45cd752a17942425dd3594a5d0bdfcb28b8062d9e7cc1db383cbccb9a59eb50f

Analysis

max time kernel
127s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1989468b4c9b05979929e80aa756092a.html
Size

31KB
MD5

1989468b4c9b05979929e80aa756092a
SHA1

7b64e06c738a24524128fe97b2da940fbc265523
SHA256

45cd752a17942425dd3594a5d0bdfcb28b8062d9e7cc1db383cbccb9a59eb50f
SHA512

c170fe89f1daebe4c6f25f4bf38721dd6644c5ca727ef31bf8d313e147c8ae9f97ffd067215e7c75058a62585a9ac39cf10f5c090207885c8ee9a826e05e04f8
SSDEEP

384:Afk6FUVqfRIjTljx+KIb4rlqcqcIcpIQ3BhW3XsNpK/T14P5hMTWB9Q0:mQqfRIjTNxFqApMTWHQ0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C12CFF61-A526-11EE-9610-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409891505"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2864	1712	iexplore.exe	28
PID 1712 wrote to memory of 2864	1712	iexplore.exe	28
PID 1712 wrote to memory of 2864	1712	iexplore.exe	28
PID 1712 wrote to memory of 2864	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1989468b4c9b05979929e80aa756092a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bfa92f2cae35107a25e08e0200f4d54

SHA1
5be3738182c00cc1c473df31f3695d9a489c5dcb

SHA256
f78a46e16ace1f0949ab7d09fd10449f7593cbae2971591c249e1cec34431e1f

SHA512
6a02e80cf459b71ac1aaac1e86ced6d583b816641cf1cfd39ab710cb12a039bdb981ee76ac1909c80cb7000279c22cdc0c208334452aff6c034d1a3884b159f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f671ebee0476cf0265094dd895f52900

SHA1
47a470a5780df6933c3108df3c99649f5e341c30

SHA256
c7367ba3cd6e5c1e78d40c175d08e1e0d8e9fc00fbbd0e0c76d09c77763b5665

SHA512
4aed761e334c37071ca68ba570754b057e7961ae87aac237eb8de2c2547c636491f93b0fcb41306d8f82194b6ed6816c2a6d0b3d76f4da6cac86b12429fb447c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a19213e9c0cff6d5904bcae1b8a57f

SHA1
13e54b2fa89466317f5764ac0796dc937ddcd783

SHA256
d2f52d1ca9dfd060b4291a2c98b76ff52f8a22d58c227d5918d748d1e574ea17

SHA512
aedcc9013b00e2e1642a0949bbecd2ac99fc25e2000d5c0925f80a6420c82afc6e63fd9a459976b8a03e699f0fd2dab58fb0fc30093335b5f1354acb54c691bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc81efdfaea65c50c707770ae30814ea

SHA1
00678501660dd7d5bdeac413bb3fd8961eedf24d

SHA256
f5094f5b7fa0239c5eb43182bd7699ef24e88033cae35b7345aab71a3383fffe

SHA512
552c6d55a9c72fa7ab05f2df1a959c5c46b6bc208bc56fda5a1b736dfc4d594c9c8e5f6bf4d7faf95f841e86f43e2126180d556378472f03657020fa90a0880d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1162a77bf2a2d0ba9dac038991b69d0b

SHA1
6a062ded93957da5e2b78bdc3375610044ca181a

SHA256
2135abbad8cb1b4c9dd0e4ea34ecef24c53c3203801e916f9e06e4772496d5e4

SHA512
5253ad78b3dbf66bb29ea716fb1f7c506f73ce9e5c8f5124aa6557feca1e49e8edb8ae2452de66afb5ec9658608d3aa0a0cf981b2ced1325e8c7f7bb7401ce9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
781e03108530194813db254b2bc74359

SHA1
bffc082e3297ed805c2aa6a5783385924051cbd4

SHA256
67ab5972353d860cb1b2ea168c567a0a255e90d49a99dc7b34f00b385af7ada7

SHA512
facb7d4448126df00eeb9c9db5d97c45b774b88cd63213c9ad402f5dbaa0d5dbb35201f7b3c365147697256555937b308c6f7c1db76b9696e9b42b1ca67b27ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf5747f5abaa26832411d9c686bed19a

SHA1
a46eac396aacdc5735d0a90e68aea1497114959f

SHA256
42c9910318e519a17b0646ab41ae982feddeda69cf2e115ebe934b3313a1df90

SHA512
6c176c4030797afdf3dc62eddc72e6c9fd4376ff81601aa475e09837e2b57302bee0d521e781f71b7cd390599af366aefd0c8e14875f0046eddc37f7ef883d7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbf008fc85f04c963e9a26c9914af6bf

SHA1
7a898ed2c70d2cdc3e9ea8363981e3d347a699a9

SHA256
2467d4f0f4c9d0cd057c4dadb3e1a331326f7dc44e30981ed2c0798735a3222e

SHA512
de8567f70d9775f599bad53a1ce2d8c4d88f715f30b8d6494d9feaa5be872473dce63c1d2e3a2fa053c327d154ff8b3f711ddc8c94055fd0f09480b507a05a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22fda87e31ec25456c64e2d9939e7ae8

SHA1
9ee8f33481e25385ecb2d4e5fcf18d1739244862

SHA256
b4a3927d10feeb870d5ae8592481fde54e35414ed90571a4bf3479fdb98e7b7b

SHA512
4b4117c30df53a71eda9b25d125110e05b90c93b01874d6c0239cdce2d6b84e926f3b8c46446c2016a684c2c94d4be3dd53539b49d4f41d45627df09ab7736ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27AD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar287C.tmp

Filesize
50KB

MD5
22002cbf5bbe57967b0da01a55aab0a5

SHA1
332dd9751900b82d45c65b149b911a168ffff4bc

SHA256
afcdb1089ddc3410b3f814dae3f2bf5aaf5296bfe666bbfb5801f584017e24cb

SHA512
0973a443cfa3c3ca402b24f4da51cf1ac19aa3a03c9077ff4a55293d367503555857e2c29a79d83ac5069f13367758bedcbec11751f2cb660843a5d4923cca95

Download Submit