b2ef17754cee5b8652039e3941a8a74f48cfb0978980984d46140abd12a17057

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

430c79359f97b85a6c1ac6a60f228974.html
Size

18KB
MD5

430c79359f97b85a6c1ac6a60f228974
SHA1

34319a0c93797ad3d0c7fa07e53f585d086a1d43
SHA256

b2ef17754cee5b8652039e3941a8a74f48cfb0978980984d46140abd12a17057
SHA512

acdb4125853b38f9e0b93728d45275041bc57b3e734395eaaf58a0167b96ee318f1f7b6b823f69c22bb24e1da4cc8b32477a4d28a77b5987bc6e282403301d18
SSDEEP

384:WQ6MoGIuEbtahr1AgdGgs8jMaztTLPAuz68MMv07X:L6VZK1AgdGgs8jJO8ts7X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D32FAE31-A448-11EE-9F2E-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804dd9a85538da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000007e4cb4554998015e9a52894983e3049bcd1fddbf909e9e1d67cbf221c91390e8000000000e8000000002000020000000b014a4372f5dfc053e1726bbff52509690ca1a026dc9a0bce8b1c8bbd21c8e83900000004bcd9144ab7f8788e854712f4f2f81500440cfe354afd3f2bf73a6509191909ebe02880cb5c2aed73828e93d3fdf7abc177eff37d3358122f51c574cb4541836936ddfbe87512aad35e2fb6ca804010b4c4884ccb67e2969ae9713f8f949d0ec75c9e5b39455831b31f2c600d4faf6be50e53b3897ce5f204f871cf03da0ff589096ffb54b6ddf194a61ed4d8bb7bdef400000009afe95bced1ef96b305b9013bae7400c1e6e98d948a88ed4270d74b135488fe89df5bfeb3952e0ce1d010e3f19a0abf377bf8bba73c0a2b76270407b75299d1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409796186"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b28ff8644ba049da21f90d046a730cd02d2d7fd621e36531b7479e5865552ecd000000000e8000000002000020000000e8464c5a1953f3fc1e4c0c67d2df751bf425a340d00ab6b1e2aa9f254bce9e7e200000004d155831658879ee7052f8291d6abadb7e86ffa5620bc00ea01acfca97f1c93e400000004cab1ad6ae259d05ef385411d8f41ef2a151314a1ecd9757ab7eb8f9bfdb8f5f5e94fa3ad6d90420973c8722abf35c325e0bb84edaa2618cbe13c22f33338375	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2848	1704	iexplore.exe	16
PID 1704 wrote to memory of 2848	1704	iexplore.exe	16
PID 1704 wrote to memory of 2848	1704	iexplore.exe	16
PID 1704 wrote to memory of 2848	1704	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\430c79359f97b85a6c1ac6a60f228974.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd2edc634c53018e771e9cd78599064

SHA1
cba26f80da611356be02accc5e05ab18fe690931

SHA256
4b08d6f2f80e4100ca8b06f748678cc2ac81a7c221f0b98bbe1e001cdf69f1ad

SHA512
332fb4646d7344f803c6073bbaf87983a10aee0ec20c4d8cd1bf52a318da61782c0062ac7ccf6978d696084d53feee3e704981046613b01116661fdf3c2a7f60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c45810236d824ec42ba19cf6ad039178

SHA1
bb64e5d18385b77d7387ab6df11fb8cee852d498

SHA256
443479388a85100aad20b5062da64440f606d32858145d604f098cb34d7f0f8e

SHA512
ce67bb73ee66aa1524c2fd57a62b07944e3feb850b8c01d02c8ce61b61ae6bd538f303a31f0ae2b7228d21ce8cd64c1510bae94215bf1f7f212f756003864c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97672530c2f43f651fe2d5c31ebd9a8b

SHA1
df1b028e82f3ff8bc16f48eabdf4709580b12bc3

SHA256
8bd28b2e91b02b7bb8b8d3b1a7c547ab35b71a3c9e4f42fa38240ec06a3e1eb2

SHA512
943e2a60297db1ac4f4410466b56d5ab9ab177370321f8b1147fdf8d8a6bac9c04fdc6fec3fd58cbc4de65d03852c272e87271f5c7e6e8c56e0101c79839658b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6e137ca96e70130fa74635d3706a4ca

SHA1
1c2688e27cfef2438a5a85c831b65402a5816cc8

SHA256
882e91594e66ac663d6cbf8561c7a15db27a94d79dce9aa44ab164246c4273ef

SHA512
9474dd1991736355eabe634649cede61a5e518afbbd8eb73868322a8a7d1e6a5c6f8a1c0b37c89dee522b5750bfd03186189ee6b93daa1e366df83530d46d676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57bee62aa0979ca6a9bec8262daef2af

SHA1
b0c15d3d34b2ce4b1f5406b5c5bc8a975249525b

SHA256
6a6c82b408192efe520fbd3c2abc8e32bdd4b8b6fc1f86850ddf368ce935e13b

SHA512
8801e6edcd0a22a53fcf8b2d4fb24ee94c225c2cd12d01b704fa5bd807d7c4282c4ab7bcc2c5ce4cf65655e865e4c297f2b4f36a88ac17faedacb09e40a92f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC62.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit