dc590f65d9cc3f2de687255db243e89866cd2196ccd4bc2470fd8c5977e4c598

Analysis

max time kernel
138s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ff7d72e2d599995acad6f83c67e917d.html
Size

9KB
MD5

1ff7d72e2d599995acad6f83c67e917d
SHA1

702d78bc10727ed0b42e0338586c2be9e5c2eb67
SHA256

dc590f65d9cc3f2de687255db243e89866cd2196ccd4bc2470fd8c5977e4c598
SHA512

ddfc83a33102d1ec9e4ead3de2a6da143faa19d8a553549dcaba3a3f8e2614cd9fa3e41f7ddd97cfc6e7f052555f5a241c0e0579a67242b5ec17b48efc2a02d6
SSDEEP

96:uzVs+ux7X1LLY1k9o84d12ef7CSTUHGT/kHKpU6+EJ3G2wMxM+GscyHb7Utm3GG6:csz7X1AYS/WwVJdtcyfhPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502fe891fc37da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA2D1521-A3EF-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007ab6ebe421a00b28ac0583647642797ef6e28197f76d774842e3a83c9004fb8a000000000e800000000200002000000017044a8e25da0a9f9562299831e8977a3e162b13fa3b090a48e4df569fa6e094900000005ef43c2b2f52b9d931ae7c18c8aa430fd1e247cb9704b797fd9fc9b1712ae155ff6100ec252f8549010045ca88a34b6aef1d31738ab5279b72f24451fa1dc482555a8acc83967b1d33032b84c297542ef96c0aa5b4b9386a15fb47a3bbc2a029affe7b7a885165b6cd930f7b57124d49ddc2c59aaec089a285723e9fc0eb1d9fa8a4977093593bcacf3d710443ddf2d5400000001915e7bba8de821b81d0764d615ffacd2dc4a1d53c1bbc6a98b8fad3bd07c6ad441a5f9890a482c0a3a8d8f37430da71724eb633cd978807c9d61bf65ff7ff96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409757922"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004527137458787ce4f5e9c34ad31543b77e6dfdb56536cfb2a90df222dead35c6000000000e80000000020000200000003bdd70182b48334f2b4166903016a65b9174f849ed354bbcd1af8aed5b8d19112000000047117c618beacb54bf552d8b70787d4f69e62ff4e61770468e392fef2de89efd400000006c57c5003a30af62e9b4eabfc0712bca078d2d4b4cbc954bf55612ab8732bfbb2b115be36d44fa4256452cd5a3eff5e80a367410f0d09295d6d6379151956445	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ff7d72e2d599995acad6f83c67e917d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41eb71ffc48523bb515d99c278a49052

SHA1
c29f3a5bdfe888beb3667ae8d21d1783bb0817b7

SHA256
64aed5587c7497d431b3e7d7070b62e048252e3791fa9a9df8894fc32f1487ba

SHA512
56e6b59fba40630d30e2fe4884a04c49f33c7c010a3e4663a32466ed05f72d347446161eb774559ed0361047dd29d39818cb327525dd6ce945ceb09a87dafe5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b563153cc989b2410467d5ba1b44982

SHA1
111b1800ac6b6460e3ee766d84d573113673cd5e

SHA256
06416054fb084ff85ea553b1d7d5fa4aebf85f88ab63c8183b381fda4180474b

SHA512
af427f2b1ae7f2f7a3f788eb151ae75c415a29f5f7969683438ee77a4b6e91e6df571c6f82db370f30a8f6d394a300d321aedc2399e141ea0fa2e26bfa2c1d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
320ac0c939cb2beec816d8fb0847a480

SHA1
44f4cb7effdb711d4bd496479d737ddfc99732c8

SHA256
a08335626b711293bab504466c8bca53df868651b6f710b8a17b34ab3d4d6f97

SHA512
c9879065e4c0cc4ce0e4f89f11d857f6b4590d8ec20667fecfe16a640c8102a0a6a3e5fbec9cb0670cef41bcea82ba7a3885b00494c45dcda3a7e826d062fb06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16dd8a5ad887a0a97b247972dee3783a

SHA1
c513a8f6174578794f0829e0a4236fcb1da24a9b

SHA256
c2e0c4e77a95bb566c509260c8ab5a7ece19500ca34572effe4784bab42b1d99

SHA512
597cb4a9914ded6a7289a3a1f34a70e42570c1dbc381295c0f4981e2cea36cd2d7aaf41e581536bbfa9c838f824024f4b139cb0114d37be5086acd10ca3a75ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cb6305121cb7f7ac10c3a70220aa4c1

SHA1
c4b2aaca55aed6a6ae148700ecf772a22b189c13

SHA256
01ff6173d3c4263749e1fcde71b12d96272f50ebc098a0aad53a091f5aaba8a3

SHA512
11d11ce0aa9f6869d5a63b399fba99f5a859c042a77d090fd254959322ce1aa42ac7d5a23712874e653b339de9132c9e7c23a68ccb184e0c4627944caad665c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d3c31987efbb9dbb2ca43a18ba2017

SHA1
2bd25dbf4a5c04753d1760b8e9253f0f2a5b65fa

SHA256
20ecbc8ab9259816338cc1e89f9ef431b40cac1a7e71be6b95d740934a5f6552

SHA512
456f310997688d7467191610637ce16af982376ffc27043d50c71eb375cd8b255050946148e1ec8b6f3308bb12ae12bd506cbe9824c1364cda44b13b9483d033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58f9011d2def838eefbffabdfd2fdab7

SHA1
642453db7331331e3180dbc312bf4fc2480fc0de

SHA256
124eac7dd569aecf907e68c0527768501dc83e49d2b325bb49cca243e341f29f

SHA512
6bb09157c435af7f6ebb025bc0c5269428ded7d2278b0aa53ad4e8000fd10f61c5f8d13f4222027cb48347bb411056013e7c9c458e9c7c4e9191a0f6211aee50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc3ab7e13dc7737f8494942b411417b6

SHA1
f2e375a9b6477756ce18c33e02cb7ca098c7849f

SHA256
5a3a3b76679e5eb48173817c8d1c1e598f6c8249d087c673956b1137cbf43881

SHA512
de7a7f9364711e14b979552a77644899d553d4f1b7287dc7ec3d0ae2725dc54a955ee0d552d8e84c242cbf92fcedba517fb95e08f33d7fc16c5ff0a7e61a0625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
733f7c52b0d0c9a601e5bfe7ce358cdd

SHA1
73a90dba2d7de4e2413ba323e7b0a9d7ec7c39b9

SHA256
afca2f27c11e899994b33ffcc257eaf41a1ac528a25fcf6c8d4f6d66b8c5bc60

SHA512
bc6d901306ba5b0fde399358855fbe8ab9bdfde9da37f5f7803b7418ff4690f707878f31aabbb461fa04db1b66bd7fc37558defdce15162caf9dffc13d2cd5b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d500bfeaf6416c40516069eb8036f75a

SHA1
6cdbfd3f8cb84591ac13096ba4f4461ccf11a50b

SHA256
49f9af77dee272d1a67d47ca914c20e90de6cbaa023cbb27a2eff991e366337e

SHA512
1972d06af5bc647585405d7cd7939628b9905ac069cad427584a78bc2d3eb8938f4dc9d08d2ea38eac5c2afd23424357a4bee3cef89282ef37405b720af19f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAAB4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF77.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit