e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2

Analysis

max time kernel
119s
max time network
177s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WindowBlinds/Diamond/NS_Shellstyle2.html
Size

5KB
MD5

094d852d42f1f76504ba2ea156eed7ad
SHA1

367c3e1bb3a02c199983163beeb767d405f9fc83
SHA256

437bff401f1e7c361b775f155d09f3a68c6cd963cdd7fbd5f86fb5cdd9c4cbe7
SHA512

21d76ccf4d2c0e470038fdf22bde84dd5da040204703bdcfd10b353ee3819d95961914d1e5344fe8ea9642cb647d59cde2a397ff536349d5f54d3460f06f6134
SSDEEP

96:AxuTg5Bo2CULXpopgH6dLWexLw3M45bFnptnVpeMWSe15lWGCRxQO9SBSM8MdCF5:AxuTqogiuf5bF/WQe1TexQBMRL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e5702488b7be4f90ac6140f0bbe04dfd1aa26cc5b404788e2a989dc504e34c8b000000000e8000000002000020000000f1a3af8f285a416cbcedf2acd0c19dae1434249214284282dd72bf986d16f7a12000000069525ec06140f2abc89ae5d1ab995cee59ada36e33da041cdf300d56725c2c0040000000184f3025763d588cfbe168040d0955c4e4de5e995a67ba3c35a6cede6b79a54e5901bd7784ebcb5d6bb24d56b6da73bc2788e4a670a4285f64b31fb6c6454382	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{266518F1-A346-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000fb114c501a4fa2e5a90db2269b062c331d34b126027d535680e66501a06eda1000000000e800000000200002000000089052990a04153c4a17fa18ca862c8850ac54bbce29c34611d51089c4ef6e19190000000b4e58c44f880ef2f5c7ef4721f13cef41bdcaf8573888c0ea10b62e47c5e73726794ab947389bfed4676257775ee4b752f5d001aed88580c7cdc1009835751e1b251fcccbd1abac489d5ea77eee0eb657159ec1bac14e68547a81b3e5703db03902e6f94d3f1af02434e374828e5bdf679814e44e77b6bbb2065aec3ead396bb57bf3dcc4452b4f6bb05cd7ed20bc47540000000f03871e680ce0ce93ab8072e393b47ffadc56472aede65fd0a2992d37c21931842d93caf3ad50e7cd09cc3a256b641cfe3b79121c1ae042abd9fc174925e5fb8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003c5cfc5237da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685092"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2780	iexplore.exe
2780	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2812	2780	iexplore.exe	30
PID 2780 wrote to memory of 2812	2780	iexplore.exe	30
PID 2780 wrote to memory of 2812	2780	iexplore.exe	30
PID 2780 wrote to memory of 2812	2780	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\WindowBlinds\Diamond\NS_Shellstyle2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
264665d1d026e8c9dcb8050dbd262ae7

SHA1
baeb564192de50358c60c32bf5c14f5d4c42770c

SHA256
46a930b1231eacdd6b028985d7849f5d6f7b9620b646bc32bf04730573074f9e

SHA512
5cd193deae4f33fe91e4ae1a44030fdc2317447c93a3b4a0305dc605a989ed2046a6f633f04c191ffddd68685fcc47729eca4b46b23436bafcf8871fc10c1645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5985d1f281e18b1369caceb9155b3de2

SHA1
67c03e1e6251c3e8232779f8cff9a844df922ebb

SHA256
c713717623cb83616898e74826e8a19cd9396f530db589174f3c903575a35e63

SHA512
6dc70352325c9270bd61125a5ea7147bc404494fe3599e2e04d55ba7a2f24cb5b945abd0bc7a04be701117dc07f2f95f057cd8d4771a9c7b29fcedb700a6a20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fb5d7c637630ee8c34a238cdb6561b9

SHA1
61a08442e541f20aa97b93ce3ad76cfd61eb2fb7

SHA256
eddae9baf0c9ffcbda0615f947c9b003fbd8e16af44e1419b6e4a131594cfb06

SHA512
1aacb220e28fbd0618688132e15933e078a77b52e623ee94ea4c1a9786aa9c1575344a933b6af87e5f9bdfcb84074a3ba3520111cd7febb2458401565a87be28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27470fc188cf0c309d19ab1f435ded21

SHA1
bf0ceb83b2cbd3cdfc798a73b06f4c2068b3d273

SHA256
73986de58c6d7bc1e90b44fb433251a0f94d39392ed06e18b2f88e86d425802a

SHA512
5ab6c3b225c8b22a6130b0f771c156e68819e57ba52ef5aacd697f2b1507c0611950a4faa93f72601b5f557f12ff0d92fcdf3c8b379fe11b2acfac44da45b243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e12102cfa10bcc093212b4a3a6e0f0d

SHA1
fd173a2b86012c7ca3bf511770b5f8c717747620

SHA256
19465aa1c7e13f1901cfabd30ac4f26959c8b89891abb36e26b0072029888361

SHA512
c093725b32921baf2188db7739d03e265e4c319f6c98e821c0a6830a34a50394b70b8ec09e5030d371653b549c6922a1fb2ead2d099772c948bdd60ff096fffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b0f02aedf3d1bc0ae05a61b0e80a19e

SHA1
5294cef22b0114d42f11734808a7807216610f16

SHA256
f0e697acbf704819ada2ac44cf5e9851131c307f4087f0e709846ea93afe71d4

SHA512
cb28ecbb38be89a306fb1230df1950f52d7df634047e59d90dd0de4d7c34178277972eeb86724513824b0a9681ee5aa2af1a759ee2e853d8cc5ff75e3baefbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f527f2a519d5b8b95e4be4c7b5a9f081

SHA1
b7475f5580ab33aafc180d540f0aefc4c1d15148

SHA256
7539e7c869697fa2a6e3982d52aeae3ad0cec0dff12dc316e7d6c023e4c76b86

SHA512
e321cc300f2e2876882ad641318da03ccd5c8c5b3fbd2d27376329ab0cb4ded13fff1c3cafee8febe76a21f3633e9526de2fa69bcd5c0ba123665b3e0bbcb48f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b49b48360ffcfad5bbadaccecd357ae9

SHA1
862f40df835e1b4eae31da0b1dada2b486c4d1f9

SHA256
8854c061424eb0d535633e16b0ef74a43cc856f9889169be38c3baaf3ff03166

SHA512
bb2f285748f007d2ddf85b5d5dcb95c1a2160d4b277a923a8e4ccb77bd7081178631d98f78209165c1d1380e9fb04e6b593816319b9ec0570fd3c32be0f9b078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f5d8488f2889243c67b718b5d1189b5

SHA1
b6a8bbe2dde45cc33585e9a7d7e2d9611d72c642

SHA256
fc6763bc5c85ad0e0affddf6b7a8aaa26d653449cf9b626ff89b696027ee2491

SHA512
d11c03f68ca4cc731c30d26512206c3337cca52a7861b6e583ef8bdde96b818532664c7c23169c91267a7ceff7448274af6c1049a02ba655e9dcb0bc900f1a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab120C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E9E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit