dd3549f18cadb9f43ed80cbf6477a1ec418af41ee047af22cb971557f0091fee

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d5e2d78ccca22568f8f373e01369e88.html
Size

58KB
MD5

0d5e2d78ccca22568f8f373e01369e88
SHA1

bc1b2f4668f740a72fb6965c6eb2ff7eb54c0a65
SHA256

dd3549f18cadb9f43ed80cbf6477a1ec418af41ee047af22cb971557f0091fee
SHA512

f3bd9df009c07181e0598d2d43fc2faa979618b3ef125693a82d52fc98f8596db3e8bd9debe57757daf59826a9605373bfae51b7a69dc27dcf803aa94ec49851
SSDEEP

1536:gQZBCCOdP0IxCYDBMf0f0fMOfxfIfMfkfWfofEf6fvfjfwftftfSfqfefRf8fOfZ:gk2J0Ix0csUOJQUMewMSHbIF1Ky2JkmB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2094e4cfb938da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000092ec42b6317d32e7d4a999bdce586c1d05598c596aa05cd930839dea9818ebe1000000000e8000000002000020000000d3535809e9d74b7323d5998c41484869438f95b7f9d70ec82b4276111ca411a920000000af97dd217e0f68b1f5a84e7020489c05daa41fc22e6fd4e4ea800b36edfa77234000000053b22325ebe2d120527f9450dbfbfa0a3327e835ed9431c0364acd13df90a53fc7f8ad2d54738dea4d092761acbca3c329e48b7db371c90f18e5c88f31832f7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000009773449dd42d0b8b067e076100e26a6722b250eb0aa286f2ef66ac2dcc4b8db000000000e8000000002000020000000ce1786a440e7e8dcec85265c5e48a27b893d060d5b6ac8413868cf5ace9dc350900000001d2e48ec473cbdb6c0abb0e139bf9383c283132dd8e047351c943a12a8380a80716aad67e102ea0c60dd4545f12b2543c78937b80431823fc73b9a5524f89a306049e791ea3f2c477c05795fc3b2566ff36020e215bf3bf8bdb1523787968d6299c8dadf61c7a02872c92c5091527274239119d96b1ed59fbd167b7cf85eb830f431c7ec4a07f917227f56c741d681ec4000000038d0cfa1569f2f4b1152ae9dc8428495b05b6b77841ad30113a7f1e276c3e8d8447b6060073dae141d00f166a5b3c5cdb2949ff103848305de82419d222ea309	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E24F6401-A4AC-11EE-8837-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409839182"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1672	1768	iexplore.exe	28
PID 1768 wrote to memory of 1672	1768	iexplore.exe	28
PID 1768 wrote to memory of 1672	1768	iexplore.exe	28
PID 1768 wrote to memory of 1672	1768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d5e2d78ccca22568f8f373e01369e88.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b87d1e3c5f5877810170de2507cadbfc

SHA1
a8fcc92c20ffd75d682272cc5d248f45a3894ef6

SHA256
593d5da759d52179de63ee6e47fd063fdcc74b9abee998ba51a47ba8c25df27f

SHA512
d858e69ecd68f1ba9c2b2b23891cb02c8e3965d768ed9c39b8daa4cf4308a1074cb2834bf098a4b39a2fd0b32377216f954e1b3b4316bad276c99ef8e64bf0b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec2abad278bfbca8343e0756f6cbae5

SHA1
2ec7940e70b4f2542c71ffccab7b204afac099e7

SHA256
c0139c845305a71e1b46b88dca6059ae9372ad8056f078ae3f8c858ab0ad6ac2

SHA512
7873b37734a9f4e3fe4bc0903e65f29671e0311051a92caffd64997d0a25a558427487c3ceb48b98f1908f50988e28fcbd15234adc78ce2784f656223a96c186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d29835cf652269b402014a3506e9cb78

SHA1
6d62556fc677b43c4db30a12041f9de1490f11e3

SHA256
6ca0e3f4f863918fe604382ce905f18bf81daaaddf03ba07d623b1978b26dbca

SHA512
828c85dd1c3a0c611a10e86574373c190534bd99012bc014a6a8302900b52b40228fc4afa15b1c03a82e2b41b8d24e5fa99860e2fee056f075376b7639d8e44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16c44f9b31206a2794a66b340733b1e5

SHA1
eff21282928b2efe11c05ea9b0a2b0b73d400b7a

SHA256
66fceaf3b5ee7c6fedba27d8162446d5ebbbbfb8338c542d96e5393fbe4afd79

SHA512
d7108328c08335879869590d030cb9d7ae18424e6bba1a64e258eec28758762969fb8d56192d150d3eb9c6d1b1c7dae1af6a7538c9784a14345f7d62c20b1ece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410f484587b7462574fd387b97596cb5

SHA1
cb76369b8931e34771e44b22d70e0f7b94fa61df

SHA256
956a37c46af02626089c20babef6d190d195683229fe6f15b236f93095f5e484

SHA512
2078221cea8fb6d1e8bd6a12dce9da45203ec9e6c69691f5bb8d8db3a0c0e22ecac8fa3b63bc43c3dd59dbcd27135aa34699038ffff60106b3d47ef7a8a42d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab120C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar121F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit