e2ba22e2bfcdffe7ac229b8f0fac5feb5c421a9b9cbfaf0ac6a1b36ff3408677

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1870dc88522b7d1c3818741aaeb85cec.html
Size

6KB
MD5

1870dc88522b7d1c3818741aaeb85cec
SHA1

8eeb142af43c433856267fff185a516c9b35cd9e
SHA256

e2ba22e2bfcdffe7ac229b8f0fac5feb5c421a9b9cbfaf0ac6a1b36ff3408677
SHA512

553e341b0fb06cc1489dfbd7efc9f4085a3534d72efe05f5bf7ba0a150958a92f9bb000a6bbb06f57c4b82a6aa2f2563aa763870ecafbe783d9e70a9450e8381
SSDEEP

96:SI3iu8IMYXKjl63GL4X9NH7tIm6DTIBDD4HsfuyxCDeD4XKQrgFf1Gj2wve9W:SI3ibA6oljGmNvfu046uw1aPveg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000cb8e1bd225530b8719533e7f5177f8fb8408241d5b1f3b888924af62f9af199c000000000e800000000200002000000070e726881c93131a3c3d668c1d07b23b89e30f28e1c5d2dc0d98eecf988f8c8120000000ef8aaca8db72a121e2d715f8268eaf207e5d7b643178eae300fc98f20f55347540000000bb7978cfb5300ebc44c09b67df05c0b2079db9e2a713684c2fb9e506413b69493e786b9e935e9ab506b69100e23243a76545143dae90d282afe6e8ee353b3d9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000023224f6ead951bad3661c28383b23785fc99dff702c6242d3a8dd6fd56f896c8000000000e80000000020000200000009ed20dde3885521d5e84c0913650c0099412162dd5e9826c0d28197dff7f4f74900000003c2656e25c69c171e16904d271f966a77c51dea08d9e402bab4d108777713c2552c22693f245072a1836b498a71d406d6c36ce5106b613e7a03d2cfc761c9b68a7a99d46723b2e4aae50e97c58cf4958013d3efa2ef45dc9c38251c499bfc9d4d4bb2effa86c360f48ecd0d913cf42903fc670d898c7ed38ecfc83f0903b2d09f9b7e5d4235e4966d58f09fd4db4fb9640000000a3e8f140d050283f35aed4b20fa48f9f619243b8733038b890e7d41ae0309dd553a807a5a4cfc90a499779e8bf8a9c9502831b38d6f29cc7391f89fb74676630	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36D7E291-A51B-11EE-8568-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f26e2a2839da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2276	2580	iexplore.exe	28
PID 2580 wrote to memory of 2276	2580	iexplore.exe	28
PID 2580 wrote to memory of 2276	2580	iexplore.exe	28
PID 2580 wrote to memory of 2276	2580	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1870dc88522b7d1c3818741aaeb85cec.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b1b742371a385607dd9995c32ec056

SHA1
cdd23a482dba0583babb102529e7cb2d1a231b25

SHA256
44d4ab523efb9b1fa525f150d7881dd75eb6a4f4daeb2e2f487331323eaae940

SHA512
13f2a179078e7b175f16b5b9fecd80c91464a086a0915708f39a46588ae794c2fb8bf883cef2d35d966d051932d0810ffb404436f2e54dda0df5a6a07219a0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5a71bde0e7d54719c5adffc37ea4ae

SHA1
d4d507cdb82d710e9a7cf5c6db14c270fa86dd28

SHA256
e4e52c3117857585803be3fe1fea02758685c6e6d66ee072febb9dd4df70e983

SHA512
85a500b1609bc3f5491145738be9898bb118f8949e112540336c1889a067ef92edfc97900617c984d0c3c17a8b8527bc8af98adcb05cbfc3779a00ee0edca679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6adce0171af54ca29f92efa9280b1f2d

SHA1
9b78b49c18e58d4ae7c50329d6805612b9f573b9

SHA256
47e4654b9fd59ad4de7c2d54a7f6f534f495660acd91dabb543dfa0e209260f5

SHA512
f512f3a42d2a8db83ab346d5eb7cfa3ff168706d3003901ff46c953ca098b2fe0800aae14ad74a9111fe3cb7126c57f46a763654a41256c2e65211defa1d3ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db4f7c6943f2a993725ba1b66f9f9355

SHA1
2c8fe257e8e111b1e674fd442b3c55c1cdb5e890

SHA256
c85d3a3822bedecf841cd842a418b9cb9685e1a370e3c4790be9a9edeb882082

SHA512
bbc47d2cc9e18439ce4608801b2d7a118fb198e6be48dd5deab7d10b90ef25a2d9668ae7cbc8709b88cc43871a20d36c1a66b550b365c8ba92b56392dbdaf619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee3985ce1687a9e21ef7e31107a4f35

SHA1
d20f1ab0e5ccffa78eb4e6ae0085a31aa12c1e5a

SHA256
5cafab493445c8aa54104cb3308d477ab3774455383cb38fc574b97f25e28c50

SHA512
6bf1777540bf0fc95bfdcbe4185e60c0fbf3e4af00849ed135cfae4adceb16b541db3f101b0a1e371cc841c16b6ff83f37b05fee3beee014d592d97e5c16734d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80dfdf57d082e16059b875c6dae29a8d

SHA1
051418269113068a07d9864aa7768d58c37c8a94

SHA256
8602ed4ce3a6a8769a26462ef106bdaeee4749bac01afb5bf2469f1bfc35da59

SHA512
c853a0eea537688ae27b2b4d984c25929686f1e7056a5ff569052ade019b8d0a28d654214dfe5f9ceaf3baa01a524383fed24dd298eee180956f7633b493ec56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea7283fd35cbb78e3de09820d8816a95

SHA1
be98e8ef5dea56a3834cb39d17e9d91899a3ec66

SHA256
09860b6bff48f5f5e9d010fe5c78e287434ba03d020290d92fc3a27950393fab

SHA512
1ffbc21325cd4ccf2040a5797f64b7cecd723ccf2149b94ede6f15fcbeb28d0225eca7c3ef3039980e591528a5a158f3ab6b5fd12a2aed565794afa0eb24c036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47eaac887529dd7beee74b4e86264358

SHA1
ea2722b9a001e579706709b6d9cd55e1219ce3c4

SHA256
25eb1b59662e7be0f0c3a7c62d7b980ab054176c9b0a7aaa93c790c60bb04fc7

SHA512
0081c5d463f735afec37a1fee90c5c964b278400bd40eb0a75980df36cf974e06e192564255c78e4b6aaa1fb02fd9297d373923f23921397bcd1f9db54619bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b410cc9bddb9fe26a7cfbeed44471341

SHA1
18d4198c140591879a57578eb04c06bae670e49b

SHA256
61cf2a94ef1bfdc49814fa5a4e977a9b853d00f47305ecece031a2673290dc07

SHA512
17ccc9a9ee8e51c976cb52acb3254bc4cf8201e4a18e4055972ec0b32bb2d576f1359a93f501c78349bd0c093ad29ed7ad1c7fd34738b9dbe97282c586bada8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da90e3a003a2a98282c6acf8460b3a46

SHA1
ffc81d4298203c0643c1a5bb5a19c5764550f97d

SHA256
d78c63757defd28e27fceb059be971dea69cb3488a8d8a20178afb38971c6e20

SHA512
c6b6b11201b3201c121ccebcfe02eea1800e4680bd3dd145a3421595fb1cb33c2f5d5855ade9fdfaffb66c55a1630b76910aba1661a8fab5f09805709b68d045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db35641edf39bd83458008b2e6644ed6

SHA1
fc759c40d0d69600a483f1a018339ce536f00ce3

SHA256
c6a08f46c8cbd6cbd231131e270728f8fd6511c7b98a466cf2bc797b93fcd446

SHA512
d60636c92c4d774d6b14e6fdf5c7ba10331bb82c89062c6c5d12585420749b8e99817ff8ed813d3dee5bcf4d9cbc6369207bc7c14754f143946f1dda25b6cfea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
274cff70ce76fa1eaf8509014d1668d1

SHA1
5953cc0cf7b161bbf1241f38fbece33dfd761e1f

SHA256
c25e8eae493fdae1dcac05d68b29a5777e268e2e53c063bc2d64c0f0d2880a6a

SHA512
9014d08bd87d5c3a9ce52df2fb3046c2d55917ec93ecdd12cc3f6529599fb3f703378f0020bc4eb8d8bbba939bf0eeb6e00578f3130138d439f8e7f704fc0465

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17A9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1857.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit