e1c63f8c3b95cd1a3c3a0adb5e0425bf2bf597d5fa69c2810dc9b3b8caa0cb16

Analysis

max time kernel
140s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ac9ee7c2026ff8f27272252c594b3b4.html
Size

13KB
MD5

1ac9ee7c2026ff8f27272252c594b3b4
SHA1

8e7a0c4046659526227ceb46e1d7836b8b4329b0
SHA256

e1c63f8c3b95cd1a3c3a0adb5e0425bf2bf597d5fa69c2810dc9b3b8caa0cb16
SHA512

b326e090696e0e2adbe40f16cbde5f922880558113bc44143874b09d19aa2131797f51c0fa7a5aeaabd61d294b999242a560f44db8bf4c4466ba6fdf5c2d1587
SSDEEP

192:mrKpW4UDwt0vfWUnaNS8OvwQle0OwwO7heZUq7NxIvzuTBliz8RBl5tGgBlaBlbb:moW9bO8BvwQle0OwwO47NK0ccTwhkA/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ef79a0495f10e9ef78dadc1cfc7447e4b8dae373787fe6786578ed3c63daa037000000000e80000000020000200000003c241dab637cf169d65bee2892877f89cff3322e08e9406b65d8b4fe6817fb42900000000070483c8c88ffd63c497ab9a2e46e510c55090752e3ddebda93229bd11bfb234c4d439037324af39ea360650c15accd205960f75c59d3f65f6b15fe8383bad247357a8217757bbfa8a80ac97ae132a94e358b778fdc1ce82955195d914243e88336a8780401b5828440c3508b5d6c58a7f0c8f00b47bd10e44d0e06f8d8a3defb8c7dfd763c6443774539e2f4074f50400000005f50960239bebf194d8bb52c649aac57aa93412e8bda82178bb54a217167390bba98151343c32b0656eade00603f310047629b199d43f8701758924a28493668	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309da92dc037da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409731983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{551DF461-A3B3-11EE-B0BF-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000340f30994ecca49937a2e308480bb3a8b32d5f5ec69f1c4312c843ac3243788f000000000e80000000020000200000001ba8b5c306b7dd1b66346aa015f9c602b4bd61cca644498a842d58be5b17c48e2000000073335a14b554b6c0d7eb68723bd545669580c3d446c3c595d0888713656c0c5c40000000b336096690639357d84bded9721b72b48d5d6e4befb43cb029fdab24866186d78d1f75c692a44377f6e7bf01ade631b80ec54b6059961386666cca77f96290c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2732	2908	iexplore.exe	28
PID 2908 wrote to memory of 2732	2908	iexplore.exe	28
PID 2908 wrote to memory of 2732	2908	iexplore.exe	28
PID 2908 wrote to memory of 2732	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ac9ee7c2026ff8f27272252c594b3b4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c2f1564e4fdb20727f18aa801e4403

SHA1
b9ace077a9bafb551dac7c095f54279bc994a46a

SHA256
778f5f2e2fb97b54d54abad9ca8f19935e52af84d79c296021b295b0bd66f0d0

SHA512
cec73bdd10d5c53f0d061a6a4b207db2f20bc65baca8528945527f992ee57df4e16f349dffde6be365f2b975b8aa810aee55f3cedfd9e4c086ff9d7328fb22df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df926f3f6320943376c1b91d5a66e4ba

SHA1
5fc005adc3a3ddb45f11357b61c662be0f2e6769

SHA256
3ca6c377097e0c1a5627a448e872db425e87154cbcd4731efc898ce02b5ad53d

SHA512
b68ea73f8555953d5b48c97149f49731b6f2847f7c79f83f2b3b4f5000a1bd5367ac7eee1020f7d4d1334067f643390020add4ca64538e1f83f0d95e3de8da97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfdf6df39c24ab3fed2b4886f9fd8ed3

SHA1
2f15b8634c78867544159901cddd2f75ff337324

SHA256
b3a48978885182334810cd26750270d2ccd0353bb6c07ae483665863e1e2d7f9

SHA512
27b93dc03890ae2922449075cce8e0a6d0e042b0688f49be8c043773f0177751c9ccff52a43f544053c2879cfa68e657e0ea68d5b042cc4b9b86ae8c188482cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eaba5a25c6759bc61e42bc11dbcadc4

SHA1
9e90b6daa3fca7d1b6630aa24c20c0f329fb4e35

SHA256
aafad39ffc22c4064b3f7adfc05617c8ffaadcc55a0cd5c78217cd3a24f24988

SHA512
a36e3074d192a7a87f75fd665b8fb0bbb866a1f74164d1aad8762cffbd0026f6335d46c54bb81f14f2518f8feb09291d3997b431a433741b4c279b86a987e56c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ca5e0ecc752395c208fb083cdb8c7c1

SHA1
ad458b1e9f3659ce8012f3571c47c8a95d1692d4

SHA256
8ec61dceace8b179f03382395f72aed0acce527b8689f08efe125d66b3d9a001

SHA512
6b4974fdd9aeee6fd7b7d369119ca9df6f4833c51d7d9f089fb1f6c1ee427343041246dc38e00ac4cca2c98d418dc6e4dc025848e168a9434099dae7d57c0a56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b1904a4481c1ba0ae4d4784e169bd7b

SHA1
cfb13a1716ddeed5ad9459f929c3bfd802e60c95

SHA256
0e74ac1b6a847ad3f4483dc783de304e97ece20f2cd1c2aec9f641980c0d4105

SHA512
f5d74455ff96cfb3d78bc648628dee37b6b40622897b746de5594469daf53db0123886048fce5d8da33d92c500edb57e8c5f527e5a3f6321ba08a5cdec03d9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42440fae253602dcd0650de4f253b522

SHA1
06ab7525d34051d122a54571dee3c60631d1ff04

SHA256
79c900e9efdfb1625ee155fb945c496705b1c85af97f91186b06ecbbe31cc059

SHA512
f46a1100b717c4f117e790f1587fc1e31ba5d0f0c43eb4509d6baa7e539a7be7e4984241037518868e3551dbb6cbcfdad7c5a2bc4d1af3c3aa21cd4c10717331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd89e0f3759df1ed894698c7256a02f

SHA1
09437d7e263451bbdac22b68922be2a16759bffa

SHA256
21330bbba8fca011dfd30096869f3d509b3e9334cb305b8b9a71656530d02ed2

SHA512
ac08c2fe4c35aad304d4f6c37e3f4f00095d29c4ac0cab24fca7b58d99877c927d5e877e822ee1d20028f33e01c1e30463c3cab1105ac0af083679eedffe76ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3228b69976a8b806e43ca99630e06db

SHA1
18518d40b9cbf43b218227ef330e39167a1a76ef

SHA256
4e435bdacfa3a3018a92bbeca5498c5068b8411fbcbfa4845597413c5c22cec3

SHA512
b4137a4f524a873e81aad0b0a9ea6af39abb5554c762b3f1241765a3730d7a19e1b3ff3ef170562fd6f43e6970bada304cda5b5bc677190601821772ce32a7dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80f21af2a322c55cd5122b316188690c

SHA1
4559f92652ad09fff21532837ccc4a182f08838d

SHA256
361b56ce2fc9750900d8b11f0a9a4f4967ecd5d8201b5cd30a67d47e4be63ce2

SHA512
e5306f6a48b147d36c26e3ddf14b1645596fc85cd27577a2a6cebc5e6a69b7facbd9f1943a3cd8bc725358f780a0533c986cae79524b11163b323223bc8b823e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab88F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89AF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit