e784cf21f2000eeba0b07183c52504703821a61828728e6ed49e0872f484608a

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1722bad4231ea5566f23876c82064618.html
Size

17KB
MD5

1722bad4231ea5566f23876c82064618
SHA1

f467cfa4b6f1477b221a9000b545b302e9af4bae
SHA256

e784cf21f2000eeba0b07183c52504703821a61828728e6ed49e0872f484608a
SHA512

64a267cef1ac6e75d9216497bfcd99c39c8efb8c173ddcf0a166a61973877e9738e907af3d55ddfea00ffb2c49a682be7bc494bd6776fc05e9455719700157df
SSDEEP

384:fjGzb7cfZt/s/N7ceO1LmspYutzETexdy/YqZtHTN2V:2cX/sdOdzETekYOxTm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bcf740390ca31421ee73316d4e3277bf37e3bab44d475f55d3be40c6f4900a6d000000000e8000000002000020000000b980b44e27e10f6002bbde02aa95455f31c3e38400c6cdc17f01fde4cf3a753520000000f00491ae94df01a38d004cd6c1efaefbd4d3a8863c6c043cc5929318ab32f72e400000002619f653422c480fb5b019647570cb0cc19ce11baaeac99d5736c3274e14054c1b63fb3122b1b5850f656e349ad92f902800933a94a4231db657791938a33780	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000003d7307b6daabe2cb7a1b0769c9ae734ddbc38ce56dda8a792a8b9c5615b31512000000000e8000000002000020000000b8b5a45063300248aaf7360f2ba8740541ea56fcb5628e9adfc4f4c952bda08990000000702f6232fbed1f7b70fcca2767ac2aac1989c048e6edb22546fb93dc8770f35ab9afe38b4f861639d9359b4000f92b2c372bee787229ddfd84b7f29f990a70e111f3dd4efb6c75117446a61884ac136b6ac253f8dc8678fa2b3458e7766e44b9c6237a894ea90067b3b8fe0a84d0514ac2fcdd1b0587dc8c89ff3737d73eb96b0143d0ee95ace1e066b0f48edb802b3b40000000a144c5239f825164bcee7cb3300f19ba541b0c4bf214b68bb956e504065828a745861f6de016536deb871633558201b6bdc521b7b0a935f131efbc00714ac1ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31414E61-A387-11EE-9BDC-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409713028"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90cccd149437da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1688	3020	iexplore.exe	28
PID 3020 wrote to memory of 1688	3020	iexplore.exe	28
PID 3020 wrote to memory of 1688	3020	iexplore.exe	28
PID 3020 wrote to memory of 1688	3020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1722bad4231ea5566f23876c82064618.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
689a0081e5aeae2fd55e3c30bb5627bb

SHA1
27bf36b914130be38001684a3a4047eb74280ad1

SHA256
0dda6190962702ef57829b61a2c1a209699feb21290032d01d9934fbb2595f67

SHA512
fcf8b6f1ef41298f174c90a307b843d86d7c452edb5a16041f47bb2ee5bff607a2ed8ab413fa573d071c915bfaef72833cee34c5e151027ecbb2887f2ff217e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4747144a692c72e0afc8d8d421c9f3cd

SHA1
d66948b3be9106d0e972dd87d76167a620f30b54

SHA256
b724ff24c8804dc2f7e4feffa887fcd405c6e3eb75ead5d033a039f6663b5811

SHA512
c801399bf876fb3c2a8979c99edd35b81a5bad3fa4f791588765a1e954f82b39dd06f9773ad97a946c6174b1c7025d34796e0b65232049ce061b3f5b05309252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11e86243016f32ff72df5b1fc36bdd61

SHA1
635325b2563f8f18de3582faf56038bd9e2f7c8b

SHA256
a6e899bb5a0564a65c8f8ed9e9b796b2df1c7e0159562fc02c8540bed3df817a

SHA512
d111cffdb878ec25adb2cf4cd1519b4ffaebab2baf95e79b0d2f2ca16d299f36422ec5477f7c91c93196429e7bd4ffb084a8dcdbc3516b40c4e9ffad8942b91b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d246c2b1dab8115bbbc7a049674a4a

SHA1
88b1dac83185564d0ee78940d8d416476716df5f

SHA256
80f77abc57626b125e46d66040c8111097ea6c721c19b6f8da81c59c86560dbc

SHA512
0b235d31c21e78e384d96bcd442158167d60c32a9743a0d107f2b9e8232b04b3c56843af30381c37931b931dfd91d5582f9417a50799de4d592c5505ec17c10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6171cfe869252fbded3410fa316873aa

SHA1
e182a7b3387cb3e92feb99f15bab1fef5c1e2ad8

SHA256
d8404bd6b111e8b4f868fc0310120126b7bad199dacd9f6ad4f5b1e7be3e2e69

SHA512
a1cb9357e368cf14bb4a120d7ec0d85cd4860cc51a177a22040f499a7806cb7cce8bb56f603368c4d58930add7bd9133ffa1d21bd93a7a1fac5080cb8b760f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acf391130855001f7a6c9c9a4d56718d

SHA1
0dcf6cc9dc11307452eb49ec6fe0359fea1a0baf

SHA256
e962ea5e85885d3ff3bb654305ec18121376cc7d500e20cf25db6ee8333313cd

SHA512
f5e2327faf0efaef7362675a1d6637cd3ebf010668a275dd753b4667edf60a332bfe3db75c503a044d59723099ce9b90127145278f404b0898ed1394783efc73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4afd61a19f6e6d212a52d849b51f4cf6

SHA1
12b433e83ca73da746043d2b83f7c7014f1ada57

SHA256
97da3838015397071f576866b19680afda8524837b16bbe5596878012300261a

SHA512
ffbae4fcaae74f48603c50676d92e026b248aaece9faf0ffaee901db539960dfbd3169b49ad5dbeb6c4d6b8a670ea41237cbab8b81060f5a71847cdb6bfdd08b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12ef6edca980099c75cb97f14123539c

SHA1
934ba6530822b74e3267f95b2c10215c0c49a247

SHA256
784cfb6f92a53e99525b7ed768473a4b99d0409585608233a01d8e73704c426c

SHA512
cff5873f9573f1d8c78b92dadf435d47397f1256831bc350ab7772c233bc9c281d3a03cfb86492fdde6a8817b5175d5d1f43278bae62a5d42db84154f8e287bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a87c0bd8f73851cc58ca1fa397371f9

SHA1
390e5f0a111e4d4904f42c70fb0fb167b2beec9f

SHA256
08d86ed3b470a67f332bcb17f64862b005416c237625764bce69171457a6bcac

SHA512
cde980da57f64a9c605393fad609f0bc5783a72b432676bd133fe90326c6b9acc6ca5f89291bea9486e3d4dcad09238f54340ca26f0ab9ce7b3cca6918ecc5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab846D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8654.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit