20d7986249f055040f42e68d1d6ea9389649c470df60a6eb2533466aea2d53d8

Analysis

max time kernel
79s
max time network
188s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0439a4d4e26d50ed8707b64a691d70c8.html
Size

134KB
MD5

0439a4d4e26d50ed8707b64a691d70c8
SHA1

b3fc0bcde90e2e7f8b032be87025e80cca4df030
SHA256

20d7986249f055040f42e68d1d6ea9389649c470df60a6eb2533466aea2d53d8
SHA512

0b29d72cf4e8ff1d3e0c0a3164a95941a8521fe789a9891cfaa34d9dfa89ba8b719069e64c72b50b739e01d4f264131ae1b19af7cffe2ed0a1fcf705477f05f5
SSDEEP

3072:Eed6c/dvtbUPcyWozy1xx03orIaECqoTlj0me0Fle6IA3:btbUPcyWozy1xx03oEaECqoTB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3850981-A43B-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
792	iexplore.exe
792	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2856	792	iexplore.exe	28
PID 792 wrote to memory of 2856	792	iexplore.exe	28
PID 792 wrote to memory of 2856	792	iexplore.exe	28
PID 792 wrote to memory of 2856	792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0439a4d4e26d50ed8707b64a691d70c8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c9967dec26b27c73158bc6bc39b7ad8

SHA1
3312adce88336c0e5d7c7ac6cb20e5519907cbd6

SHA256
30f6bebcb8c816f0d1f60a9ee2cde40be2bf7c20e69154e08934a4967f056bfa

SHA512
ae91006d21c22e6e4216807763b5d14c79adf7c9e72f0e3e28d16a78be0969c0dd06d7b3f3999f9fa182d7c5e354b2ec887d24ed31bb55d876aefcc4804a4dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8740143a428c391920e9fff7e8161ece

SHA1
e6b6f9374feb3aba85b266728c49d629751a9199

SHA256
cc96e4c3cba90b7d98db595dd6b2fa4c231c5ff7a5e363fa8a0183b2c3726a9d

SHA512
3ea7c814ca9d35a44e8f360a50de5d5cc2244e018c30cdb2df9c402f2074f8532c04a4e27c890cf320a3c910e6ece984aef6053d03a441b7227e02fdac220bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3515f4649915014b8cd8cb9d9eff9466

SHA1
063d527675797b79b6810b3271e78924b5ce0382

SHA256
1a0aac0aad332032a1697fc098d8cb81aea17e375fb31fd963aa7ea98080c170

SHA512
6a73e7c98b8e57feb18f417e87f672fe3694075820a365f97ae19809d7efe923ff5869dc5f6803699ca458c2d9c342ecad86ce2569a8c067247086496ab1b31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f5ca2777827ca074ea39f8509ce2269

SHA1
cc2a35e19e0367a325cebcef464f383755102a5a

SHA256
ceb79c4ab62170476d4fbff76770d762bc139e318eaebcd3fdcba06596c398f1

SHA512
6832c9c1bb54a10297d3b5f16dd2cb1f6a70e42cf2811d41fe26b48501347993e7cec6541def208513aea7241d8d66687c12c56e98a834bac25eec980039b229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc08cf39c69114441e8139b4618fd376

SHA1
1024ced57216db824ca13cbb601d669d71539621

SHA256
ea2542f83f280d5d069111e5bef1960fad12859a255e306f8cda4d38eaed41d2

SHA512
0bc5e7b5372cd80eefdd6aa8c402ae83903be0e010f2bea85874a8f59edc6dd9a36125ca3c6f95adf4d9bb3a45fbd73b1e67aaa938e3b7e98bd47901c68717a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40d5b24b2c13fe961cfdcbfaeeb52ee4

SHA1
f68b6f4291a363376bf5997237307af56fcab62c

SHA256
aedfb5a4a636237a5614918cbce410fbdc0e25f7bd1d4c190e9743b899be14d8

SHA512
fb87b6bc757037dbd080a6aa5255357e6cee07612abdc6d9e4f915987e51b702f5da7f6389cb6bfbebdda8331536e23a8244f0c2a670efbb2a14fb770fd87483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc0cdebd5111dc14cb74c81abfd19991

SHA1
a8c373fc4c78762c34238fbe4debaa5e4438fc80

SHA256
d1b67c12887c493ef8e5b8f375a974e990a613d117acd159c2ab87d63b0b84fe

SHA512
698cbc4ef8033df22900d27a49abf9784edc80b2f723ddacf635974a8a03a73d005ea056d583deedc6a4bd4459d1570215ea7aa20b470ca372997c2c72c9cdba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d991bb285273bff18bb88db5087c7c6

SHA1
d85e803c088a1a033b245ab643d65a651fe0950e

SHA256
af04ccf6c7f83837119c90ab22abd3ad1ae1ca99dd9bbcaffd21a8f66f3c5fe4

SHA512
b63b3de169d465131671aac4f7023900d433232ec5ec0da94653c5e9be555b0714c130146b82786679446da9e0343b688f89a41cca3973e0eacf26756ca71db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d67da4986d5768c5cb1c75bed65dde2

SHA1
5996aa910f0a61ffab9698e6da2dcfb898c82b9e

SHA256
91089ec5180450888e020baeadf4e389f866520e3270bfd4e0712c18ce8c6503

SHA512
f245147dd1381b9729a988108b7d72054ae08991e82328565b407917dc5794e41e0dc233ccc572130cb3935d154ace39fb4f92358e002c0f24239027acdaa57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA1F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit