fe2830867ed96e98945271bf488f3bf7f51164a1d5b5b2a737b62404160fdab2

Analysis

max time kernel
165s
max time network
199s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

180d8ef3148bdeb74fe28dc9ae4eaa8f.html
Size

4KB
MD5

180d8ef3148bdeb74fe28dc9ae4eaa8f
SHA1

8aeb632b90844b677403153b543726e85df4579d
SHA256

fe2830867ed96e98945271bf488f3bf7f51164a1d5b5b2a737b62404160fdab2
SHA512

af94a86195cf62cc1a3b0688617fbe3c14f4cbe0b8f38480c56d1ddeef16e07b8c3066b9b2f4abcfa89b0b56eef4dbd90d958196d307af939aacfaa0caea8fbb
SSDEEP

96:ZWXGt22yDf4abXGt25FSZBtKIoRlCRlLGwxGctaZF:4XGo3rBbXGo+08GwQctm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000bd2381a31ba3413e12ba8905df65e38f60e8aaa923ba5cd289971768735ec6b8000000000e8000000002000020000000a1694849c1d3b726932317ce250753e1627cda25e2bb0e431dbf0fec4bac9386900000003a4b2aff9bd2f044475a016548fb1a3555c60e2aa21ee781a4555565b7886c76c322600229a30f74eff40d121603d32441eb5afa22af7930fc12abdd465a3d377509a3280b3a2eee0ca738a2d546c5d7e45feb96563453741715601ac00a2557783e115270358a109aa6658a601c1a359fba7c8c044b52b32852ffdd4f96cb8d7ff84bf2737f07f6042a2a62128a620a40000000278f213351c607871072f20977f6aa3b5fed23aab94b00d1e205c115d9698f4c449d3b5cf8b4c7373bddf3591376c610b097f96b0431e39f9865d6d01feee6b3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409885136"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000314f3b02e7e97cdac8f8b9375ee642c5f339d7d61561a1722e9b9f76415e4ef2000000000e800000000200002000000061d51a95af45d5fb17008f2d5f85021329af571886f6f9461ae9b1114950d04c20000000f5b551a095aca8c4f7d160641d43ba5b23a01fb59c56ffcefb3cab3acf5f635a4000000025b2039d249c314522480c256d63f77307ceb8f376b0ffb0e42e2a60fa0e4d04e32a32cecb37b9cb093e3c2d6a99da71891ff51ec9c79fae8fed0b4a678ec3c7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dbd2c42439da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0B68951-A517-11EE-A1AA-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2272	2724	iexplore.exe	30
PID 2724 wrote to memory of 2272	2724	iexplore.exe	30
PID 2724 wrote to memory of 2272	2724	iexplore.exe	30
PID 2724 wrote to memory of 2272	2724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\180d8ef3148bdeb74fe28dc9ae4eaa8f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4822b8d8a82c49088dd88ccf2b5e5471

SHA1
837bdd54ffbd6098fe0e2731983772c185e123ff

SHA256
5459781ea9c65ff3bf492dab7955965416a3b0ccc36953ccfa5ceb7da5178d0b

SHA512
d45ee9d23ce2bcea68ea829d1cedbaa2b83ed64a31fe7280911aeec293222bcc235610f22c8c86d7474cbe6d359859ee3a46d8f25a6bf7a815a4cc52bfcdcf7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
678c9f5c2f469533d45bd4841b2e3b89

SHA1
849fd0829f5f92593b9e4eaeb607dd56d22ac0d7

SHA256
1c55e68bfd3d4e44f942de784e8700c1796a7fce04efd76445a2a685d5b6138d

SHA512
21427163928ee23b2dedc86871a89a28b051f3f9668bf5f065add10c7e8ff2e400ce2b962faa24e885cf8cb11f50433d1410265fb0702fe1b91173e92df1af1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51f9f8c7f5d77b7efb122a051742f364

SHA1
eab75869ddc8eee351f850b7d3d63ed4fdce6f11

SHA256
07c755ae86cf78f53e0ff4f0842529871c57bd86565c5b9caa9546f12047a95b

SHA512
4b7e76993b427e3f4a245cef888090bf6985e5d314e1e4d2617e007648c58461a6cbbfe19f22aa81f1f670cc6e6fc7b2b322246fa5cb3bc62d4153ffe3eb19f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9a1911ef5add0ac6b330e0263047be1

SHA1
119528cb67ba1662ed2a2f0382fb2d7e25ca23ab

SHA256
8c1a0d49e4b7b1d03708e4d7c1499098db93ace86ba8b0ce3ca7e3f421eb9163

SHA512
1995d432f920679d87604db377bf8b180080608a946ce8cef805bf2ce7f4253cccfced487849943301f2000e002a6ed17f013fdaca2a08c97bbfcdc3fdf93868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28612dd7f5ceb1368d6794711d032db

SHA1
62f4f0ddaebff6d01a7f8901649e0dc0ba3fb098

SHA256
d63cd3fcef572d12edee5d122a9764722dc476a2e8b97b3fb75fcbcd6c320d88

SHA512
ce10e561cd03db73a1c924aa14b4d5e5ea9ef1a9ee4b78b0cbc134b953596d043f53e15b4ea343de6523fe6e12a0ed64ef2bc7132d3c37294d1ed161020e6aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdcfc8976f76c21822db8bcd4c4e3b64

SHA1
13c86bf6663b4aba7d2756732b35775f82dea2e0

SHA256
6665f2870811dc26d258500d385de5cc3e8a0155a565ffe0d1a1ded759775292

SHA512
73b1dadf46f5eb8da750ceb7a7140a50acb1a9c709242e7fc3ea01fbfc9e11d47e6e0de85c768d0c219ef80db0f4862e8f53219391cff9998c786edf9b15129e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C4A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8EDD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit