e80c9fd8bf8f28dfa73e3290731e5f2e9bac5d8f9abdfb8b839d0ce05ce13a23

Analysis

max time kernel
119s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077feaff71de38d31b9c06d0c3758f30.html
Size

6KB
MD5

077feaff71de38d31b9c06d0c3758f30
SHA1

551ea2865c8dee6edccea7e381074f72814b564a
SHA256

e80c9fd8bf8f28dfa73e3290731e5f2e9bac5d8f9abdfb8b839d0ce05ce13a23
SHA512

477a2561aa82c132e7605956e542b8f51aa1702a8ca4fa3b359360804c77a57ea08fa389fe379928ee9ddf05b3ca58413f0cd0e4336215b0869ebce1e25a501a
SSDEEP

96:uzVs+ux7oXLLY1k9o84d12ef7CSTUaZcEZ7ru7f:csz7oXAYS/tb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E160F541-A2CC-11EE-A7E3-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b8cab7d936da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409633014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d94e31656ad0a85bbcbad9280656a2b54826b2dc7d245b8ceae7e0380889656a000000000e800000000200002000000041d4d5e6f8e921d336630d1721760d873b17c230cdbb2a447d43bb1c394f02d1200000001abce5d931f5901481d8a450fb2b72c1618858c070b1c0e34f1f7e384b994a834000000081321a7353f6a50406ddabd3e62a0865741b5df0905eb19630767b54813eff712b57c9ec614b24fb7e78746335897e43bc10f7338aa5e5c81334c12b5d7d318c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000000dad467c4c62db57e9debc1bbd54cbf1a07ae968778c7ac481c7d2e16ec4cfb000000000e8000000002000020000000b4bab48e953a0bd8c2c9dff1f85c5b9d1d98a5a41722c1d68467583c0f78227390000000d7bdb9b86eae07dd080619a799e08ba1902b9f094a34a5f445cdf6c79c13badbfbab030cd3e800db6c031e1d674cbfd52d14fe0fea1d8a92367d62486d9e620389eb0f22c5d85432225615213511ccd2e2ba7ceceb396c7eadbcaaa319c763e7ed995058db58c0d3354f00a8e0c4a90c999520adb43cbc01bc6064ba0a8cc41b5e2f14c578bd806d7aacee42308b589f40000000f34f1a7609558e20834b507e2faf9c461b87fd9e18009f28ba71e618487aa5064ba91267db6041089d7c5edd8cc4b310cd68cc1ce138b8a735fbf0840377adc1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2872	1628	iexplore.exe	28
PID 1628 wrote to memory of 2872	1628	iexplore.exe	28
PID 1628 wrote to memory of 2872	1628	iexplore.exe	28
PID 1628 wrote to memory of 2872	1628	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\077feaff71de38d31b9c06d0c3758f30.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8209020d870e13095634cf37ba60df65

SHA1
6e0764b7aaa98b4eedf12e60d4a034996522ab38

SHA256
8ba61f4d2b2cdc0a0d970e4ebc3f4d021f3029ef9958d8c21505a9a02a315a03

SHA512
6b7dcadb96523f66dc87f1628b8fecd8c8ceba49825ca61a2e5583322a663748d69f5708f33dd1fe9290becc215b55118fa04a604e52e43fb85aba3135717fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17f11e3472317f21209cd56a68a203b

SHA1
c4fd4badb46a0161fe54659476d30ae76f2f3a8b

SHA256
22d4431e4bb347e345877e5e38ba03d2694a0923c7a3441b216795d37b793ce8

SHA512
dffa881176f1aa6f2e3e5ed826564fe46cfd94a6090eaeb40b7ac927333d773698385cd85f4d46d99bf39044d481960b40c63f213bfbd1803ab9957e897f2a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dd9de84c221f89d0b34019e453a7a2f

SHA1
fadc32b35a9be12c23728df5711363cf88f59b3d

SHA256
5c960a5776189b6e8103af7221f0d124a5d31ca27d03eb8e33206d446df2b493

SHA512
da30887e83cfa288cd2384e5c8c141fe326adf2e3aa7f9c66a0cd11b7f557a451c1c6f36bf4a57bad3b096e18ca91fa0d8cfdf81ad78656ab3a57bb2fbb7375f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bef84ec79fa062ca53e53adc1c52183

SHA1
9eec8b61b46dd72207474a92bfcd96bca12fdb6d

SHA256
de1ed142dd0287c06ea2870da807efd921513b09f5c5da357d14a01d78594504

SHA512
51cb384b16840998832e59f30cb51dd16a95f1f63495c760d91cbd18c48e0ab1eb88e21e0d0b8445474f0210b3dbeb57d7f7de47110a968594b2d712c3cf2427

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e1efe7e303b1a0523f6dc4bb085d5ff

SHA1
70b8e82546aafe64eb8f785abbd2829ca7abad48

SHA256
8433451ebb67b297d16787bbad68036cb8a76b038719a7e51b6333bcad0c1960

SHA512
438f7e7c26d1dfee93beadd7b13bf33be915e7c94a7dfec7923b0f27e039e8ca795087bb22ba4a85eeb05124bf8d30a12f40c982c2b0e7ce122fb04ebc439a43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36080dd7f5ea1ebfea4de280fff166b6

SHA1
a44be541a59b83ae61084aa33b5dac4448a22215

SHA256
77071aa1735313ee1af02495be6f779ab099ef163fe5477f6dd322c5b83947d3

SHA512
73279f2958ae599a1af62d7522cea2e01a8e11d8e1db401119562747e6e908b03e3c2e92a161060b64763f46c69134a3a273b56329417f5024699562b7277336

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7217.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7268.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit