e35386d4f75dc745b3a143465261e4a26627f0c237a6876afe9d19d7e68730f4

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e602c5e23f0ed71e73cce6b91eb29a4.html
Size

6KB
MD5

1e602c5e23f0ed71e73cce6b91eb29a4
SHA1

8519d4e0824a6c6910157fcc52b5ea1222f350fb
SHA256

e35386d4f75dc745b3a143465261e4a26627f0c237a6876afe9d19d7e68730f4
SHA512

7e23029a5167226a9d6e273a40774f1582b6b35fe5569f7df2c2c9020869eda3dee5a4869e4826bd5592d6eac8b3d3b417c1031ed680c17ba2533bf214cefd2d
SSDEEP

96:uzVs+ux7HdLLY1k9o84d12ef7CSTUHH/6/NcEZ7ru7f:csz7HdAYS/o4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000aa282475fab5ea2fa379b8b887d382a6e56b9ffcbd6dd058b1051a9b3e2f5912000000000e80000000020000200000000af2aa618dfd5eb5841fc51170b1ce3ead088de6c6d8b24c68b5ff58439eea54200000007a135ebf8ea613687da0f9841f0a5550941a319d71d23a50e79c62105a7db87340000000cbfb2c8d9fee52115bf4870de4925fad6a59774c3684e0ddcbdf8cb5a975a90690aad55952655c87275c61e9f16d440329f630a1c7ec208dd3d5ef77be31d87b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409748810"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{831B23C1-A3DA-11EE-9A90-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c7a270e737da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000bdce2d814a7ba18e3dca689598263ab6337b169faf09d04fd99e447c048d60ef000000000e80000000020000200000005b611574ee478f8e52e16dc311b97cc19a2c95576bed25a7e18628c047ce0bf690000000f348d20f10b7923a3a5bc5f3304a619c50b66b95c17923b078c1429496e47c9139772f74db1e3a31fe4cd0e09e416c4ae45a7d2593feca07de6db3a4b09989fd07307e3e447459c4e7db950653f5d503e4fcaf31372da6bb8c10b4907d87a64eec38ef351695409772b251dbb16a5ed7f98054f0c239b699648960a6b53a79b4194bd2dccd4a4a017dab03960a28884040000000d3c4bf1a32bca577ea59029dc0925154843afd73127f7d54907a3943dc278d9d38e95c75d1d84b81283a82853d26eaef9bc30e08c545aec3e4894686ee36a8ec	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e602c5e23f0ed71e73cce6b91eb29a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
597379e26db406171151103927c0824a

SHA1
3f81c2f54be64955b8d38044fa68e1da13384c5e

SHA256
c4ee6483671833b1fa44c7dfec4f20bed5928cb6f53e2ff4ede63e7ebefa284c

SHA512
36b58f827ec846025d6370b3c2cd27e996460c9e716ea4f9ea8f771309502074fa3eda37e791551b65fd79b521d82cc9d6f2635d24ddeaa0a696cc01f3a770b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff8842d61214da32f742420e3c8e0a8

SHA1
a6ce35678745842bf00e0d113641081d3b1bd5ba

SHA256
19fe7415cde60635581cc9f01c753b1629b5c37c808daa8e1277c1537883587b

SHA512
47ae83c7a7065b56a73d467fe7a0fbcb3218fc39c796ba5276d6b11b6b655d4f01f355e8e85a3c0fb8fbccb4af736d2043b3e0adb1debb351cf8627e54fef8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16aa30d160017c783af31469e0174d02

SHA1
bcf73a0f592ff6075c4531ec9177e0008effb8a8

SHA256
656629ba2fea9b87239b7c025380cc4d8ec39756e18e3bbf81995f82f344479c

SHA512
27df8cf5826791bd30768c902db35c41144142f166bd3416d2eb2f51f6b4b9e65653fa6465b969f785013e96fdf085b5f0bb2d500f742b5a5fd3db3d1fc7b2c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
346923e76ab49d4d7071b555317a4535

SHA1
5a00a271d57c162cd064302c40ef9bb701250dd6

SHA256
c5e4742c7008915a33e6e3e875b996de4ddf84ab0159d5b98e42b0b6ac53d408

SHA512
2b8c5db58b149faf9685b5529af6d257a5b2fd70416be45d77177a082c159198ed3e3b6c8fdf52dcbc4f0cb392ca368a86236e1392da467b85c6d6b4993bed79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c98079aa9c4fb7b3894d0342db16a6

SHA1
911ad64ede3728ff8ddddd5fe4b3da5ca094c38f

SHA256
284435b474ccf7c2607b88c490beafec046e51d2b67744812e9d39739f70ba74

SHA512
399dedd7d14ace2399cc9924a3a3cf7a288e2e7df3d3bb3a4fbe5d7e94eb95452842ee3d1a8ee9e224d589878687f6a1906cbdee479e450b27250ca7283974d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
922ea9a56b7c807aa49d32f0101ecceb

SHA1
fb07161b07b64804d825b7ea81d6212edc1ac9ff

SHA256
64aa64feb118a9b982f7fc97a79bee5edd2d84a7d855865b16ad850c8f528885

SHA512
993cfde24a7d4b700d5bbb1f5ba53b0e6dd00dc60094322bb52870af76b3224e823bae6aa790b1b56e7b1f706717ebe58a809079f2c9102a961de15708eb77be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33a851785825c1c9f1122c816e2b91b0

SHA1
73c4e498d1d83247d357977a4bee955e5303ef01

SHA256
6d790d8856533ad9a4d46e7a63923aa9b8aab5f1d311ade5fceee237491556c9

SHA512
526556496bb2f97151f25e0abe9758ec4b26e6ab1cd06aec4d0f20910ec43b4c49ef6eb04cf5066281348cb52fe516dd8c50beeb42694c17fc5c471701fc1824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b37e49c8313bc603b194e10d20a89fd

SHA1
b9bd830929e9fefd645c2539207a7d152e6d9452

SHA256
247047f6900e46d68f6880f0777cb33558234fb849856347e94bfd1b8e9240a0

SHA512
27fbdcb18150f985792160c167818eae6f5bb4f4712fd3618f12309fcf969a074d851f486036e07a6b470e9e1c545f348424b96e6f5cabb5f8efc059cfa68442

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE553.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5B4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit