435825fb942ba4066899f4c40c55ae35b1c9c59677429b9e438d61f41dfe2ef5

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

022987fc39fdb4cbedc38e93b2e01a60.html
Size

26KB
MD5

022987fc39fdb4cbedc38e93b2e01a60
SHA1

62c2e0d01f80e5b46de3725870f6f658c851bc06
SHA256

435825fb942ba4066899f4c40c55ae35b1c9c59677429b9e438d61f41dfe2ef5
SHA512

18015186d52088b3593f0febdf930b6efe20278e0652fcb4f06867e977776686d8cfc6f45e210c2a70d7136403fb05495c9208017902e601f7b310bff307077b
SSDEEP

384:tb9UYVBztXcA8d7u8dNq4E5vhrzbfzx/r5zpjkjmxDmMU3t:h9XVBzaASo55rlrhpjot

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a9695f9836da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409604935"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a6dd251e8ffa1ca99ff02fccc23c582878bf427c8710a6e25d1036d563a46c51000000000e8000000002000020000000b16584ba245b8800918a832bceeafa7069b91f2938c98468dc6db255771459e89000000048fe6d246a25c144d747e59f1c661f91dcab3a4429d86f7954b6f9a6145694ae223ba0359a5041dd69c2cddf0573bf2f13989253f45b125e5299e17e191cc49ffb7f462c549d65ef5e3438110e658b376753fac53d8b0fbdc0f9810012c9e9450871125ff0c5ffd3288a2da6efb1ef68a0a3cb86ce82777d041dd0b508f32df693969a28d4ae5084ee44add42a38f9ff40000000823b1d501424d26a55a0e170d931c147d3a7899a5774792eba53479d2428361c8068551a89ed0ae97b12a732f69453234426df8421bbbe7a4a34b5c2d415a8aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000efedff291de218dd12c18a6cc53d41d9a51ed32f048b7046f64ca8129123998000000000e8000000002000020000000f8ac532e44ffa5b0f5f63a0d3abb2037b55d6d20970d1756009baf9fc78136d1200000001e87273889391d3f7f09108132c0359638c24be13bae5ca69451c4c853e67830400000002adeecd386227e7c5f33b25ad8d0e3858790fc33cd3a97202e932596435719fcf456982e433271b64e9f3151ea9cfb1bf5eabdbae0c18fca6a68237df3b6586b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{871A8C91-A28B-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\022987fc39fdb4cbedc38e93b2e01a60.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6058496209ca09614aa94e0c1b33052

SHA1
fadcb532483f65ef39bf6e600150d39de9cd4f8c

SHA256
3fd7ffdf98bf9e47d10cfd6c0b5f439b202d4a5d358db932b01cbf17fb13cf35

SHA512
ffab571fdcafccdcaff6eaa2ea97204e00fd257e18e95ca6e7e78a89056849ba0b3beb7317dfffe15b144da1ec5b597be220c2e9145f8b0a46098cd2ebe89fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c39d1b7c5c27e5bb37b33a314d73565

SHA1
26a6aad7433fb58ce572a1ae56c24721016c49cb

SHA256
bc8a7629d2edecc7240693e061148d8c4be5245f294eecec8afff39619f0213c

SHA512
91f98f45b122cc661ec3f01c7a6fb4a0387cf67ef70aa98707abf746d03ef455009bb4ae6cd26022279874ead9ef996260318ed8a088dfe68a72c8e48c681a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014a297ac8294140996be7ed0cea1b9f

SHA1
8e091b2f0b3b162ae31b02bfa6f2e73ef84ca06e

SHA256
44fe9f412bb115a4c1caf31096611b3b24f54ca1b20295eaa3e103a736d7481c

SHA512
16b1affce181baacd5276f115337ea274a0eda8dd54703f6afeda7fd7a8aec39850fccffabc07196c993ada95581c109ec1eb7503312ba352d96bf303df7d5a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9af2c06283c7be8843bd40c315009ac

SHA1
2049ed54df36f13c57197bfa0aaaa62835bc2c9d

SHA256
e2c88d5d033e84b1de3c0259364cb3a6c7305cb4d1194d12b5b008bb1832ff80

SHA512
e03fb3dca27f765b3fc90f2b704f796fa75187c2aafedf5ce78c866408c3b9c603c6cd10e200ded662c87131efce16714162ca9967c27314f27982063e2fe35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93df7c112f42141b2b18b3d02954bf22

SHA1
4ec429d91c09a80da9bcc5ab8b22cf07ca3ed929

SHA256
feedf7dac54a40014e2ac105730b61d1625889900db19832e8286a43bf546479

SHA512
f091a0732b30341b89cadc73239d77931008d89d4220ea32aa0a291d911f240d43e7041e358896904dcee527c3b99e4a559e11db8292e01b879f6898c64f4e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
498bca49c63fcb82f28f513d5976cb13

SHA1
336e5f89ef6429860c456dbbb33ad6a4f0e95dc3

SHA256
b17657606380fe22cb5fe729d7165949f54d219cb29ec7041d0a28fae5e42647

SHA512
cf7522630ae7a6d4a4ffab7747d815e8a8f2518688c73b002462fd99690ff1351819d61a1ecb3a115ea208bf05cc511a8aac9063da79f3d6864d655eafe4c829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5fb96f56394f64a7db09282b7092350

SHA1
68aefa88ea0d4335b91aead12168e91d8e41e834

SHA256
e0580ffed2c90e112098211a15b348e2750abbb07f55efb59f3e84a7af350b9d

SHA512
ba7d793eef95b5337697a0737b817974886d1f512e4b399d57782720c4d21eed5574a159cb788b3fae68cee07a17f551f74b357c80a2282a43a74ce5cb0777fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fdd94ddf5df8ae851811c49967b01b5

SHA1
6a1776d505b071439bfccff3f92c918f5c6881e3

SHA256
21561cb8b8b4d27aba4f6b0e10e7e54fa93f9283ea5316c603d7d61e591da0e1

SHA512
a9a4f299fbe27f88f8afaa82f6920c6c1bb139ce82a42934fe56a4e806173283fe7d63021acf083f17ec49516cad45157b7929cc36fd233e974a2b2f60cd4faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c17fc9774064df21fcc86f128498b97

SHA1
d345878148733dbd355a3e863cd9f1cb6adbefbd

SHA256
73994cefb65c38a396a21595afea55418cebdbe96d6eceec29a458f51553854f

SHA512
c0a767890f8f4ca7dfc82e7887c9fe8e566c14a14379dcf5045ae16f6d7140128556c3fc39972880827657a64953a78e8611aaefd9b07625c14db1ae19e46d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC93B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC9EA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit