4d560fee14445c5f7a6ffc91b9e2c4671133dde2039afacbe417786fe0b1599d

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1c7176670bb8aa7ab7d70bea3bca2a4c.html
Size

19KB
MD5

1c7176670bb8aa7ab7d70bea3bca2a4c
SHA1

f43d4e1e3e52f19c6d8d8ec1a1043496a2a45931
SHA256

4d560fee14445c5f7a6ffc91b9e2c4671133dde2039afacbe417786fe0b1599d
SHA512

a73ca9cb893258ebf6562e65ccc886627503df32cdb483d87dbbf242dbff9f54a8ab86f75212d02e68baea0a49fb6b581afa495cbdeb0197b37ef859c7ec5793
SSDEEP

384:e0iud9PqAm4tHvrCtALDv9ri36V5vqSvHhEvdzz:e0i4iAm4tPyALVi36V5iaqzz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B423DCB1-A3C5-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409739882"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c7176670bb8aa7ab7d70bea3bca2a4c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0453240415b562a9f2be1e3adcd7b154

SHA1
79d13fcef9be95284ad16345fe36f69d54023661

SHA256
99b43391c1b2af30587588cc7ad856a01ac4c3b84287cfe5fd5e921e87ad9020

SHA512
758c314eda04298e5927424778400930c6d3b6053310443e01d4804a71d9e5098cf1f7073dd63a615c0f2004567e36f5a7575f9fa4354f22d59f341ec8be8ff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd8799c4ef5939b1dae7dc913d1c8822

SHA1
ef13d794e77380c26badb994c28340a58600eb49

SHA256
258d3a9cc0870ba392e5dde7712586c3717f887c1533b0de9d5f984ad9abe91c

SHA512
a790ff4044cd05d4c352642859cba88e5bd92cf49979e1ed030ef18baf179035ff0720ee82ee6a99c8854490f7f7a53ad22bf28e23a44a0fc00128e2b2598efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d19a45a21c7ebf797d66d65f29b3b272

SHA1
34914ec0c1d24210c8b645da3c5abc056a0f9b51

SHA256
bfe7ec7b48f8041965ba6eb1d8e53c7a7d837383fe6e9c1e4ea7124140b8c43b

SHA512
9b726463bf4c515fcc3c4845a9d06399a18b0d69a53753ced5bf51271bc943cb22a008c673146250431917958ca8d978cc00b6280779ff77e980a2073816d5f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a185acb85b5088c2ed9fb12dcc0f3ddf

SHA1
8ee3a43a0fd42e95ade0066eb55022623ed39ca7

SHA256
ac00b9eeb6ad083a1c1dd4aa90cec2edd99e85bceb2f290bbbb355fad483aa29

SHA512
a158aee9551b8169810a827b8cf774c619bf06bb0ddd95db7322f36cc08a8c9b494e8ed927c28f70db95f2c477badd5344e045d3969df87539372428cd6f7793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
284e514811eee553170e9592abcb6a7a

SHA1
c3dfb18f0613a5046c570018684ff6411a1de2db

SHA256
cf785f63338ab262e74cdc0f3df08e5cc5c559cc1aa68fd128b72752b5e98d11

SHA512
7bdd2754e0dc9e95a16763e30a9822a2e064eebd0d3cf8cc445d36913673c0af5dcccc58cfa69c65bab3fdfcd04dc38b264df517d6b1e873df0037b0b1ff0c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdd8f878c17c6847b5145d82663c9d4d

SHA1
58bf1e43f5ddf9f4c0e16aabde5d914851b65f39

SHA256
5d8b94dd3d3bebfad85b4b7fbc66add14b3ae885ac2e30590a191297891e3e2d

SHA512
cf22f8d0f84b439ae39211e093e981e5403e829f39e2d2e98ef78983fb6976ace24aabf05e4866fbcc64f06c43a4b37661144073612f59d32da50805f086b503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6c53cc94fce9e11f1d223d115ae3745

SHA1
4bbd255e70331d48f07eb0ef5821d09e594c391c

SHA256
019f1d81f9d8c29a3163d845e023fa0b3699f04bed635bff1bfd5db4f86c777a

SHA512
30dae7e77801bd64201e93c5972d0e4127464e8143ff740c0e22efc8faa1e0ab79843624505ef28f6ac1b9bf215a674c146b097dff547362e1001a27cafd1904

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab677C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar682A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit