ec1d6360e4bf2028b0242ec616625d7ed8d5fa845f15c21d02d9f33e71bb193b

Analysis

max time kernel
142s
max time network
163s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

055d526d9a7298e5271d082801110ce0.html
Size

2KB
MD5

055d526d9a7298e5271d082801110ce0
SHA1

d8ea33265f319c01150d6e97aded7fb7f1a41315
SHA256

ec1d6360e4bf2028b0242ec616625d7ed8d5fa845f15c21d02d9f33e71bb193b
SHA512

5a8f202161c5b3403a9c394668da5ba3006c4345c5c1b7184c9cd7b236a3a69deeca1f4f15d12ce6db17040286f6a39ccd914fc8d83f093f835b6fcc37b3ec38

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{440A0F51-A288-11EE-B665-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000009fcec26bab5ec7989bae0e19df8eaa1ac9a5469632e7615967788c8c4c58668d000000000e80000000020000200000002c098040dc583587f3bcfe858841451aa264c2de9711b03f5de2d8377a5bdb3a20000000b999fbbbd2d63281df473cf25036781ce3258877ec02ef51d5bc7eb64311109a400000001a3955eb6c4d589f0739c1be7d398312645941a075bbea681372b6ccd279335e4ac1d9aadee12deb6b44ea44c2446b0286477a5e16ebe3327b67d851d40fc550	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409603537"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1023e9189536da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006765ecdca87c4c53274af06948b9261204bcf904e27d57b7433cd2ef92be3709000000000e8000000002000020000000945e78cb58609dcc166578fc180045f92b880865a20ca56aeb1e9d843b3c1d1b900000006e469dabcaee26ca44022e3a3b0915c4351054b071550e55ec57f20ee1fc96548c893977dfd832fdc7da77e94a3fde0784ffdfdc8c7357a21777b688f7a69b848d612091791881486583f6d2e5e3296436def421c4be3035f6370b473cb37f4a50c2597509064f5ec819ea2e6062d59a7e9ae0b2f9e0b0d7b1ea5d51283ef539de95e6cd9b3cb07dee9b213d232fd08f40000000f89d5201cac15ff3e0b9124c03dbd0327b3c87ffcf6f869edcf74cdceec2393eab0cd2778499c546fea7bf71fc063cc57458c480b12f07d40c6c6146fceedf36	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1664	iexplore.exe
1664	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2120	1664	iexplore.exe	28
PID 1664 wrote to memory of 2120	1664	iexplore.exe	28
PID 1664 wrote to memory of 2120	1664	iexplore.exe	28
PID 1664 wrote to memory of 2120	1664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\055d526d9a7298e5271d082801110ce0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bdb3796016b52e57ddef0f606ae6803

SHA1
5d6cbe2a797585b91f367d57e609f6058ace66ec

SHA256
133e76ee8ef0d4f822441484372b894336c3c682dadffc3639992ad589d00bfc

SHA512
0a11843923a7e53ed4798dcd265822117ba01dee4975ee30b99751018656174f78f279696f7da08b294f2682d1cd6d7da9b52698640ba6a92d787b9156996ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c11ee0054001d85f52bdbcdaef27905

SHA1
0d80ac9e32a0f1e0a036d9b2c948e302b7882656

SHA256
5f36e49bf7222821ada17f752a5549d74a37c20a1d5831486dd042f8c447e416

SHA512
a8f7523b31dbcf1adeac2f9b7b9c596332ffc6fe2d4682c64d44494768441776c7361d498dfb967e4f2d46f0496ee19b50ab6f9a6325d9057a21b0a5b2eb1444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b0712dcd9321d09679ae6c9208ac6f2

SHA1
6705e70a3ed1ffd173ccd25312f247be5757213e

SHA256
c1ff623418f6270eac5512c88d4e915af87a822662cb923c426b8bf30c455936

SHA512
c957d76eaf2b2ac4e29e0305eec774c47fc67703b10872336581252359580c9d84c562ad15fe71e761fcbe9d06f9223f4346e82560922041070146ce077b3c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49bb5f6d5c486ee71615e4950dc48ba6

SHA1
1935bc067c721881da87dc980a7b857d1cc653eb

SHA256
66e624ceaaa6c9bced50642ff8623df9acb6836d6daca25643ec1b541063de93

SHA512
502219ec644af426175e2db967000783cea5a47f10edf6691953652318be7813f29f7555afbe8774c5e5b68202b0b3b8d593adfe6c2c34eacffb2784dfbdb5d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5250667f2355eb620557c6a79079ff47

SHA1
2bcba76ecde6eec9826cbfa4e7d0ede9649b5c79

SHA256
55089b062bdeaffc9ac317b642b00aa1024bc844b7ad6144a940070c9da05676

SHA512
d64016492e00b702aadb330614dd7b9b4cac18bbec070dc0ce18b23614e47196fcd674ab13faec5213c2d3d6d8fde41860528de34d86722336b18ab85cfd588a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC5E1.tmp

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC94E.tmp

Filesize
30KB

MD5
622775d756f43008787c80f07a1b2ee9

SHA1
2245d8ffc942443d715055bc799c1879bfefd1a1

SHA256
c66fd76a5c221080a5397d05ac862e295cddda1b7565972990d0567a6dbbe60b

SHA512
86742e8d35a9689a46bfc9eafeda3ecedc1431994959ec037f1a68c452fb7f26d1a721ca45b3061f25ddb6105544f28ce5c13276a4ee6e1a4d43161bb5f6e33a

Download Submit