280525128aa1212a1e48f67b87992a85a345194e7abf6da4895e12c1d21407e6

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1788ac87ab5bec8fa1f7510b090bc892.html
Size

44KB
MD5

1788ac87ab5bec8fa1f7510b090bc892
SHA1

aeefb28951e6d9da44fa25ca848d9342995a80fe
SHA256

280525128aa1212a1e48f67b87992a85a345194e7abf6da4895e12c1d21407e6
SHA512

ef19318066695adbe3e7dfe2c3b57ec54f0e83310e6aa090c5d106de57fde07e60899e639ebd3fbb4885e42235a1c73e753cbde878015b9268015c4ece901e6e
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2oWgHqPelgK6nJWfpKvcABWXslP2VW3Qsz5MWgh4j3y:mZJtwgHqPelgK6nJWfpKvcABWXslP2VB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2091cfaf9d37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409717107"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000021ade468f5120e47cebe13654d74f4ac789e989b1824fe7e62402daf4078ff39000000000e800000000200002000000060d2d7683a7d838bfb2d275fa3dc8449e30cbffd513953167e44e69de1a46389200000003085970da734c54768533011e99161480a52dc2bf2b9b8d0ebf7290afaa65e614000000009562640ea0a4785eaa98c7faa9e32045baf1afd09a7e53ae5b70f4154c7752b9fc2401ea9539d3362cef9dc5309564318ac9f2bc2eb766664d17dd539abac27	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000092045d74c58f0b24b47ed45c47f6643ad19024d2cb435da10c7b5465bd9ff045000000000e8000000002000020000000035821d0ff960fdc5e4305cd2c8ab02471bc764bef3b831ec32c99f65775d86e900000004737a986ffe90ac9e4aa9ac92bab41fd913c7447ce4f635b7c0075cb8a351fdf4611ae20640d9023ee87628c43855524959c888cd14d2a629095f5d2fb732f40f6732a0159d942e3d6de94fc1a4344449d38923ad09e2715871873d2929c6a0616c96c7135e15edf6f258373a6a08a67e8038b532813d31df6c67c095d62d9fce475586d7798e4e3a9394fe82325460f400000004ac9e97eafe59075735127be749482c42d350dbb128e057b1c85c730e3d6699243835249dff87aad4155eb84df10fae9d86e7c40d7e070fbaa69b839a7c4afa5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A91F7021-A390-11EE-A5E0-76D8C56D161B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28
PID 2400 wrote to memory of 2676	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1788ac87ab5bec8fa1f7510b090bc892.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc25c2765e2ad68d776e82ca0d9ada43

SHA1
ed4e5c1eaac476ffe21ee52451eacfc5d70d62a2

SHA256
44ac31e11a67c3107c80b5000f47993f50450aaacad26d44b2da739d7b6cad5a

SHA512
a7fca9e0ddb28cb90ee88f2adcf3f4a1d79edd7f4edd46d2777599d5feaa1e37a69169eb451ddad9a8dc7c6f6025121358d235a3c3308757a8941fa1941adf55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
825b5bda530b9bf3c7853a4b6b1771fd

SHA1
c2a71ce12d8c21d537059a30b6239b61bc4b5678

SHA256
54a8cc3882f7eba7f1af4b6311d3b8035cdadb3d719f95e72891c83a1771593e

SHA512
965960c5f765cc226cc856039083e9cee1d9d9a24b0770c04f0067d91493a0365e8cc6f449f1461327aa3f11734b4d1ba5222bb0c58799520ff34ddc1d9fd9c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7df47da33d32725b643253a37a862d07

SHA1
27d5b4a1a861ba5ca36000244bab7345a8dde1a2

SHA256
de437c820be40fd9a25f484a72cf561d64e22e33e4db142d58a2cd70e959eb1f

SHA512
b77f1c89e19665ee30fde536b2c7fc6289844ac1f3b5015475cbc38b2903f7200cb8427100cacaa7bf7810f84a306d21654a9d395bebd683eb7b6791a0e3ab53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d7d0320aa64fbc1099a1ad015815a71

SHA1
57d4ca0e03e108b2b1785f5815d21674265f9bca

SHA256
f85c01bb5e68fbb46772422fe19781336ddac5a647aed16115383b4206d844eb

SHA512
1005139cb2f02774bee49adfb8bee27dc6b56a8208d8c70ff5a73798171ebaead9823f2824dc227d08add5d3b2f1e3f2886704905b43fabdc2f5eaac12fee8d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd0f70d629972ddaec5b602353171d4

SHA1
c326c83099ae5e9149445a09fcfe04335d64ae38

SHA256
96e3fa43c3a3e8341dac5922e805791208781bb60ab181a2a0c7be509e1a3f5b

SHA512
9c6732ce75a345e0946ffc7755ce11eaceb0281777fb68998747ff1a2c9574b5ff4bdb2dafdc5d2e4e78ca464a980342019b93522b43c6c0e7c6e6981b34d77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0e849c6971fe52a8366fbd4d158e9b1

SHA1
634f0dd8901e1a7d521c7d86b607f49d73a99da4

SHA256
a0eaf2e46a437ff644a3fa11b716844cd0165d078c19b0d97279a9c4cf7c22ba

SHA512
0787e6396ac7dd0e663a9b85e26ff03dc9f85bec6b94c996155f44dc75c7e1588db7ee69048aaf9022704c851c938b92b43e1e8d904a7e166ff09aadbe4aa675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a689775ef8ba7f5aaa73f63c08fd343e

SHA1
4d2118121b6b16319acba3fd0229a3714c649ed0

SHA256
b813dc78929838055f18fdf42663e2fae761f3bc6d555543996618d577cb9efc

SHA512
13662f724265d5ca74fbccdd448f8fb179de2688e5c39e3873e744802aaaa17576bc28a9fe99715e755e28ba64542be6503d63096d66ea7002d674c49dbf1bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be66077a6c6da8235260b6345f363ca

SHA1
1e5aeed447222866ed7174b756f6611d58118624

SHA256
d61d6aa519a8c767d5156ec86d10f0a774d46c4e0bc115346b1dd93667526734

SHA512
b00eb29ed0bdf25498ab88f1bb226e1ccaacab4a6f414040e9d9c3b212fa002bd43eabaee21a7bc2672c80b00cd0a7a2888132a61caf0a1d0049f632bdcc68a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2464.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2503.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit