652ccaa6cabb46d96e62fbd10e661a060c3

SHA512
d02abd7479ea8a5e0ae4275a6b0ba683f72f56e73806fd119525e515e7672007a3b6510a5ee115d7874439ecbd22bc857ee6d41e0a1c4d68f09ed3aebc581e54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d95c4d484ca69c05a0139fc195398acd

SHA1
a23064245ab857aabc1f94b5550f7a8452d0313f

SHA256
d4883bbb288d9b2045cb9c23f50bfcd16cd18879596c1410b93cd77bf2d0e872

SHA512
8e190ace71c0aa52581e3ba241d3119b9e2527d573a04f1d5ec6829a02394cb8b2c89e25fc79052fe797aeb1beb803a6e31aa8d451662451d8f6a8e0c9949729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4d8dc4d54a83e31fce3719acacb760b

SHA1
646a68a6d2af53382b4601c0ee9396e51fbb3683

SHA256
9e42673ebad154565df855b1ddad9e25f83581149d7e0b7d1cdfe8c53879d606

SHA512
df2be5eb7ce065e11d4157eab4cb188fd8c844822019c1060aa830c6f2eeabb2ba9192b6ad54ff8d81d71cb6421af20d5c9e5fdecf27a7cfada70eb75c0e1fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfa57069021d0fd21f770362ff9a5c07

SHA1
1be35c962fc005d353dc50dd3ec011ee1a0e5158

SHA256
381339437747f4e66c777791561807212517170abfa45705175cf5863480575d

SHA512
1adfabd9e97786f6d2c3850d73c50458ba125aeff5b706b8b43b627d1aed5bcc281385c0502f04fac6c81578e6e326c82a80eb03731d7361b05da93766c75771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19278b95fc648dff94b9d455d4b6e5b8

SHA1
eef3d1e4fe2a94b93d02ab69797e6ec59ed5c38b

SHA256
2f56d336d78c63310f0a1c4c63e219633489e431024199a604dcafe5bca2b5f1

SHA512
3ddb7077856bae010005c30d81f45618fd201d21620bc091651aceeaaff0c51bd05c97394f503e2ba604bd1b66f0cb0fc3690379fababb9149bc605e3da19bd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
016360da380106b6fce93494061ae97a

SHA1
0e884299e2c56d6ee8a239848348a5b57bd3120e

SHA256
c101e41537af4404767752a55fcef12c0b3247f71c4a073fa60c9e7a4dd7f6b7

SHA512
7a9614752015cb11a8b5f6590b9355b96c19cac4e2e60bb816e65a0ab4425c669b6b4a56f0736426ca9fe17a0cb297a7e6a8531d98a975ed18c9c8e3af4ce986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1190.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1644.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit