e49ca22128b00577742c2ce39de287a17ea31585263f1ffcfadfff44800091c3

Analysis

max time kernel
145s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e92aa3efc0b842e285d1ec903cbcb0c.html
Size

17KB
MD5

1e92aa3efc0b842e285d1ec903cbcb0c
SHA1

3cb800ded77f0a484be4cdf60bdb39b3255aef03
SHA256

e49ca22128b00577742c2ce39de287a17ea31585263f1ffcfadfff44800091c3
SHA512

974ed52fcaf2b01903aefb8f42ee302e4b11b98f17570fe14a02b024e5aa34f8f02001fb46629cb3c0125dc11432833b17b5a048e32d911c76e2855c4345fcf0
SSDEEP

192:MoglIsrs12wtO4TaGTHEDKcUVELfQ6dc3rVw8k/w1wvqLkw1LB9euBuLbdU8d:vglIc2PtO4TaGTHcLfQe5/gRLB9eguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{945E6961-A3DC-11EE-BF7B-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409749697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2720	2512	iexplore.exe	28
PID 2512 wrote to memory of 2720	2512	iexplore.exe	28
PID 2512 wrote to memory of 2720	2512	iexplore.exe	28
PID 2512 wrote to memory of 2720	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e92aa3efc0b842e285d1ec903cbcb0c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da114084d799d794a304d79087cf1953

SHA1
de5e73d6b1aa746a42c34dad49f00c9a6718f708

SHA256
4b0f67f9fa7894e648360da654477bc1e6d363d1c69f4d9795ed89b00cf1e3eb

SHA512
af6945045fd42e7a99ba5d9a6b0936c65df10d30ebfae5f37db62bc913cda6dc57cffa4ba5287cf9deb61fe851216817a3faca7549f3a0895ec8e8eb4ea40f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
504a5ee9ac1162e2eb049993d80cbd74

SHA1
2fd25970de846b5fbc7c5de95d1bdb50bc0617fe

SHA256
e06dc76dada093cd6df6f789c71ef435ae65abb1802693679e33478ec04adeea

SHA512
b1dae8a9460b5e4e5046e67281f2ad8cb2d4abb88424df11849d36d09c988da71eeb65a2070d994378bf810e3406326ba568a4f4e75b078796a84d43cad2a6e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6febc9d8d8d86a516c77c9f0c220f33c

SHA1
908b9dd80d951704ad126869b0cb86b62d9de75e

SHA256
cddbc97394587b3ed4f9444bfbe1c79788c71e7dabf5fd975bd2bde5fa53cf14

SHA512
b815971d37204b430d5ab07777a5471ee7d743d26bc5d5272b018eee2b810bc0c6aaac2d363fb4ac59c206fb2ea91f3eb8da544f57e8925163a4f29fdcc66459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b36e3e89340b0a976309f7f9ec2265d5

SHA1
edb691b7204c1a2432febe80c792783611203f40

SHA256
2fd1c7622ff2b47c2d85485e6891a10d1f6f3cefbd097a562bb255cfa09911ac

SHA512
33b335bda3f34b5b90c8044e1f410d001070a827a043a01f81717a987a91a04db0268900c552337df9c09ca899f63244f31efd4fa7e3172d248fd6e3a09fae91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
447fe9baa6dbf4f80cd0f625dca72a67

SHA1
0956fd13bcc5ef569d8e6493de31c7bd71017e2e

SHA256
bc3949ec40d627d74243f7d71c49728ae166a12063967c5d48fb7ba9e0774e65

SHA512
33fda9db619e18660ce4f6720285e234b91cf4c48d57ab9e25205bdd98ffaaf058c72c1a5be85e597dabd6a8b9b107ec90f2c636c3d643918555f15b6ae4b8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2342bf4acd9667cefcfb2620eb8be95d

SHA1
304120f0ce8923dfd818be75dc0755bdfd71b26c

SHA256
aaeb5f6d9d3847dc252c1efd745993f4469aa72b25bbc7d40f24766ec51519f7

SHA512
2e3fefce06e9f3c58d9fb195d57b93d67527b8f1b7505b0e9abf845a8cd0ba7925d8cbed1f24731a9bf9357e585aa407e3db4982756f26b516d4217c821ff405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c7a0ee2e92e51b1699c98b95f1331f7

SHA1
c501afe3f494efae0e5b31a0d34bf4d2424c3248

SHA256
23de7972ad51db5dc7c12fa95c82181f4786f49da82819f4ce8191ef840f6905

SHA512
f0389462f7f86e5685b049579fd7210040129adc9f324cf7963b1c01979e05268cb13b12c2450c2529c03f9df0f91b92278ab2137220b112454a915c52af1fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a28b4f216538b774cb003f70e63b9de

SHA1
d82ea17099025652f915a6e42a8e71a09e654c66

SHA256
bcc6943ad50a70a76301480ec2c457e9c85aa41d8ba2d1362da4f3bb381e1fcf

SHA512
9bc263ad82a4a6208665d1917f7349dfe2ed14c9c203f635b2bb0cac6233d2fbf0355575f01a21adac9b30b704480b20465c1e6472aa51201037624871b8233f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab560C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar597B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit