7ae6545b9655b0adef0ef88276683d1519d4554f718ab33f93c27fee6747348c

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1000a3bf39f84aee17e79fdf2804ce1c.html
Size

77KB
MD5

1000a3bf39f84aee17e79fdf2804ce1c
SHA1

af1e74e1411b048d4bb3215f2e26ef578816771b
SHA256

7ae6545b9655b0adef0ef88276683d1519d4554f718ab33f93c27fee6747348c
SHA512

6e267496dc51ca404d60633f8c542877f46f86d522f548e4db04ad7da77ed70819946c9e600f6d80c3c8d04ba96bc40bdc412528b703b7e24157b518483b8494
SSDEEP

768:Q1hBwks4x4CGhB8hMUPVcPa0+9rxb2ksoNUPBUPVSGn6v28saNNUPOjNUPEshBU9:QuToaUIAUIIcUIhUIbUIvUImUIxoot

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68EC0E71-A4C4-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409849279"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f05c45d138da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000477096a3a5973e442d79313686ae8f91a2a5a62db2847e7194bba2367147415c000000000e80000000020000200000005d53125854ddbc75408568f6881df411e416939e2654ce058a6df8e6830d5b61900000001e1a5a1892b77e93ef278a474ef1602018b26b2a3edbf01f0c9ec95bd6b5a0547ad1b6c44ac9951761bb1282f4934fbd7a142cd43b9a335528b6164223c1beeef306891a999fa7cc80cdb0131be9ddd0c5931e67555709bb3b47928e25a8bb9f4a9219190a507deb038772a9bda8ecfc78f7836d0c7c0b54900ad7bc496f99396eb51034c869348668c8a5a41eec2e0b4000000016ed0d61bc069cfcc374c46a6b2b4bc8081031e55723c52c5209494363d29728484c06bc4ed759a670a49051be7ac35ae8d070c3f01d39b2b7e34554c402d6cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d2717ce353bd254d2401b1a84b17ab8172deddd6f406b9f1a1310b7ec4653634000000000e80000000020000200000000b8d862703dd6b5b8a11f92fbf067a00796d5e92a61fe58340d755284f797b4e200000000fe2601d4da94caf67e07e0beeaaccd094803c9efbab0320282f8c51bb60560340000000b35a7725d47127a11b2252f71fccf88145660b78838af3d6dbbc22e2b23c29be5522dfb8ace573cd49bbdd1ab4f6ef01fa6dd4af3e7a1267a18616b40dd581b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1000a3bf39f84aee17e79fdf2804ce1c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a96db9482a389c472dd7a0cbafa8992

SHA1
103ad81a812a0811bac4dbb01c1008eff7c1acee

SHA256
eb8112cac720bafdf7958187c2fe9d0bf3af2865b73b8756ae5777451ffe0039

SHA512
8a32838ceb0837f7a038208c10f833aa48bba5f92d83053a04fe43276ee9c793441a1c4fc60fdab3b9514b336370a9fe99a4c8ad091d36fe9b1dbf6734678789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aa695b0719accfb812ee74229bd3441

SHA1
6fac6d4ca99da40a1ee8fd49d2622d7c60a542d6

SHA256
c3ef5c8a66fad9a13512b60001583533020d8e12f8d8e175a14af5825deea401

SHA512
744ec776c21478abd5868d0409df2396a91557d4426321faf54cabe093aaf44e85608bc8a6efdfd6ad5dcef6a84df08dc5fc6a5888dff267f0f07a9a2f403636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
087b9a2e5e0f15e901da3112e8be514d

SHA1
560d7979d83de9129fd1149e7122ea490f9da1df

SHA256
c3d6b2eb38588fe06ecb50b0a4d570a8fb623e7d1113c48c76ae3f34dcbae667

SHA512
b55e280ea1acc48bce3514046f8869a5290fe717f685d2e17aba765f5fe75d3465f0f0d31f1b01510c4e0eabaae21e831f1921a3ccdb00b756d6c1ca68736ec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1296184aca51916983cb6c01386fa5e5

SHA1
e0ebd51794112c4f6024ea24792aaa47b29dc63f

SHA256
4ec370822430a720ea87a6208b3664b3af5e57ba6229eab210a9e30cfdc8c0b0

SHA512
960b99d7fd960ca2bddc3f4bb6c5bf6aea4887f108de04e3bcaa2a50e87fd624d27b4b2d4febdc851c1e048facd3d0e27d03f3335c242245b4887223738d2e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994156d03019a20c7263bdc33d5b6161

SHA1
826f1d6121aecab0411ba6ac584af8bd7392d9c0

SHA256
681aabbb20c90864837e34e5462f8be9d922953f9e585ff808a25aae17cf5c79

SHA512
47ebd71e205001563296d71774341e2ebe204a6c4f0d8dbbe8f2204cdc716aef3f0728b61bddb5342fe19c15a5c93ee077a5e1bc691ee03b0a8d9db3412bdbbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19bea2a362a7b4cf376489faa528acc2

SHA1
df855d240b29133a33e5cd7f3612c5d3bb60f512

SHA256
e539e1ea31895cabc97bd972e5353303f4a5fb46417fdae266d796c27d4e80e1

SHA512
58416057787f1d43691350c7a9a9c247e86c6b54c21779ebc5741166f0f8faf61911fab4fbefd5292012b5aa7c4098e606e282a0570a07a3164601638e6f84f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173c1cc8786d01f0babcc96ac761c25b

SHA1
10c710e161402c70af6500010a7e65567d02981f

SHA256
331c8fb0d37b2fc8f2b4b255120b923f7f01e2635213bd732e7d8b5800ef4a2b

SHA512
49c72e2457150ba6b7fbb7f652bb252bf51440f884af18af9b22c64a542e6509ee8cda1a023279e156ae8a5a2d63564146311a143815e2b565851c8399ae4e1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB53D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB61C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit