e09563dd6ec21471b65968989f13df1aba31258ee34f6b7243aff6e1a249154c

Analysis

max time kernel
83s
max time network
174s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12e025c30b89019d2c8e73f6c5327ab6.html
Size

7KB
MD5

12e025c30b89019d2c8e73f6c5327ab6
SHA1

48baaa7cbad54ba0ab1bdf43f0a718b6726cc29a
SHA256

e09563dd6ec21471b65968989f13df1aba31258ee34f6b7243aff6e1a249154c
SHA512

62f9d6b876170eaeb8875f798c51fe253f10b3cade28333c8aa8cfb893860d059dee085172e3d2cc7be87bfee841be5868203d3650fc27870fd296c2839b3d36
SSDEEP

96:uzVs+ux78TLLY1k9o84d12ef7CSTUpx/6/uQvVHcEZ7ru7f:csz78TAYS/o4uQvVHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCD23EE1-A352-11EE-979B-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401cdfce5f37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409690546"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d4c359bb68227a79fa9c7301dfb0199d08a1860dcf5848f8d0fcf145bbd615b6000000000e8000000002000020000000963d3bc544953b4753149acf5e76e0db36be5bd089b8ac94c3f6047a7a47cb55200000007277b43ed1a0276c9ef52031ddea54294ebfd7fa4b20bc25391eb27f8219d9474000000072d7a6235c90818b54fbf9008ce5e6c590e348dbecbd453118fc635745529e9851b94dd2a00fae9358f4349921cc0492cfb1aea072bbaace186e55ec1ffc66e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000cdfa2604132baf282d4259a64443653f46df7416e80092cad17dd2f092aa03ec000000000e800000000200002000000086238eca0d56ef9df144bdba5c589c2a568420b26b92ff725d7354c75c484d0590000000a52f8320a132a714766332523e989ebe3ba997a6a06db9ec26c16c8bb5a0af59134de6ec7c537f858e9bd225c9801233ffa0dee86b277d26e7f343e74798efc7e33dd0c7b977de5a98fabafe82ea0b7caab649408a6a060a707408527112abf8c2848ada64b40d8bbb22b839ec532d39a86b71a3c6c4540fd7ea02d2cae88e0bf4065c018ece5e6a85952dc8e122bf14400000009cd02517913e3947b8f4ee9bd57825a0d3ab992d7aaff750c7e14693fb8ed647f88852eb556d9b845fc01be2b94e25eb3301e4b77734be15dca28fe97bb93250	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2748	1612	iexplore.exe	28
PID 1612 wrote to memory of 2748	1612	iexplore.exe	28
PID 1612 wrote to memory of 2748	1612	iexplore.exe	28
PID 1612 wrote to memory of 2748	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12e025c30b89019d2c8e73f6c5327ab6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89801c8f356e416186b7bc37b41e55da

SHA1
537af51bb85322e9b4bcb2c8c986ddd4b55970a9

SHA256
e6234fddc0a20cb948493600efa6ae13ed2494942045075ffc3315083348206a

SHA512
563b2d58d4843c53423b46a25d4278f6908ab9fbd5ef040be64c25e44d142bacb38a16aee11e7e7a353b6eb217c1f8572f4355ce362e44f3934a4b05a4b86667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
901d46af749e42e1c94e0eaafaa2b329

SHA1
78daccd203f2529f99f452267deaf649e51c6bc1

SHA256
08806af988329326f3679c8aaa8f2af72c6f38342e244cf4773b7233a20a3b1c

SHA512
28e03f54f89388d557a2680aa9cb8e4c3c8305515f79d9cdc8d7985569f4558d833043ee1c3c4a020636b16fdd170c8d9b033ad078ef4fe809df475d77d21c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1881071cecb9f533bc1f151ed351d4e1

SHA1
ddfe006b86f961590ed6a3bf0d91ff0c17c64a4b

SHA256
56f316e20141f595bb5563eeae8a8362b6a6d9a1b6b7cd024c0c3bfa0073ae53

SHA512
4ae8c6459ec24c24bf32097e5af9a39bd58b9cf88df0f8b9addfb7dec850165d4ec64e256404c8661ac74ef0f9a569b4c2ec85be4e66fff1f0f3d6487201a241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df9892a35a896ea340c2c5412d5c5457

SHA1
0480ef5a91dc7d3aa70864b303cf28a2475c8c49

SHA256
82207ead2b093b6aee76ba85982ad8a93fe5798f7c91ebd73d0833d08a0a953e

SHA512
3e2ad28df469a341d731cb02dc88595c7950d470747954282bca752d05e5b757441a9312db22fe65ac8ab63ed77bdc444e931703e7b18c6e64f8b25304509a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96c81450be3b918a0d8ed5b7176bc59b

SHA1
61a65dbd3b6bd64433ecae3b3a48969a31304e66

SHA256
0aae299766db2cbe21e75e1ea88ec4680b7cb8757844e1c9c75efbe39aeecbe6

SHA512
811a50815cf8500f0745505876265ba12d7369531675d6c3c7d311024b2e3bfa13ea5653f9ae120ecf2e112c5f9d83c88c8cb678c4477855e13bb2dd4007df7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a785f27afc06beccc775c38303db4c

SHA1
e644eb9c14cabe4ca8755796e599386ce714fe15

SHA256
5026b325671b436d8de2f35877abbdd3a657a6ec47c34de4cc62b43292f500ae

SHA512
cac69ff887f292f073c7f3d5f24493c8bb3623e33fd88e02eae77f81354ae270d219b5c06e59e22d8d5d962522fea197b0f8354cfedde3ae378919808530be94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
227d706b7c8ad87dcfd45ac442010e49

SHA1
d27bd11bf7958ffdad6da6a727009a4a8358e1b1

SHA256
5da4fa7725cd8127c6304840d280f2d7a0f41bd1dfb91802ea7861e39529e14f

SHA512
5cf6c356110213b66b30fdbdf01d43fcfa8b278715cb4581c1c3537859e74436007ffd54a4f0d5bc95e4f471129a78258805063390c37ccadbfbbbf95de35b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c321c2f7c6e2680764e98348c029ed

SHA1
dd1d6caac9ba88889f986e4a2add45b4d62b4b58

SHA256
06b7101be921ff9fa0eb1a6c58d92b914d2e3a56dfc23e712f01128106823c8b

SHA512
4cc77fe298b9fb3c6ca9097a3f8264783fa655f1459db8b214b2d557dca75494a4af53ce785678244a5bcd5f8a872f876dd8bd3129d8483b49d87c15800ed4ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d21a909d29c4e06eccee3299826a8455

SHA1
4baa12191abb2afc4205bb72d3555cc1800244ea

SHA256
35090ead346b7544d6263d0c7d36ed75c1b5a620f94fc7b8455a4545c8a8da7f

SHA512
f12467a85967e5824fb43e5456d7f968f47fa32f432534f847c30d81b4300e2aa5de335dfbb275e6fdba00963433ceb2678f58dc8b324461e1ba148a7887e65b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
016f8fbee54abc1110560973ff0cf088

SHA1
0621f24285e6773d4a349ec87f8d3efa488d54a2

SHA256
07c5bd4a6942bea917c11bd9dc9b4463281a7c02bc275a9ec91dbb3de342388d

SHA512
6a36854436ffc3620032140bc057a1bf8ec87506ff3978424a2907519781ecc8621dc4ce80c918fae1a333efddd2d6c5c2d10f10ad9436766aec3f6e50ab7529

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82F8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar854C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit