dc904d1255c1546ab4192ba1e165c9b1aecb021c9dc0ecbf26d587c486fdc2a0

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ce04d7293400e40cada07cb4ad989b.html
Size

22KB
MD5

07ce04d7293400e40cada07cb4ad989b
SHA1

f907eb7ca54f8c6182abd7142b21f739f099c1be
SHA256

dc904d1255c1546ab4192ba1e165c9b1aecb021c9dc0ecbf26d587c486fdc2a0
SHA512

3d551a9d85a2994a955c32fc977c7c129da3b736dae5e87e6bb7f1679ee91161d08a4672168d3d5234b143913a54aac2496fc5460346790d7678205c93a9213a
SSDEEP

192:hA+D+d+Y+8+w+QNZl9MhDF+bVKZjgKZ+/UgwMjd+oRbZOSiv/DWsZEs3wbBXVODh:EMpF+bVK17gwqwoRsVLTSxVEh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c7b027dd36da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002c152af970acec23317b3e651240b6f4ee31f337e02b86d9288cc85331cb946e000000000e800000000200002000000063ed409437bde70c8524d7bdae9dfb5a8185612756019e107776f7bd508b00eb90000000a97c855884ac50bffd9245297dd84454a8dedd8d4682d1b8455188d6f091c3f6795db1a5b3c250dd914321c9a748c3c46309fe14442962298b9329a853db66ef72bc3f5b6184957dd12c66f92ac21a6df61d5a7bd40e66dfe1a9ab48e46e0944dccb72653f8b7ce0d018dd00e54283be58f84940d1a99509c29f76168fd00faeafdf0d540390f8e1d8ee3eabd92a72b9400000006b8b3a994b38e2152d98c9e1043e6cebbfb62a6edb8c6cf983b212a052c5fc6ce4477105f719a9d8ce356d3436c07e96dbc1b8cd8db37974e0df015bc35616be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409634482"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a3c6cea5a45537dce67794063f607c260962bb2938a18131360bb40aca837557000000000e800000000200002000000094d1d163db920fa52905a117011e3728b9cf9ef746fc214540254478cf8147c5200000000c34ea70da39eb3c2a400e58bf207c45d029bd7e32ac71e47d47a6893ebd389d4000000071538e7bab6dc20f8a45b527206ae2041add1009a82eea65d56264387502b9ec243933a0d5aba96c3f8c4b687677d3042d31664ebb196c17eae934190651dc90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50F8EC21-A2D0-11EE-BD99-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2452	2432	iexplore.exe	28
PID 2432 wrote to memory of 2452	2432	iexplore.exe	28
PID 2432 wrote to memory of 2452	2432	iexplore.exe	28
PID 2432 wrote to memory of 2452	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07ce04d7293400e40cada07cb4ad989b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
456b1524fe7b6fea5e6d60de7645ab53

SHA1
c76c36af44eab2007ba93c8603f333dab55a69f5

SHA256
4b5b0f8b6025d3a1916a7f71c9c745561eb561dea8c7f669c5c2712851442dee

SHA512
170b13b17640fb478b39523b686f1678ddbffda934b79ebf42ce921f74854e132d0be8146187d206dd80da0521db87ddf719d5ea127437bd31ffe22005c7a269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e711e6c006b11de425c052153d2aaca

SHA1
b742a898ee67ca9bdec69cf1c2dd0a4d6b6ebdb4

SHA256
658d9881671bfbe029b1424c8159cf2e3578a72f15329aae2be103844d411972

SHA512
986695ba17e836e61336f5c84f3ba95581c713ad4f5d129d36bff0a99b9e12828c6b258152b20e0dc83287d5d3346012866d1e97edbf1b9f4b5060fa30ddcc0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee1d9cca5905fdefdb9f22e6645d5db

SHA1
5a2e618e9fdcccd826212877f260a7e40ed3c3ff

SHA256
484ef6134b10def1228775144fdd3a98399a86c2cf45bb2474855be45a765b20

SHA512
02cadfb6ab48308368952778865610a693571e33bf5d1a963814ad5d381b373bb1ff8818a2413fa8efea7f1da36fdfe04223f96da4b242f6740570452a0c70f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a278fec263c9f954d460c4b190fc4e55

SHA1
c370b4e1d4b536658ee52a2098cd02d6e382977e

SHA256
be32a0abb57a5c0dd3fdf8c86aa349765123a7cee7dfbe908921ed4626791dc7

SHA512
bd5cc6ac65683ae9b61cecf6074da45e889c971eae5fa84cf410f86e550d3e1aceb158b886a874b0053f9160f30efc3f865f1c8a5d575a1639775f3772a89ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4899c9fd434dc87be53d467fb455213d

SHA1
3bfdfff00c0f227d5641c0a0ff47cb02d99df873

SHA256
a5f5591c395662a32244dabe5089b52bf5320cc0fb331dfc1363adc45c7d3364

SHA512
39f6eac7e504a615bf2a023ac6ba2d5b5c8d860e47eb2a3b28f3fae52036a60b052369fef82898629faf12e4d00b570351caa0bffa559788c3a589d0262fa4e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7dd2c61f21c94a4859b7b9e244a315c

SHA1
55147bf72eaa6416be5a45c50c8be914dd17583f

SHA256
76a5083523d9a1d28b61459ded852166232c61c611eade9ff197556b7996b1db

SHA512
fb50750c218bf2db03ee1933d0309a8fc40216b8e1af4f37f13d1ca43dfa3f920c8da1a2a367cf0f7ced8bd19e383bb2daa9869db45e77834765228f4535e0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ebcf006233cf90e0defa36b6357920b

SHA1
344c78de75048d046add1a8079c009a713e7fcad

SHA256
6e8a7da274c4c4216a8e01dcc76b97e98859b215d756557492b20abd278d6e8c

SHA512
d21368d886b36a7f42703874edf9fe644eab40d1c10b19c7f550830ee8c96c4b08d47cf29be233d823ae37a777bd86f8d7edbcf01b93e05141526bc4d8be9501

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f705635929bd40f44f4619c7fa559da

SHA1
e0a7767aaf330308aa1094b1a834f6697d857293

SHA256
56c1ef2dc122408a54b7914b2419d1262e4bf6180ae1f74b55c5f96bd27c5283

SHA512
6180c40463f332961ce1e28e712b8ef4c57bf9944d93aa050eba8e9692dcdaf87e99e2c03ca55b4085687bbafb1b2343c7f682014904feade59d815a587a9252

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B0C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar82BD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit