ef86c2dd4baca16799c787facb8185889fc88a10eaf59523f176215e802f1f4a

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e8bb4a050868a59c71fb26ffe681c20.html
Size

119KB
MD5

1e8bb4a050868a59c71fb26ffe681c20
SHA1

1489221c93d740f612a73d7b4a98fbf86a2da681
SHA256

ef86c2dd4baca16799c787facb8185889fc88a10eaf59523f176215e802f1f4a
SHA512

2f640d7635cc80463ab00ee16898cc9176cd81dc6a37a8eaae6340feb45a9320dc4f60fe219fc191049673775fb8c861f81fb5fb5b38de6cc62ed7d8b443cefe
SSDEEP

1536:SuAyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsX:SVyfkMY+BES09JXAnyrZaJQ6go

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4102B391-A308-11EE-B8EF-46FAA8558A22} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000fd5e811f91594faab9754af4fae652c3289e1a29dc255cbf1149b150b91e98b9000000000e8000000002000020000000465df4c88e2a645a587674b7ccec101b56f013d675143aa32a506444b9377fb6200000007623be5e92057e2e1a15b961333f27bbb9dee846f9f1838757f3e23934514dd84000000013331ae8a68249ee8f91b73cb53e8456aa6a4ab6788a96afdfc8556800d3ea15516a056ae459176ca90a77608394628159d251d9bf4f9f1b4c60d31830304a02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ccb0151537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ef90f2be9be576eba3085fb4c4e90aaf2fc843b6b2e5768a5db6d25f46901051000000000e800000000200002000000026d5016da876c72ac4987e85165211fe4ee2c05a10db88c258c6ef410c17783c9000000034c277f4ed9b71909eff77e81dedf68774bad2f09ef4bcb69b698c5c91ffbc69df98d6d0eb7fd2ed2eee06531c76841288f8428992c7cd5cd0ff25b92a8518fce6951d593e6c88dc7ae764fadcee9dec86eace70b2adad76f621ecbce8fbfbdd31caebdefd7a74299c69984623ac5a63c60b30a65441ff847e39cf2d3a6e76bc734392182ab2c01393794183cdfa3ced400000005193a96ec2ea431d8718e870661a149219593908f29addc7e96c1e5eb25681736b84c6700babdf6e85cb644ae4d0fd7c07b547288366b6a5a9fc3b3d68550036	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409658515"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2404	1644	iexplore.exe	16
PID 1644 wrote to memory of 2404	1644	iexplore.exe	16
PID 1644 wrote to memory of 2404	1644	iexplore.exe	16
PID 1644 wrote to memory of 2404	1644	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e8bb4a050868a59c71fb26ffe681c20.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d1eefb10ec93fc1b485db751ad7dd04

SHA1
6d488c849186edda9d4f3d5a502d9f5a716abdfc

SHA256
fcd4ad3c50ff0c92639c89181dad114a07ce453e1fdd3c2dac88231be4cab2a1

SHA512
f30cb740f7ec271b463babe6f17f16984683c4a861f98401e1095c77edbc318bc77136292eaca8e7031feadbb35ed6eb01c6e8af06d23c8fd7f42c229ee28be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb4950d86eb5bde55b850b6e7998967

SHA1
d1e4e56287d325c630bed9c7cd1e7fe91e917aab

SHA256
66d734f93a1f4a3c270534dec08fec2ca7c98091b280d42deeced87d7aac3630

SHA512
0f59e33271b6042e5d02a9360f4a2a138eb5e040afe904ef5580e5c06569fbe87a6e85ae1981c7960054f21e8838baee6e3e628dfbabe6dece0ccdb10d9944cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b37b42bfc1ee2c8a905e89a2f68fcf81

SHA1
7f7ff5f8b209b389dc869a8f11dee97cf0e80fc0

SHA256
346ff3e83dcfb8fb931f36404218845442c2abc505860e33da611f7da04e6d9a

SHA512
74db928e8c42c9e510d2dd4b056acdc1004b5bbdf5ab971fce54817a564f25a1fe980b740d0844c59b7a39468ff4025fe406ea2e62149722c905436e2fa70fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9067dba6223c53cab01e56d686f3eab8

SHA1
9346fe954b32a487b2f596a6490ae88db1858e3e

SHA256
6dd40827e676469a69c3b8ea2c008a9a0fe16428699478e3a3087535b16f13d9

SHA512
a822d5e6f211018be4e7048e6e627590c388bce0ebf46ca2583fadc763bbf07448f98e00e6d4dd219db2a2df7a3d27d4fcf2b456f2604480b51cce42cd888b97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c73a96e58a5791ac829168b1a6e82f7

SHA1
e4ab84dc1aa7c12b93a1f3cfdc26535a325c4f4c

SHA256
de2847b2dbf5ea5a24791126ba1ddf03b041ff08b88c054a3928d31b1cbbd2dc

SHA512
e7170e02623c18ae56c95eed6727495b990a0b938feab142657f9962aefbd392baebb26fb9bfd524c26b85c459baa4bea3c42fd2f23518daab2a2ce201efcb19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015a236412f5f59e081f9a8319757121

SHA1
f3fa4f298e8b142558c97d42a48faf9cdc305b8b

SHA256
f2bfa0264beff57adbb807e6e8e01bfea9782b03e8fc993a20c5a078874eeba5

SHA512
2ba60a8593e9bf59271425b53fec2fbe137447ead8a867715c648ebcd460a6b54fbd96cad38b5c49015d2dce40e81744937eaa1e7da7561d0c3182526aaf6886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5853deeaa97258ddb7783199cf1e0211

SHA1
dc1d669564a662ed6ae69bc8e8008b51b192e653

SHA256
cd19dca70d7ad55585ed438d3f7f56f0e1090a21137e1be565975ce143f1f606

SHA512
aeba004b4f45d85f85184c663adaf713c3ce5f143e7b26e6060fd1859882583b61355be121a980e688519117240ab75df3c616c67c30658def150d2a32a4458f

Download Submit