6748d8ecd20cb131f3f647aa52e880f5d7340e0a8ec6915b7179998e77c3e024

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d6acba448d3fcd2f3187a611e149947.html
Size

254B
MD5

1d6acba448d3fcd2f3187a611e149947
SHA1

c437425a74692a4f2bf3d7dd2931e5176c799682
SHA256

6748d8ecd20cb131f3f647aa52e880f5d7340e0a8ec6915b7179998e77c3e024
SHA512

b32623fd68cccf18a65ba0fd7e1cd60204d5a2a247f2fb6a98a1477a57768b1ea6548ebae9715fdc768a3939f8a37c62ed822be17c484c95926deadce873ab13

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000353bcf758196a4450674320fc9076ffec03dc59ea9732f1c6306eeb98f3f1750000000000e8000000002000020000000e8df8bf5103a52d7f3ebc7809e7dbfa0e7de2e3af730a58ea8c2d3aa27ad6898900000001cdc63b1dafd63d860d6fd6a60d83825688075b81cdcbf2cfe15698de9288040a5f8c0da4caa4769b5cf334df417c0a5b9760f24a3daf4745e68cf2b2db62cb9240e028a13c66a142fd49213c6750240f21db1adcacff48f7debf43949c2437ed990fc9d8fffe8cfd5ec1b1af04de175d13dc6d176dffc12dc6fd2dcf11e41c2a33244a0b91e3b09cd85b22fba902868400000008f7c0fbe58dee731ecb8cf10f8a63c8e891c653ea26ca8140fe7f4526d2be4aef2551bc865b5f8bfc997e7e1b561a1b15b4d401efd470f5cabf8f143a91e5f0b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409656202"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2B18961-A302-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000004bcdb4e8261f56c81a444516a98ac8223f34664ed60a0a643f2e4e3551a58559000000000e8000000002000020000000ec24e72369d0a10c7ed0a8bc190f0d9119e54ed4ccfbfc09665372165c65429b2000000067ce9e30fa546373f43c04bb39da2420da1aba33fd3d8cf8781b40122c0df9a9400000008a985325b6f953aaa5b2aac1a5a8fd4c72f8739854f26868b9464fc9bf0b6d2d1c8cec316787e90c3f15a3044434619e2e0af4581b34f9e8c730bd48a4c9e6d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ae32b70f37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2208	1716	iexplore.exe	28
PID 1716 wrote to memory of 2208	1716	iexplore.exe	28
PID 1716 wrote to memory of 2208	1716	iexplore.exe	28
PID 1716 wrote to memory of 2208	1716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d6acba448d3fcd2f3187a611e149947.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12ae82d2798763dde0973c5cb9779aa9

SHA1
739407fd980d6baf90ff01ddb5ee466716f891f3

SHA256
1fb58999f756f5cb6ec8cacbaa5790bfa0b03b7f721f6c8e89d68291c5108af4

SHA512
f2f4b55fd619a6422d77693c8d97697144a68e0798d8867d6e464728778b35cc783deb1c88c9ed985868796e8e4713d783051c432767ea3dd145975f7f8e0c06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db95912118ae640b6b1da19d78bf73dd

SHA1
c2abaa5108cb4044140b0a2f6281c1da08ea5674

SHA256
8232e12ee67c478306f38ea734636214104c3f11f8e1a08350e8437e456ef6fe

SHA512
d1f115a5a68a82376cc8169c7159be0b4a72c812d7cfec841edf26c8cec14c27272c8102d473c035f9abe408ca2c9125482bd21635d15e817e86332b5d615ebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6c2dac5068ebb99b92dcf87b63ac09c

SHA1
8f9ef3ef51f1681bed314e5d3226d574153fde30

SHA256
0de75a0246445ffa72c438962dd8fa9ec7ce714f3c9bf486771cba584e9e36d5

SHA512
086a17a29ac9f54bae7ea7a25bc409f2c23d3ec5f87bec9f03b6de9faef7569c9a832e762e83dedda524ad4b5dd66bb7c06f811044dd8e05b490a9a8c281faf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9e6ab8579d8dd2b45dbd4d5043ebad4

SHA1
42c34775d929452f08942fb15d7acef93627d15e

SHA256
0791df21635cad602fda2df45c1560b5ddfaecdeed20b25760cfb0fd409349a7

SHA512
266147370413081f30c64ce3cdd48027b80935cb6ff34c20c107c08fc26863fdabbd89488d3c8ce1da82df426ab28c6722ffc00f654adf9e1e7a22b97ca7354a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6893bc3426b6d84778572215c4622017

SHA1
bbaeda55e6eda9e01078965b960812955205e194

SHA256
ca1c9afcef9f6f6efa48a2056283f43da0b614d47a3a8df7d86bc7224d80ad3f

SHA512
e68ac758d7acf67e426761910002eea0dc3cb2c02328c69f513d145d71ab0668c63481f0631ef471af94cb1c933c4a7fd6712c3ea7f5ae03581e6af95ae2aa01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0e5f90feba8b38b6e56e9dc4ab97395

SHA1
5e12a3d4d09fdbdde3bf3709a8bae426d6d67aa5

SHA256
541a4a803c92489f102bd023fba285baa9f05289f8981786889e9d0be1173c59

SHA512
aa06c4c9181f857b9259b2b96ca9b1fdf3db9102cfb45a2b96f68d4e7483ff8023b23ca4bd924acdfc5d62feaa373d892ee1baebc6274173d5865ebb6c355780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e3c553576c9e387168322e368be1cd5

SHA1
61cb168f84f5693531aeab1b290a293925b59bd8

SHA256
5ec24e13b53f57ecc60d76dabca7c10f8ee8f18a9cbec7972105200796808c0a

SHA512
ffc2f766f9e6af43536a22f96b35c883d13213b686b3f4cbb7db0333e3a105ead0e26360993ed7817ce93eada03c90fca72edc63181ed965879d8c69fe817df8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3249.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32E9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit