0b4e0857b1a2e6a458f97e1118320c806f0a7e11ddfce87163a22114aaf1cc29

Analysis

max time kernel
185s
max time network
246s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1604178db4cf18a7e4328a2e93502290.html
Size

50KB
MD5

1604178db4cf18a7e4328a2e93502290
SHA1

bbada83b2780e1430e5628480bd27a704d8b232c
SHA256

0b4e0857b1a2e6a458f97e1118320c806f0a7e11ddfce87163a22114aaf1cc29
SHA512

bee78cb2c6fe23c6d525a594beb7b5455c3324c3868cfd3afb30943e9bee48a91256a270050c930779de6fbac64ecef013d38bb353ae1ca641ab9cbd19111020
SSDEEP

1536:55R/nPW4vVrVhO2ttxbhUMP+zlWDNWc9ba7VOQ3csF8ioFzXuinqS7nsv2x4ok9r:BPDIDOQ3GiIzXuinR7nu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0E2E830-A505-11EE-8575-62DD1C0ECF51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409877432"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2552	iexplore.exe
2552	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2904	2552	iexplore.exe	28
PID 2552 wrote to memory of 2904	2552	iexplore.exe	28
PID 2552 wrote to memory of 2904	2552	iexplore.exe	28
PID 2552 wrote to memory of 2904	2552	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1604178db4cf18a7e4328a2e93502290.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba8f3ba333db5ccb76c3b988dd17bcff

SHA1
233b2c9b0fbdad8c2e2ccbc6f382065df4485226

SHA256
ae31458b0abaa4f29841ef8f4572d108c958ee0f90f88601a5c2ad5d51d68383

SHA512
bce56ab5275a01a9dd07ac0767e64733c853dee60cf96d0359134100cedf9e2ab005e5f8d04649e300f8f4593db9698737c1e691491e5f335bb0c3cae32adba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6759cf8dea0cbfe1de5278cbead07027

SHA1
8153d8dcc919fe84e00b04dc09f531b4f1ea07fa

SHA256
0b2a55f1e66345322c2db22604fabebcd422594030274c0687aa179f243b5624

SHA512
043c1fde28071845553e516feea72585fa8237b7d06372ab9e291ea8467a70e6a21ca6e130e08a9c904cc76364820ff05ff01c1374adef0752c4ce81f25dee37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e172ec179cdac481d0d884fb26a2106c

SHA1
169c47c9dd4077e32398d6ff9fbf43a843cb7c02

SHA256
bb44823733b3f6aeca2488ff91a09abbbca3fb1fcdd8343d09f597293d759c88

SHA512
3d88763398cfcb107fbc6e3ab80c90abe4b9d33a51b668b5d7f97cc895ac2d1e4d0ba31d37284353445611131291c8b3d08a1951c4e4d0077cede372ce28f92f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
575a54246bb00c3396e59db963731b82

SHA1
50f68e81657fa14016f0cc77f7eabd326c5b6bad

SHA256
b8128fd536a1c25a2bb8ba6f90822bc2440ad99006cc6b7f1559d8b4f68aa636

SHA512
5c40d6271433823b2962c0b0c21183ba98934166611975ded68863c2c64bccb29ece409922d0454c2bd23682cf20b66443885c66039651bd3a9e8d18bb5e823f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a78bfd8e12547e88c1d147d3fbb8ba6

SHA1
71b73244810dccfc36b06a3874c599a864b379a9

SHA256
0d6f4693a455bc7dba6da1f4a92a0024c486f76016885d78a59d825691a5b587

SHA512
6ba5fb53cd304abcf3e0301d5aa32eb0fa22358f88160b19539d3f0afd039a412993500bbac74c1d914b712f50c7707d6661c37cc4ab34943305446b646c641c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d896e804b5e3fb046c437ef17ee75f

SHA1
5a3c202a97746037ee1c0696feed2b86f5a0488c

SHA256
e5ed86a92c8c0dd8df644ad5fcde572f49d7bfe663419060a0376224df291a1f

SHA512
8b55c02608b62c27a03816fdd8f9449b98f37d1689cd327e6265bb9cb0db378dc0bfc972e64108d522ae6f7864059987b419e30531e48d106e5893874477fb3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
179f41228fe54dff717351daa6a1fdfb

SHA1
f400c0da548407b1aded9edebed08d6ab500c402

SHA256
cfe8123c05f9bb2dccdb40d7972638968cd565534085cf2da14dc5f58eb6b38a

SHA512
1360777f412c01b629e8f7bbed226d02db9e4a80613b8124280c6f5679c53a382e80ad008fc137bb1d31005dc5ad65cc4edaa58d2a980721e6ce3448a349e55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c51d0b5c8d69bf1a50e57387576337e6

SHA1
f659d8c56b912b3652848e93a390dfa6fe312578

SHA256
a3f729a936411c66fc67c97aa95e0ebefd697ed609836ea355e055bd930191ab

SHA512
9b0b8e172de102d6cf037d8bb0dcae8989dd87982e0fba794212f9905bec1f63c495af2e86cf5b00f2103e4bf9f0d1b39ec4576d6434bb7b578691f70b04e1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a367ac8ed8c764fe39dd68d06c771bf7

SHA1
235674bca11a90ba927b75efe2403c9aaab9d047

SHA256
2603d1c270ef6698e6931b4553cb3f2fba031c7bfb860c84e6b343993e6557be

SHA512
6db7f6bf5578217b5d98598027044a941da4a98fec195463f3efed6e4bc0e66cb420755a378cb69568d58dec9418888cdd7d561e0032bda55dd1bcc7829c4a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153ca1b0cd9648e0ade208cd86733ebd

SHA1
e25214cb05dc5b5af7c866f6e53eb479fd5ede18

SHA256
a98dd5e5f5cdba6c5bbe403ae06bf2384c96ab4ec9c675a62ccbb6e152b78e65

SHA512
98772024b1dee32b05d61eff25da81800d88b0bdf54a8c2477f42cc7c7fc14e92e9efb207ef4240064d28dec60e59467f834055ac8187e309cfb9c0cc603075b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD26D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD780.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit