e51bcd62bfe5d793c396c8b1db1dc885e1cc7407add37ff664c07d4597281c8d

Analysis

max time kernel
141s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0943543cc5f41877cd3fa53cc6d13883.html
Size

106KB
MD5

0943543cc5f41877cd3fa53cc6d13883
SHA1

c81ef09c38be1bc551dbee4494bb69492041fe72
SHA256

e51bcd62bfe5d793c396c8b1db1dc885e1cc7407add37ff664c07d4597281c8d
SHA512

dab17ef3c22e035354630f4259744c5134e1203d28d5d69f9385b610ce38c345005870fbff781ac1c88250b2275d8307e500df38f1bb8f32d386203e38dc4ad4
SSDEEP

1536:wlCYKs3aIDm00+uQ8WVd3UUaf8kcXDUafy2tGUafeOJU:wslY9Vf7DkUaf8XXDUafyQGUafeUU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8E25051-A2DD-11EE-9B8E-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409640320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2412	2236	iexplore.exe	28
PID 2236 wrote to memory of 2412	2236	iexplore.exe	28
PID 2236 wrote to memory of 2412	2236	iexplore.exe	28
PID 2236 wrote to memory of 2412	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0943543cc5f41877cd3fa53cc6d13883.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f38eb90c446edb0f5eefd4e72a874b72

SHA1
7e18273ad1a5ee3be5511ca7089351e69bf0d856

SHA256
28dfc38a8b866e4edaaf216ea783066b14470b6164a3427d0f172cd0d8043493

SHA512
2497f50fb3c98710e4be3d188543baedeeed1895cf62d1dcc9dde80f3c925048cfecaac0d34564b0397626334799f45b782aeb70b2638d87c957dfce57fb8fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9384331e657d50aeadcda8fea853b1fa

SHA1
f315569d9907ee7d563d9f9b5dc02a03affdb8dc

SHA256
4b12d05e8f02ef2dccce776db068fdbe7e53cff7354d9adbaa87ec2e7519aeb6

SHA512
ffde40c3a281348415ec8f50edc9c4fee25a810abdb4b9985a50735a887f083bc284e491573d8d9a9bf665a8ce54f387450d20029ace8da844d75bd9ecf992b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43118ed677f23c1ea8e519243db2bd98

SHA1
bf8c26c1828ec697b7bdad0ac010e26a66b25a6d

SHA256
1e40012b7dab0b200f87773940bdd2a71b7f3632dbe52900bf1c009f7bf623f1

SHA512
401f11c2d3367e2ef8efe3213bc794bbf287c9dfec601735f7afc8ba822e6957f6dc520216b4820c12f4ce4a82edadf3680f071380abae37ffa4f287a6b456cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43de208094534fbc09b83ab2ecce742f

SHA1
268348d55fd282f2cc33169c560273c53f83649e

SHA256
8f53a5ea3455358935024ec4b9abace25e7f37de1746e366c083f62bc7d1e092

SHA512
4ae03e9f309f45af00afd17253f0cb2e2c608fcc0dd0c60a32a075a4cf3eccedae5b4c7f5279d457f2c7be1ef3acf6ad6a8c38cda4bc73aebb94861c2aca427d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab2873bd882f2b1772784142b8df25e

SHA1
16c49c9987320c2ac899ecdc84f4a1dc210d911c

SHA256
aa98e0e07b86420e629e1ca0d60e53d97e0f1abe7ebf562f6fd1368b92fd84c7

SHA512
09c7f4cf43059f68f1c3e7b2f2d8ddbb877e41bd60e859536c8fa94304daca81333ff5e8dfa757a432463c657c4477a83aabded84d2c6a8328035c8d789808e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cac4a81269c6a14d449c2e558b10013

SHA1
ee1297124a0321ffd16a9363ac95f1f481564dd6

SHA256
af9c8c708d6cbb811e131fec386bf5b2710be0c1908972798b6f9d6edc9c49f4

SHA512
54c1ec108929394b85764ccb5ba2cdd30d944d06bfd98790cf28fe186d80b9451b2c9b16287b4e8500a6176a2c7bd545d6b5ab3e1723dba0f7a2e70c7f7bbd9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74384a0c70b81f69071fb86b2df83961

SHA1
8d99dff02e6effcd4e907e756508f5a595d7aea4

SHA256
6695c0a5e7f5ae3c98352be7baa78aee27d50de7886133e2a85e18c7631676fb

SHA512
b8d3528d89041bb896f9304583f550e8d2dab03fd66b330fb703217ea6a98714b4eee9aa8ecce1a5ce558d789e3c848b3e47ce876fa4ec02020130b145a5734e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee8b4a788e6657a6a533b63dcc752e03

SHA1
0577485e22f027aaab4873cbafab0c241be6e1b4

SHA256
6be42ef36c1bdca29810e7699509cffe56b2d6b20aaf1a7f7b8d1b2e0f284898

SHA512
f02b0953ce9e1318b61fc7fe2a6e859e12fc986361daa9243a1ccc0f13629171c57c634b5647590190de991cbee42ae4043bc1cc21fa2b11a967a688652da996

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab565A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5747.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit