dce3eb167ba1f2575bf4e2dfd78515f726888312ddbb74d60fc9c7f0c8caa71c

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e348f2be6aa997d8e5be3df294bd865.html
Size

6KB
MD5

1e348f2be6aa997d8e5be3df294bd865
SHA1

34ce0cfcd951e9a191d3dc672bcb66e9324ca64d
SHA256

dce3eb167ba1f2575bf4e2dfd78515f726888312ddbb74d60fc9c7f0c8caa71c
SHA512

fd321a1be5b49d0145f56a58a2af13861e85c83112aaad00c801ab8d046578f91884b8654720a288dedc3478fda7ada75caa576e8fa9a1c6e31143970326fee7
SSDEEP

96:uzVs+ux7Q1LLY1k9o84d12ef7CSTUyKY/6/NcEZ7ru7f:csz7Q1AYS/x4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e7cc5d727dc12fd678649bab3eae3e06db3218b6508063a5c7747eaae3fd9d0e000000000e800000000200002000000044f86f00e7292b6d1f66f21d4b2cc8f30dc0bf0c3b958ace249780dc0e3b2ae120000000ddce81ada780cae2f85e9baf37b136184aa262bbd0ec76003d48545fa020758440000000bb4dff73ebd0fa7b8bdb816cd512569e705e2d49b7eecd311f9dce7c5de8a543db176a97d309504aa4772ea95d8d1088893bb6aafd694ac7feb1ffc380b075e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202eceb71337da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ad0fb94c1ad98db808febc657f26769acee466e135af940ed1b0537954512c06000000000e80000000020000200000004df068ef23accc12334384bc579cd3c78461191b1e0d12660c35c13c30bca5be90000000f507ebdbbf3d9a41570aa63ebec2108c060342f7e945c82a7567ff8da40bb85a203675dc1eeb4a1a5194ef43171558d4faff490e73e1b6747b0e09f5e4ded512dcb3afe0953854dd085132034a48e3b6497250e2518cfc6a8d67e1796b6b5984dbdb581d5d23ec77d3044b184dcd5710f9b22ba8f425f1d0ba8916be0026cdde1cd93bc329aa34f819f3f118d05e06ca40000000e70dd35af3619a7049052c74c999ca31e53d868c50c99596e9c92e8b3bca7a25577645ce595c46adec303ae56db6e6c01a2cfd03bfbbaf864059b3e26569c92d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9EFD771-A306-11EE-B1D6-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409657889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2336	2500	iexplore.exe	17
PID 2500 wrote to memory of 2336	2500	iexplore.exe	17
PID 2500 wrote to memory of 2336	2500	iexplore.exe	17
PID 2500 wrote to memory of 2336	2500	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e348f2be6aa997d8e5be3df294bd865.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38cfefd7bda846fa42fbcb1f612e7375

SHA1
b0816b0841987c102a12dc7282cf162e7de603f6

SHA256
ee644b77cd8daf00c3290141210a56caeb9e7c2a778732589e8a30553b1062f9

SHA512
b94879f00b40c477e4242429d16131aab690eef6a3bb7e8779ba2ba69fd346a619484af8fb22d2caff44fe080cbfa9514cef49117d87f3f2433951dacd0dfed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ae64a8263a71304a7d05e03fe8ed4e7

SHA1
f03c8ea2c159d2ab5a2c4583f0c7088992b4fd77

SHA256
97efe418dd5a0fae90e7e658806827ea9340184f7d48eb99d1e785f4f2e0e0ec

SHA512
78c217a5ac6a5eb757faaf1964cce3b0209eeb83542204723f46272ba88f1a7310a8d1507b5ffbbf4e15fe9444b26de294df035626f925bab080417c6fe068f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b2052be4f63910437659d9a2b9d0309

SHA1
4425284fc30dd6f8c8aadd3850d29b80979685ee

SHA256
8b497ce0966d71411b7a67cc247331410d2089eac53db743a76c8e59bf8284cd

SHA512
03ed5e064f7db1f6dc70ab9a46bfdfc2c0494dff59137d6fbf33250bf5ad02e6e3d1aa732da05c104b336b3cac7be80ba94588055b10789df8023d881c0903bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
663e3f44a46625890fe81ea63d06c175

SHA1
b2e49337cf3d8341fea7d2fcb88fcfe8086399b9

SHA256
859c4984741bbfedec67fb767e66a04948a42dbfbd1e1d98e51188d3e1f5a7d8

SHA512
5c373f607519b98984bfb440e8e057541eaec1f0fe0f19866f06aa6d633f00f70e91d8508650991d15d8e17b737ea1522f4636e9bed9dfa19a9400b8903bcae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1e13f13c92f0621a4bed3003636ae3

SHA1
5c4189a3b8d905ee1349d9e8d85794358321308a

SHA256
8f96ed00d892a89b0896af6da63e32d61ddb6941e49e344af2e0051e03944574

SHA512
0c6cec194548749964af0cd0045d903655bf3b8182448a33c8f10671364e331676b4ed584cc3e4b7d86dde83ec6946ace783f1063a9bccde1afbc0e15565bfbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
036cc5a0379e10a4ad58563d3e8ca455

SHA1
d550c840abdd5e51e841c29fb586c4018e124847

SHA256
3cde65c5673effb27739b1a8d7f7385f79db9df8b10aea69c0de455974133a4e

SHA512
466591c1f0bd3ee9f9db97a8a8c7fad26a29103f7cd504fa64c2b156cea4986a4188fef990693087a89a1f56cd9745ad0bc211ff8d1b6b2c75f376cc18cb0f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05e47e4b5a948c7cd7eab531c766ac76

SHA1
a241978abd8be4331d2f071559fe8debf2d849c5

SHA256
95c4f4ff3bbd039a4e5d837ce5747957bc176f975a0994e486a9d56c33269f25

SHA512
84eeb2711766ba515302c7aa6688be938b5af28c9d39a838dcdd5b1359fac4a445d189be7a38a1337b08319debfe2b3d59d0e51ecdf894abe60504d99347023c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
616332677b870faf4463adadaae9e452

SHA1
d2f01dbb5a17185c2b246c0d5dace200e9721f3f

SHA256
b7516664390f4f8414a01e4812057b90e6282ac5aa8f1c036000601f2d3915d6

SHA512
bf40c7ff24410b6b380663f52121ebc8fd97b723f803079f8db5c4779c27c672dfd417629e5f99851099f304868da3bdcf7600af4036318ebbaecd37cc4d7baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73db27cc3b58bbc79559ee443785ac3

SHA1
f62af74f509cb65bedd21e07a65824927acc5dee

SHA256
4972b476f863a36ca84e25ac3ded965e72ace8dcdae5f3f4e4c33a1de3ca7743

SHA512
212bf8cff183e885a613f75309b9488f04c416626d9a13fad6029da8061138e6c3db59a54ffb23bdbc6ef93fedec1fe55ee50a696b6d1595bb6660771f0a8199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808d44be1ed4794ac1d7a3d374f46d03

SHA1
838f7fdc7d423f6584958f90108b13c279a3acda

SHA256
dfd00c36c895e1d3fbf3631bf070960160a920d4a4678de4149d1d561cd654af

SHA512
bf3d1e5644fcb6b80322812bebeb8ad4c199e8a63917cc8de604644aa49ec1be0f346a14fe564a3b5136bdd831bcc6686000d4773222b4a1f40dda686e8eeae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35f4745eaacdd287946f8f8510b1bf2

SHA1
1473f69361a0b2e4e1182403ef7d0be9d9a241eb

SHA256
676ebe948ea97525dba96e19e99694b377db863bc5dadeb6422107870c269658

SHA512
cbd0db6d998a3db6a7e93f7510c364e90ab5e0fc72e0cc9016cee14e541d14ff987208af10b94defcca2ae4a86539f7440d22aedaaf0b2d1ad9e231e79a1c011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31f4458593bbb5ddbe39b674b277d7a

SHA1
868a738bb9e68a6db4d31748748e868c4a3f10f5

SHA256
f9b7d4574ecd8ecc5efe45122aeaaf87c10a435643338a61da0f7bd65afb0e81

SHA512
1efca7f6b43745e52be5117287dd7a8121bb910ba61ed0528880c87e0aee879a28983b53bdf578977969c415cfde58b8a942a2ca795a245bec50cfc3d618f59f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
123dd36cee7effdffe4bf94cc028bcb7

SHA1
c4d6c3377f322835397e09c2b77d8a934a536985

SHA256
751778022fbf39fd6c94b9aea07a9998fc5a687e903dcc100e1ad92948cd87bf

SHA512
9737b764f7d27daf6edf4eefc867884456708a14790c5e70128e813877ea70a9bf96ccd9ec246df6fbaa60f65190c261eeb1989e516e4c39b3102ed8bf5ba0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc0fd15bbaaf6d21b79ec880a8a5c6d

SHA1
8c046dd9a9bae565618c3f08e94abad034cadb97

SHA256
4144c9e2bc35e6efa3f83cee98aa0195fab3fc1dc76e1b266785ced955b2331a

SHA512
a5a59dbd05dd2564a2f48886d3942148b13155519dda5e582a48b9bd8c7c3416a626e25f31aa9721aa156485c803f928e9310a6f8fe2f5a978a23d15b30f1af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B6.tmp

Filesize
98KB

MD5
371aef904c2a44b47aeefa7c5bb3312d

SHA1
b1058296c351474166e45ea27423122bb191efc3

SHA256
0836be0716e46b765bc8c79b573e98af6e058dcd5ef6a6f38e29f30b7ad77ad4

SHA512
8a40153454ad5319c7e5c6c5e6d818a483bdb3bd4a7d250359e8d393ff87378a384ff007a80ee9ed76243f83a7db1662f3b0d5c7debfe704fff8e724f7886812

Download Submit