ab36cfba604bbba04cf15e1796c83e87b22ceb614f35fe55ad83834655561b55

Analysis

max time kernel
141s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10bf0f8a4ee8ad37d871a1bcac47be68.html
Size

18KB
MD5

10bf0f8a4ee8ad37d871a1bcac47be68
SHA1

ccbc5a603da31cfcb2931dea4e0447da343b9ef2
SHA256

ab36cfba604bbba04cf15e1796c83e87b22ceb614f35fe55ad83834655561b55
SHA512

0f08746b8eafd97d1a1ee7385f46065781974bf6aa0f4dceccfeba392a416fa225521f1090bb915e54bc60a69465ada77cdcc26a6c14c1f1da683916cc1bf924
SSDEEP

384:cmvz2LrwRuahr1AgdGgs8jMaztTLPAuz68MMv07X:rzoquK1AgdGgs8jJO8ts7X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409852958"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE2ACEB1-A4CC-11EE-9F1C-6E556AB52A45} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005a41446b93fa50ac1b9441f00a3b43ff0397e07d1376b9e28a33f02f5419738c000000000e8000000002000020000000e13cf2814d177c99a15b2d3ea91d84098091e913fc01ffb99e0aff98df434f1b90000000f1d52f3ed0050807d7ad9acb051ca69cdde67454957d322be25a066226a5150b3b062bf155735950090eec478bf5f7735f04bd1eff2f0c5256a6963c7a548660416e395473ba7554fdcc0815aeaf8e4c958aee06518a0f79855349a86de3d5051fac60a8e78044f4efa6bdd5537c25c057958e814a5db4c6fd78007eefa2c476d51d5ea5010cab7bab28bcd1dfa24df2400000001da5381f97025e776c91845b40cb76489187ad2a6d14b4135a21da0cba10dec20b3b88e245ed883c3bf10ecd3d6f99eb0c2f09573bc97229b1cdc545b58dc82a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005b6e5a3b3742c8b5934721c41a5e7cf60bf464a8882ace9ae61c7e22272c5d2b000000000e80000000020000200000007c387a6ccca8374426baf5d45174ebb1c6c4523cf76f83066a25b507665f2ff12000000026a54a524bf1baef043592d53ed93a32c5e99ceee3b98ca16cb331ad89cc24dc400000007a080e22640f3a6d733020900771cabf057479497c1aa6e82c9ee4f6c0f0709224b9760e7ac1745f98d11786bbd043067ecd099a0e3dd53ef571d640f4f1345a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e517d6d938da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
1116	IEXPLORE.EXE
1116	IEXPLORE.EXE
1116	IEXPLORE.EXE
1116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1116	2292	iexplore.exe	28
PID 2292 wrote to memory of 1116	2292	iexplore.exe	28
PID 2292 wrote to memory of 1116	2292	iexplore.exe	28
PID 2292 wrote to memory of 1116	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10bf0f8a4ee8ad37d871a1bcac47be68.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7801424fe8e7ce00e87e85fccb152d3

SHA1
85e612074d1d618bc16042e2b958d2463cf61e7f

SHA256
8e9018446beb91669fd6cd042435f9ed22c46098870941e374267a452c04d332

SHA512
efe267965814692dfd4609b0aac13bf48260346444495c7cf9eed3db59b5fd0e89dcb29f26720faad7b77d72a9b2295dfe1558a1241c7507842deebd1b7c1417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11c37d9a4894c025b1e6e3c65ef50306

SHA1
58c07f41a668e46654b00861d6bdfbf6d79f520b

SHA256
ff679c0fcb4351820046f5bf6d02946b1d986689948d9117b3a1ca9a29daab5e

SHA512
35b6729fb5d4bd7452e7f32c9a999267329a9b1be7be5afcbf3caff7d78f3684b900007adbc0e171c1b49a87c0741d9160bdf3fca0c753fb3e9a2d910b23e547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1c79e8c50a72134126e2bc3c296f614

SHA1
12bb7de777083b9fd3158f96cc60452f00ba084e

SHA256
4de540d01ed8b0a3341c622c99c32f1292fa814ced918c0fb272a3011a33c988

SHA512
70cb6a091fe3cfdcffe4503e7bebc71ec5c928a69fb29dd8c768260d11e81ab39360422845b7b37a6b48a360d680ecc4963341e2bcd429a60e779fa906a60683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6aafabc9ca2619e22c065730ff9cf44

SHA1
c1a7cebdb0dd6e4f9388564c8a413fab33e570d0

SHA256
e011b033686282031a552d88afc4f5ed7c014832a26888c8726c7d7f2e54e6a0

SHA512
ab5f708cd51c67718eca0a81b586c2bb6c2a738ec0fec73abec68a1d32bf05ecbd7068428e90654a1c0f4f5f8f4ee1f1230d9dab2c9f78f136930f2fcf6990be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E60.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar545C.tmp

Filesize
118KB

MD5
001d4c455cf5b150f99ccc59c81b097a

SHA1
50078c45b16708c766e04e80cb4d7242444f33c9

SHA256
e6372aa6ae33e1947f16be8b00d8f7acaffd2ee750bbcab07043115f7d717f10

SHA512
2c3bab703bc93967950e89d759e0ab9ebe366b565805c64c72ff7f5a56b0d128b094b668c7673a73c6dd8cce4291fcbdd610d046374b87971dd49656ad157f47

Download Submit