dc4e6729a51f6bf91f96d6d8654c45074981c3ccec8df8170367afecbed5e3c6

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40eafde0b8e90fde74cff0385f633c9a.html
Size

19KB
MD5

40eafde0b8e90fde74cff0385f633c9a
SHA1

57714d958855cd99799384bf105595bf3bf6d3ad
SHA256

dc4e6729a51f6bf91f96d6d8654c45074981c3ccec8df8170367afecbed5e3c6
SHA512

180a0b703d096a3c844f39e0579d274a349321563ebf31d881e53e6dc55fe2dd0a9fd74c29f6cbfad7b32b32ede24913aaed57283b906f1b66ac57edb80a248e
SSDEEP

384:4+QfPFd9QZBC7mOdM8ytKfpC5IgSnbmFe7Ac2H6l6LAPd:Zcd9QZBC7mOdM8XpC5I9nC4lPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3024eef84b38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000053fa879f0815623f0e45892a8a784bbd647e959e67d32dd38cf1182499ef5b93000000000e8000000002000020000000a6ac734321be93043b11eb98bbcd755eaf39563f201a6bdc7beb250a357478b220000000f53159aee35c69eaa1ad26bf4af387d6c3f9f091c6066c649fccd54a48ec3c434000000098856072ad97b48c7f933d5043d172ce95248a1c984511c300bcd13a9dd06e09f147cfe9516796e85c78154b6baa72403547f050e3eb706e2add08ed450b2623	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409792033"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20278D71-A43F-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000aa75ee43d60e65008b3e3b6adac459995624e9413e62b617a353f57296f83eec000000000e8000000002000020000000a0cba40d6527448807d27ac72ac54500641b9d3dcc2a597a32612ced6076ffa9900000004e20f7e6219fd21c120662db8cafd4bd22c6df587987851cd9490435887c8ec143425116966e2f53dc80173d6dcf117f49cd92cc30a84821e5ab82867b1cb9839090e870ec541057f0d5c0360bd17fea8ff1931bcbf22d577865977f4256a06989e16bbe9bd63da3d2fc9b581f5083dfaa09cc53c41a3c91c27855d0b4828e9076e35d8edccf0294a84450d9a3bf5b5a4000000071b5e9a3dd7d42cab5d6bc89a9a8ac041453d329695fecf6fcffb8ca605298c8ebf99d9b97250bf4ef97bcfde38847a61431c9862fbddd8d1aa3dfc4bcaa92c6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2804	2856	iexplore.exe	28
PID 2856 wrote to memory of 2804	2856	iexplore.exe	28
PID 2856 wrote to memory of 2804	2856	iexplore.exe	28
PID 2856 wrote to memory of 2804	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40eafde0b8e90fde74cff0385f633c9a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bb36372c32c83eb0941a173128fc641

SHA1
f11c6257db48deeccf35b99ade692fce688a691a

SHA256
92e81bc4ea084ee94b44bb9cba924a23d082e13f6b98bd7c70a57bd4910baf68

SHA512
ac1c4d80ad392dc72db1af336a1c610b429509a7e6633925f5fc90e217f733a7e4b6051fd4f2a69132610bb24a8dd8cca5cb51f1914c5fbc55a4fbb67d8326d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e15f0e715d1baaca1132f98d09fe7cb

SHA1
c21501ae45f236ccf6a274c77601ae245998650d

SHA256
76e0d3e55b8382d34e145f7c24a0cab09dba5f6f376fd28e0841d7accf07e219

SHA512
25623494a9b76bf0a9a5ecd5d9a6ead581b73ce0afd8cd8d5621b72450961244fe53e33b1d97413985e69c483ba99bb0fcdf827e0c81a750167c69e321e3b2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0afed232f2bc956f244e39f1568bbbe

SHA1
7c208b172526df1428ba26efe59d0465b988d991

SHA256
93d9aa85d9c34bd175a5b2a4a24c64e2f15eb91e3a5facd03bf4e7fd7aeacdc5

SHA512
77c9ff513572c92ee56594e66a60fc54c962d2e2d79ae07ae466e6637684664f70970c7ed3e728b68a9549f9802e5d2c6de326c0a27baea4119a6cab50279bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4f78abc902b425b10276dce9b14777d

SHA1
b5957d014a26a87f87ca2084a8667461c3774643

SHA256
a85f5df9f36f5a0b9687a6febc38a42730be99f66fa9d6e6c6bfe0f09f7315bf

SHA512
27520db12e2b2cd22780ba7fd45dc783defd300b2a85161d36344eadc64f4c60f847af8892726ffdb73dc15675fdd33c213965211d35b175ff7b43c7a0e3a31d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6165a625b72bf8dc8889074b8480bb7e

SHA1
c3b797fe0e0284ce11c03e7044e392db01b964f1

SHA256
ea22687f75fcb99710e40a5a8027b139f3d019c0591031c53a21fc2b1ea9218f

SHA512
33fc5badc7ef84d8f46fe84b3a99b41dbdc88114b49f33bb184a040df123dc9699270bb701522e4005e8581c5780ce564dd234fcbd8f117be5bda9dba99405ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ee9143e0b7ee0cda9d8d2a6fb84b0b

SHA1
5df8d4c829eaf3dd22fd557524cf692f2c66a13d

SHA256
86aa7fa36b7c7cd7a0972022c22b938feb8470169a9f4e52823e62c5e4812f98

SHA512
6e2364b6ba4366e2f25aa93c96222d904907f904b9c296d2774caa6ae2ee6be2df0a6ecd7d0c2b99b17d84db828bbcc08af5ef609d0b15e2e46c1769c2e90898

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA49C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA663.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit