e2028935975d4e9f89f717b7055dfb0681e72ae5b125612f7799429444ee2467

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1972d3db7bb013c021fdbc035c07ba67.html
Size

6KB
MD5

1972d3db7bb013c021fdbc035c07ba67
SHA1

78930fdafe9aac7cdc236ff7d7ba80c0855639c7
SHA256

e2028935975d4e9f89f717b7055dfb0681e72ae5b125612f7799429444ee2467
SHA512

1f399cc630e70a3cde2825827a617a49667e9442d3b42ae45cd6a8ffa9e92c6b4bb12d2e3e23a08e997b33517b6e8aefd9d48672f5480d6188cefd5162589815
SSDEEP

96:uzVs+ux7H0LLY1k9o84d12ef7CSTU6bca1sLiTcYR16cEZ7ru7f:csz7H0AYS/zpR4b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a7d212b337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B80F3D1-A3A6-11EE-B377-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409726328"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000009bea3bf3574c326a845472739d799886cabe36cb1bc00653eb457a81ecd47a59000000000e8000000002000020000000ec048e8d171801a6b9411907c3e2fabfdd415802dc6fd0d7683d0023c5bc198d90000000c03f4bb8f546eada0303db23cf2f0e0ca607edbe4c7aff2b033c8dd98f576cb0ab81ed076474274b7ba0cd445cbca8f156fcc441b527e5558de76f077a564659494c5e5922015c3e3afef2c32ad317486f7bf914d39c61f7e900acd06cbe6f077dfbf66a211eead09f023444d0c31cb6bdcb79e35c5d5b869b7db3d2e5160383a4c07140612055707a6ab455065393cb400000004044de3b3467b2e35becd37324862d07a442c69233950be1d61ba5ca9fe34d941236d4a6fe1298f2266b125e87c5e216f9cdc28596278c91e4e5c2e75d5fe954	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002de7b24c2559aeade4780767165e0f7c5a9af20f71a2146ae3bb1990017657ea000000000e8000000002000020000000818424315410a6f2395d7f9cea421cc6822d7862254f022f23c038f8fb2cba5420000000f53593e4b4fda1bc9974c23473f2c9714b201334669f44acd2bdf2bda802e37a40000000e1344933491cdcd0bc15eff3de354a6ceb3b8fc6b645c1fa147732598e4c4f4dffd92c44a6771b904267494a3ec3da8f91d5fa59a1e54613807deacde3b99e87	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1740	1696	iexplore.exe	28
PID 1696 wrote to memory of 1740	1696	iexplore.exe	28
PID 1696 wrote to memory of 1740	1696	iexplore.exe	28
PID 1696 wrote to memory of 1740	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1972d3db7bb013c021fdbc035c07ba67.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4bee6ca32a115d213a5e6ece3aaccac

SHA1
15d8f69430bf68b9086e70704e8f5d6900667dbe

SHA256
545594922d1638bcebc597f94bc1737cc66533b3127613c380e8ee41d8376ac1

SHA512
c615697e3a9ebda33b9faa9835805a2fc2d49d311981fa28e1ef4d78454723883427effcc63dd095423f45938fb7384b2e747420bd01ec4fe59bdfc3d152773f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4d305c7f52dc33c467d0359a6d7e46a

SHA1
cac76c64475ba2dab8091e28226e4b6b9a30c047

SHA256
a1d8709cb760a3cbe28ad0acc96d89387ecc65c5dec1c1e116f64278bb12c70f

SHA512
5606e628d221cc5beeb0cd69e3ba4a458ed83db099aecccf2524f803b5cf311061c5475c2ff58140ef59d5b0a2fa4ec5a1dcd99355f7ca7a974af7b8d6126f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
532b28d936d2c769637f8cb6e5ea6265

SHA1
85a9d8b5a4c607953d95a809bec1a76bc47af94e

SHA256
02145f8fbb77b137986f6e5003992a321d3aee5e187498ba45722aeb029368bd

SHA512
cf667fe5e9cd8f326fdae01ddc1d818f0299c8d5b6d58d823692bc4dee8feacb00d056cd18b9b14807c4b60ab651abcadb741da3411da01fa83296a1df45c29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4e5f1fcc6723c76e4b33089a40be882

SHA1
a0400ef8f40d7eddd8c2ca32404ff3b66898ed79

SHA256
5878a6e7184f553bf66fd9f005915d39596a2b92d9c898ec0cdfdd66b572c67a

SHA512
eb92d51f4d8c2a0272c0be89cd047445a7fbab7ec8b3fbc919899d6ab1a8204b7e14ea6335b93edc7793b14b01b38a4be25af21c759056e7ea74855742a31bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75fd78ac45bf717efbbfd5ce7d35ab8

SHA1
216992b2e4e5670f3ad0bf4d398e917f9804918a

SHA256
127c5d85be43b0df2ab9e21a9b6b32a5a109b84ae0d0ef5ebca40c262663ab16

SHA512
a44453405ca6d58e9b4a43ceecc554df627ddbba264bcbecdf090925306552cada223ae665ffad3b2b421074bd2fd8ff22252f5c0ad6289a25464142c18dba9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9af1b4932e250f5869ffd8c86534f55

SHA1
7cb385450b43f61cf05fe599ecef4188d86d24a4

SHA256
707d0d2e6e003ede6c0ef4047b4a43d9ab48030f4526818aaf759415a7e6803a

SHA512
dd78974c9f823594dd79f3f261e16e0f0134eca0bb5b53d5e2271c5d684d81cf8571c72868401c12c152b8046f5845be740b087c583c64229dbd551eb2f76443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea081410b62a82427f2d32f166b0a393

SHA1
0341ecd42d4e0baa152e9031309ac9ad2689f9d3

SHA256
b3fe6170649392ca27e73da044184b8852602563e38a8c12d8987b2865bb94d8

SHA512
4a1b02f25a96c55d3006906868e841785ffdaacc168483ad7b959ebec0d1a3bd0995b3c6a5d82ff78a920ff888cfe5ee1530dd1324687c3161e32bf9c4fa8ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f5b3fe7fac9f0e47fd1f409f169d239

SHA1
1109e85afc7fa620dd7a28f7ca2ce605ecaefa1d

SHA256
60283afbccffae347ca73fe877e19c98fc85a09cf4f5abe9e6eb9d93b0b1e7f2

SHA512
ff1106cabaa7db1a6b038f8fa7de608837f53f4799fcfce9a6b6e8a46cdba1a09f212917c23cc7eda0e9811c05c73806bfb3910494f98e7827aee8bbe04c77e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
044cfca5895d22392286f10876e0d4ed

SHA1
4ead28b10bdd94bb749a60cae843a9a6549825e5

SHA256
0da5a45842faeab3c40b3e91b068e6a6ee81dba2b9579f3475701581ee8b9248

SHA512
24249445190af061a7fe1bb468e2080f3fe3978a327e99e22cf52fbd884730a24d9640692331d4ac630376196b34ca18d18e9a3cf71a4b58da9a5bad5f900d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d44f97d7de5aeb93d6544e7e8f6d3159

SHA1
0e6b3d1300d2b036f83836ee17ad2035783a1f01

SHA256
3d044c2d349e02447773eee76c3e01fc02c2ef90d2025a88f16a70ba33738866

SHA512
ddda39fd2dcdc3c889cd2d1bf1626e2e2bb3ba65c96429424006e0c9cc3d5d999479c7d2b73b149413015cc87948018d59cf3a8c3315aca9afddfb33dd194061

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab65A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE88.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit