e14993e24ef056a4d5ced9200519081fd7bbbd5e35ab7bf5bf1f12e27e1a6539

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d8897893eb3ab9d8940e1e0d5546164.html
Size

33KB
MD5

0d8897893eb3ab9d8940e1e0d5546164
SHA1

a7712e762c7f7beb6e5ef35a7cc8a297bc2de745
SHA256

e14993e24ef056a4d5ced9200519081fd7bbbd5e35ab7bf5bf1f12e27e1a6539
SHA512

74867fff3ac3a5050c3e9336517c2776f34f1d383369df978e21def4eb811ef1e3a2d89f27413e83d086311a5a37ee949eed76918663f8c2d455dc5c513180d6
SSDEEP

384:aZQtpgQDFSwhf/ikUod9iSbqvBB8WNzmY0642PpsVWii0WMsLwQ2HfCQ5BPxbmVy:aZQtVldd646l2/CQ5BPJmVk/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 10eed955bf36da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b25368bf36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000045b67720297d5d7ba569b4ccbe34c19e191de0f7115e340b251264148fce7af1000000000e800000000200002000000028ac7927558a0c5e699b84ebd4a9fd4d2a557576c1e67c4606a98d4624ea8d12200000001fae84b9471307e2a5fec058e0ba2328790eec16cfa27c0d021381a3d25312d440000000a41d2ffb8a0386254671eed99a79c43c69598c970bf91f1b8cbfaf8070431ea28d5a38b4b0ef3c7d945189c86bfd8fc492c1867a5b9cfe0bc1ac0e4765e64564	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000479db0ae678b41901180d0d13d2e1a10fdd4885cfc6ec33be85c25b46188eadb000000000e800000000200002000000032b73930b1b14a9400be9211d87084d883b261520490d671be2f4b7405a2989f900000002a86c22c1220a947ba96cba2b9652972bcae1a7f373ded79e934f4867601fa7c62b7b2a8eb045a8351c05de0f4d8d51ce8e009e07fced63fba5ef3aad7dd25852b3fb27ac3695ce563d75021e3614bd940550b22d3a78233c01557e20a3438762633e24069fc6331b60f781bd3f05278b60a9c07c214fa4b2aba67289cad849dc02079758fe422e6c6f10df3c034af8b400000003307f609b8e7daed8f8e026f5d7027dfdf805940d83a149c30b7f8850840cfca8423b102df175a69e3c8aee93d3de516e775551082f51656ecb181d37085658a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{762AB1E1-A2B2-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409621659"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1720	2140	iexplore.exe	28
PID 2140 wrote to memory of 1720	2140	iexplore.exe	28
PID 2140 wrote to memory of 1720	2140	iexplore.exe	28
PID 2140 wrote to memory of 1720	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d8897893eb3ab9d8940e1e0d5546164.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc174b4dad83c5284755da7e36d5c42c

SHA1
786bdc9564990ccbbf1ca74167d6c37389e46261

SHA256
7fb2b49d375d9d0e8bfbfafa50aab80c5815381653953a38c88a3715a5b5a964

SHA512
e49d03a10c2e73a86b20002b5e8ea6499b2f62110d075ddb2f6c96b8270d21a84f1fa0b295682f61025307e21ad78a73a3a9a58d5160a7968bb069ccb611fabb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
423ecd1124562cc94128e2f0bddc9799

SHA1
bc5d3d29b68500a73f9e91c1667167fb8e35a27e

SHA256
5cfac5ab9f3423d196fbf032682cbc036e23a0210b2e09ff92332160586aef1d

SHA512
4873e54abe836d2404ad8029495fb80295a996bc26ead96c4017bcbcfdd2ec3af1b60fb7ece3e6d766a7319c2dbf65f9ddffb8b9dfb0009c56bfecbc67045b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f895f45f5067913b504b8cdd12ae6c

SHA1
d504e80bfd184aed8aef146c0ce070b535c777d0

SHA256
0cb65097fc2ebf4f3ef912d87e42e8293fa3f7947b62fbe349427b874dff275e

SHA512
1345a00111982ec7f36215028ea07b9d19928a0a9cd11744391607df43ae5c62ee9297431db2d1139607860f9f8ee3a7dd5089baa15d631d637453b325ecfa69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9fb983cceeab1b31f62d864a31f9208

SHA1
e297cc231cfc661f1cedbec3ebf9a41f73cfad76

SHA256
6364495319674c1c447895e8a0b3e62d667b252ce9e64fd5b77cb05ed3172dad

SHA512
87371c74f49444996bbd67f03309a21a811cad63aa73327bcc44c2765aa607345823ab9608cb94fd25af0fe7c22ec4211b1345813770e20f87953ff1d42a8e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b88b45d57dbb7be8c19bb747fa484104

SHA1
70523a8cf54dbb24357e0a2889c12a7efb6585a9

SHA256
6324b7acad3c2cc54680a28ed72cd2feb918212a96240c568e978b0bae8bad35

SHA512
0084a52abf4d6d1fea14e6fce2a305c673a04c8b589ebec69ce8e4bbd8378399e576540c2bf056942c5c7031952145e7b9e21ba23f09511741f96363697c140d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1873884c6b7b0dfe795abf43cd5e701c

SHA1
8169ab1dfe290ac183343e47586389e091d63529

SHA256
5a8af0e6e62f710d5aa8f9628a58ac4abffa71b87109856149b7fcf65f92db98

SHA512
58be1f3444b9fb99d0a3d026cb17ebfcf4c7fcf0f84d6ea9818bf27575f51f50d3545ce82938776dbf1cb9069b6df6c78458133b8b5c7e2fbf7db022f9eba62b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6a45c83c801ba75e888bfd3762b89db

SHA1
642a834c4a008409ae70ee2446557e4ff109e588

SHA256
748674a4a971fefb1a16511b0798449f567ab2b2504f5b423e79f3dd892a1162

SHA512
4527c9fb48ca8b72d5d6b249c825d8f9963ea9db948eefeb7fcf5d26b02ef20ed8d0a40e468ad94436d21d6246f7ab2590ea330c1653c99866728940524370c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae8152cb5128a9a2f25ff676ab4c440

SHA1
d653528d1718bf7fdc3cb7b15af4c9194eb095b7

SHA256
c5cbbdf5f7e46681ae6bbd62d2b506e3bebdeaed1926c62d8773a8b2482c7088

SHA512
a6201272284c390296ea8230de12c1e969fbfdb9837cc5ded4fee7b3a28c60361e363a0c8e9af5fdcd063b8c0216a65031d23c6fc731b371d63b97b8e3aff31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58da00c55a25e8883577885c4065937c

SHA1
bbe00e9347301a6aed6092d29386c15b122846c2

SHA256
26b68b5bef5ef6941dbf01c98390f4e92b7fb11f3d3e805b98926886e45cd253

SHA512
adaaa0cf2781487d0d40a295194588db06b21a0c0d8de352b5828bdaa6faa3ce251a427940ffd9f6eca95533cdbb1e210cabdd887b7894d1fd4193d11358e0a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff96b0686da5f0d7de0c1166150c3db4

SHA1
5699c7e5f6a88097679bf42e7f4eb313e239770c

SHA256
812e9666e0da6bc4971822f0165b0086c5f71d50be2a8e457aa9235481d07fb0

SHA512
a9da47d32734af92e292a0111c54a5c3d8c9b764a1ce26b35f737f5a3ec571c45037b850a70906c7396372b3cae1ce7e41b8e8169047a5d6086c0715ceb1b993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec75e89ac5a024ee65b5e808bde368ea

SHA1
6a8124996a1b282736e3ac56d3725cdaf671e863

SHA256
a64424b1d04c5406458d8b705772358a8c058d2fdd669e50beecb078d1036615

SHA512
db4a7335b61a8d2abad45b39ac0d7150304df84e32a698e22070cb7081b2cbff0f5536b95144dd0858dc42024bd58bcec873249d35fb1d0e7af4b6ba13d94641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a2f22c80b4f4a9093d2080a74c3f123

SHA1
4ef766c4239ac71c0d4724658f2987eaa04df81f

SHA256
74436deabc3a72ccb130a8dd25571ae9546bca4768b3e36903fff37c982dc49a

SHA512
5578f367ac8e88abdf5babeef813444bda5dc6fa4cdf67c9e44118a3ae516752554f388553e246f454f4dd87ebba70a5dee6de62b0940b68c1ea13374063d7dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb03e33f64d833a3f972815a76b80f8b

SHA1
c3d11b0dcab7866c4cbac395f3298299208ea5ac

SHA256
93b09cfd046816cb9345bd310aa899ad736434ae9e71835bc8b50ed9a6a0cf4e

SHA512
fb4b73449f412115d201788b6d94369a03b6676fb1e0938fede6c08528422a94479be4a5936b00a741d163901c3db13accf2d51e2f19e38b8519ebe22fdc793f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4d6bdac048bc69b1e96c1a8a18a7b11

SHA1
131df3c3b74134617f148577fd49f912e51c80b8

SHA256
22132cc7c750c41410287f66f62b5fec184d33b008986b9e68c3991365317a86

SHA512
20b5a2a528882a28c46d4285e111cdee35056aacee6afd67748356f90349c3e7e8aa7ead560d080463b97ab88d288a2ffc6d96ed23174256276015587bfbd0b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AD9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F7F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads