e8aa1fdd3251ed051e4b1b9a590ed77e5398f1dfad2872244a00c759b319d756

Analysis

max time kernel
54s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007b5dee849433dd4fc6a76e0671b47c.html
Size

57KB
MD5

007b5dee849433dd4fc6a76e0671b47c
SHA1

83c99e86f34cdfd0614370bd6b829d1eb118c727
SHA256

e8aa1fdd3251ed051e4b1b9a590ed77e5398f1dfad2872244a00c759b319d756
SHA512

2c9983617a958737bd426ff0a491a09a0e2cbc6cc4c63a8a2218dcbf5f4c682194e3131a2fa3320ec550c1e2fb824842554a4467cb49771f981f9ba5113c94c1
SSDEEP

1536:gQZBCCOdR0IxCqnhUfHfXfufifKftflfbfTfqfIfcfPfqf2fGfAfkflfdfefKfFo:gk2j0IxQ/P2aildzbygkXyu+4MNlWS9o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{369933F1-A3FF-11EE-87B3-6E1D43634CD3} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3008	1752	iexplore.exe	28
PID 1752 wrote to memory of 3008	1752	iexplore.exe	28
PID 1752 wrote to memory of 3008	1752	iexplore.exe	28
PID 1752 wrote to memory of 3008	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\007b5dee849433dd4fc6a76e0671b47c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a97400ea400f4dd46ac86eee01636449

SHA1
73ccee8ae0ce7b46e619f9f2ba45dec3be470461

SHA256
ea27b6c872d4add5cb95f4d79a4ef37b225b2ba410ef179b76db6b90543a25ee

SHA512
ba95adb45d9ff9f33bf46c566476d18b6034b676dd10bcbfe56e02bea54782836651ce15c5ff9bdf37b825a1351e444ec49123126c8109cec8b60c7d725f0c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2c312818e95c087b660cc5950df1c48

SHA1
df3254fc1038b37b9c0fdf451d4c4b8e0f5a653c

SHA256
59d76be42a1162c32386d4c7ad5029f473c184e697b32d2b7387f0dc54979a6b

SHA512
e5d5537cfe2d0a83211f93902a52bdd4b4fa90071b5fba976f7f9f7591ecf37a9c7407dbde66eb9af14063692d08d997961d748eeb1a30435ec24fdf6a204e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7ce4b60f948737dc040ebc293ed75f

SHA1
6f1f851f3925ad8e33410aab589164c6c20da771

SHA256
e782bf216cd0ff94e930afb4b4cab08e27cc9e050018d491a17a3254e5015572

SHA512
c5f79ff8decfe2c461f1c5410424e39f10d43985258982e1f2fde85c905137d85b8d4665d1226c6f094ba1c00e5be6e3eb214d70aaf336d0d1a44c5b86c0f100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6094b533c59b257c85e51b25daaaa8b4

SHA1
7a7f9ab7e21bfee18253584c9319e0f70cc6c225

SHA256
f1018521007907e25054ee27d7b49bfca38e4d44474b97c762fcea1302fd9528

SHA512
ef4dfe89df0fd17ec1d80707a3618c0900c663b3ace65131101fc99cbb627a51538e7567ab3453e81556815c0056bd7689a87a03114c94634be06a7b59a8f103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a27cda1f32d75c44fe2892355634ac95

SHA1
47b2d574d15f632128a537b853982db06bcd031b

SHA256
58faff7053aebe2788b41c4bd603b6fbe723a7a98adb00d19bb3504e2b4cc189

SHA512
d1944a1d674fc7341cca6af9864cf613ab58c5b963cdbdd9a29421914a7a02e7edbe804169d6f6e48c9074b0ae877dcde18087617769fcee8ecad75dbadf8c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7717869d717c8b864b5e47e3a57236a

SHA1
5fea864eb8c5f7c5726edad452f633c315711e53

SHA256
ff9285db885be7e0ec647954fc314a613356691f80adcb1f9f044256210748b3

SHA512
b1a327132a2d7a72bab83eb2c875ddaa37d89f2407fd86dd9972bfe2be9c9d9cf6cef55b28edc5fa6661f57303443ed5e5fd7e9a9aceccf4797021cdfb488969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
478459d2637798d1dcdd4d1e3bc5cf2c

SHA1
646405d0d70c4e6fbd33f9304c8ee12cf1b31761

SHA256
7a287f286ce65c7b7b2b4fb3c20015f72140bc030769ecf6bc93958da92ee4f3

SHA512
42455584fb933a5b7409bb95532fd3a47d125f7831ea3880325ea0296f29ab78e31b1696494bd58b757d0bf321ed5eba8d84bc8436c89ecad81188b12b505c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0c1fa682a29e4f7b936d4e7bd3c68d1

SHA1
55a7dcc86e5ecc56567543afb425a321da45239f

SHA256
98d2a766d09cf1776dae02b7bb50da934b973148079402865c14b03facbae948

SHA512
028450cb567a07f0e87114e054acbe693d3967d290d2553cf7f1050244b160b09a4b43953e0b74bebe4a0177744fe8c66eacff91d5ebbe552cda42da89f7c687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
abb8e660b8f75ce24aebb445c9541c96

SHA1
017f33e03137d2d6fbfcbc02fbe8931c9a1d4c40

SHA256
e221d965e485e0e69c245ab3ae300b0c97e32a762e7fa6137450109d3b30078e

SHA512
f1e502a4c20955dcc702ac181098778753519e61eaf961d475a96bd37d61eda23d05a37040cba71bb5f525875d00f7b3a256fe5d12e6f0fb3b359b004d173c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3355.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit