e559b2683128e281b0ceffe11a0652d4d178236fc9a0147817640f7d2da71da4

Analysis

max time kernel
14s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a50f64aebf4b27769e99878012aa1b4.html
Size

6KB
MD5

1a50f64aebf4b27769e99878012aa1b4
SHA1

7a3fc1b2db99af5c0c3fa608418c31c0e31f1ed5
SHA256

e559b2683128e281b0ceffe11a0652d4d178236fc9a0147817640f7d2da71da4
SHA512

a688c5634930c382dea9fbb14a3fa2da5fac742904bdca98feb538128efa9d12413685d34e08f6af4fc90d01bd82d34cd166e119718dfbd3e9edd60e8be05f92
SSDEEP

96:uzVs+ux7dNLLY1k9o84d12ef7CSTUTH/6/NcEZ7ru7f:csz7dNAYS/E4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{101C2031-A2F5-11EE-A038-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2768	2752	iexplore.exe	19
PID 2752 wrote to memory of 2768	2752	iexplore.exe	19
PID 2752 wrote to memory of 2768	2752	iexplore.exe	19
PID 2752 wrote to memory of 2768	2752	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a50f64aebf4b27769e99878012aa1b4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289a28c817695fadab4ce0d27f8c691b

SHA1
affeceb496c97587809f0358d0b9e114d8037ed6

SHA256
acdfef6d816441560f3bc20e2dfc77b020ba85c583f86b046a06a923caf32a1b

SHA512
8ca553e8eed2d4f50f90f5afc36506184dfe74d5735fcebcd1c194ba8983896f62541483161af9bdb537f713215dfba17a2dbbaadf9fe50efb98d17ebce335c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24ef8cd0dd423cd69a12a235e307fd81

SHA1
07d8bab81ed6c9ba8642a3b8a22763997190b301

SHA256
7d2d77bf749334cf011f388cb3752c491aa0fbd17ced2a559c49b72c857fffe7

SHA512
3e3f5ff5307f79ac0748a00c04fb2e25bfd2d34387d0a5786f36b5f28615244321ce9fb67e40838695e625372113a47efb980e41ca4695c77bc299550627da43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c767f70ee056be86c4148de7e98c897a

SHA1
cb674b90a860abf8e0e548656fa86b0c20886286

SHA256
a745463a2e26cc2b0222d05d7f3013033c3374302bd4032e1273e4683dad34c1

SHA512
9c115faa70ac0bb600aa97ffaaba45d32f6abbedb310950dc6986549934912ade1725685a839ee3ebd8902cd31b4d625ef322ba7efe9388db2dfd7bce786d430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a24c763eaefe67ee9c2267645ca1df15

SHA1
27e6522b76585a34878122cdce39b044d93f0200

SHA256
9dfcad6328367fb1c84b7fe54cb298ebd8965da602ccb27b1fbc3bbda3848e1b

SHA512
9c95f9c9a2d415381695cd2ad7bd009d3cf67ac84c3658c65fd06f70e964fa20d94d8347f906bba3ff19b0108e91cd786e639870008b01e2fef8b5c79c1b0065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dbfaf19ded99834d42f151eb8f70cea

SHA1
c36a04f6f9c9b3965b1f243b7bc2b663f3d8db80

SHA256
ccded3a95bb7e39c23f32b006aea06acd1675042c5b33663c97f61d750754bc8

SHA512
ec8b0a45bc7a40718560fd958e3b17b24b85dd02a00017b101165c5063b10e311ea942a8b475016b44698977db46a1458baf1183bc9feaa0d626dfb80988e97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81e136bce03d7af16bc70eb0cc3ba75c

SHA1
3b1e799bfccdb74a74df5e84db3a9cf3b0c41b7f

SHA256
2a7160028d2cebb319c9e797937145efb305dde190abc6ad85d0d8cfef921d4b

SHA512
c19d63ed49dcd1d843f84d9bde2206e2e2a2e9e9e465978fea753e5750b8b163215225e3e4feffe68639747218a9db790584b5dd510a690210f6509d861210db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40902cd42d46cc1fbbfe0ce856abfab1

SHA1
dda687c25dd55084bcacd7ae6cc289ec773be503

SHA256
4453947e0a841c66e098d9c2f57147140f6fabff546dc4884b91cf04138535fb

SHA512
d4a72109698d5d50a45ea701761f8f2f311096399388ee292f348e0bbca12d0db8835bc0764567280648e3a7e28fb6c29b82455b8b7393e36a70374e3ad2d365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e569cc846923990726d7d9caba9578

SHA1
bf3daf6b746e2c8f512f24f336665a740b3c3620

SHA256
eb0b889b886442b38fb254027765dc4765b2e1a66bc7fd81ad77d91cc3479984

SHA512
87fdc582198c7350aaba8044b33b05faebcbb164d32ecacecadb03f6063a595364ed46d5adae90414ae6a55eb71598b2509e9c76a2e58862be4ac6cb820e05e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ac2b80b0f99a45085e4d41095731653

SHA1
939e68801fcc7948ec7e20aee386f54224252fdf

SHA256
6fd7f07f4286e891e52528068614d81865f9d2eb3207e3e0625f3920fc8e2c98

SHA512
88e514171b63082541f1f180f0a42fcfc057b9426ad972bead9586f171159b4c3789279ead6180f50a1d22d2d2491a4570c28441173d81c9d065e8a6d80a569b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a52f027399171a3e6c7dfa5dfdbd86e9

SHA1
014f83bfd012e3a33ddde2c45df2d10e243e5aa9

SHA256
42abd07d70e9cb6328b12c32151337ecb0d137057accd22719c3b75fc7be76c9

SHA512
c01b0ffb92a36a00107a7a965d5df141337875890e4a9867428b78cab36731d7641bc26c6090fd1557ba0ff5c3c2dc3c9f56b4e926fb85d4c9eef9d36df01a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab600E.tmp

Filesize
61KB

MD5
c4cea5fdeaaed048e387c5e5dcbc84ad

SHA1
8497216ab0f15acc5a3e68138302fccff80781ac

SHA256
55606e602d54a21936e6c2a91e91a9d2cf918bad5445e5d7c62d0f3cd4c1cb15

SHA512
de2222a4eb24c5108d4c1a2278299549b364f89423ee58ccad8c1a425a2ac1f051a3b2b96f28d0c7389062ab96e0452d42ffb4cfc548ae1fa7e1110538034010

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C60.tmp

Filesize
100KB

MD5
635f2b36fa7ed5a91535905e6eda5a10

SHA1
dad4e8d228d57e67c52cd7a3f22c8986c1c5b668

SHA256
fde8bc19ca23e2a5805e7c5f031a011434f93cbebfe952ee3ecd8cbbe7464e81

SHA512
78856e868566b9e46918617cd895129bf51e896e47895e8ad4370357c88ea4f262099aa243e3825958ba2b4122cd145d1f77b3cc35b15cde4a0c72912c16e98b

Download Submit