f8165ba9c37d21a1699b1650625e3f4dab34c8b7fcd695ef5265c3b1c3481345

Analysis

max time kernel
67s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c9089c5ccc3bca418fffcaf0c2fea2b.html
Size

10KB
MD5

1c9089c5ccc3bca418fffcaf0c2fea2b
SHA1

d03715a490fd95b8bd71f5275b57922402ebcce4
SHA256

f8165ba9c37d21a1699b1650625e3f4dab34c8b7fcd695ef5265c3b1c3481345
SHA512

46f07b9a1a5a59db3f8c31d1633a01108a06c3ca4b2cf5f8b7c7a875097e3c0be6bb56cf9386e7f418bee60e0850dfdcb11893d501d792c6818b8ec5c3b672dc
SSDEEP

192:SIjlctG4K9phIwH/3xVyhxI4UFpMKHTjQaohSiuaMCtLfJPpfBC8Z8zuAmTe:SIwG4K9phIiSuM8jPu/NMCBxhfBYy1Te

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68C521B1-A39E-11EE-9098-6E1D43634CD3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000650a12da6e4e59050d4910c57ab6b0322f2501589a1a47691b4fe942c1b7eb3e000000000e8000000002000020000000ddc36ca9aa64d394867eea67c0316b6e2f745879b7875d6a3453399807bfe30290000000e9177ae744a4093ffcd5d803b767925e42456fa2eb9ea2f992e489949350f6642e938a8c6325ce116ad93e3258649876b46bcc75d4fe27881cd052b0892cb38798109fd27bfb2506f0a0bb62da5bf7e7273920e84d7b5ce54c72751ddd7ea33777d9d3a2ea54b85c4e07c571eed6bd35f21079d4611d86a58b9169bcc6f319180247f863b3f45446ec7ba52a57356572400000001c85e1252bc44627770d9bb5f82d5bfccacd1a094d08d82b449a71121ad2e2cdeba4a9270f88e978bc11b40f40f0ed3306f40eefd5ef8e8b04415418e03b903b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000000192d4c4923300248e9f07887292814ecf6a42a8e230d026ca5dc0a621ea5a75000000000e8000000002000020000000e4cd8e43d66687836136cd3ad4968fdb2d0c3598ffc06068de92d6f593daa25b200000004f176cff26c2a08d83bbe23ddba7afe64cdaf5e424568d28820824050cc20e7d400000003b4d903a7e47e2b20c63b866eac6c26bd6756bfc4ccc5af2f85104f3c942088c8f6c7f8e1ca1e98d031e056349751e06e3681f89a9df81ab971dd19063df4a8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cb283dab37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3024	3056	iexplore.exe	16
PID 3056 wrote to memory of 3024	3056	iexplore.exe	16
PID 3056 wrote to memory of 3024	3056	iexplore.exe	16
PID 3056 wrote to memory of 3024	3056	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c9089c5ccc3bca418fffcaf0c2fea2b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd6617466dc26b060c08f9d60ca99c4

SHA1
470a4792663e76c0aba9f3735498459288ad167b

SHA256
202f8a9da1ed14e05bf6b4962fcb9da190a2e0c0855372270fc3d7b9a3a52000

SHA512
761112aefda66b0627cac0916b2e57c92c483553ecabc6c3c6a41f4a55d67e7880ff7ce63ee70bb9cb5eb861b11b34b38dc882b1e8929b0b10ba0b38aefa53eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f97e53c67f324f5bb2cccf2ff01b4e54

SHA1
c5553aeb815ed314699a70a8e466fae279f8c693

SHA256
6a98e750cc6fbe6331580f3668578ee36457dfa5ea705ff60a30789252f129ed

SHA512
fca5a7b23f2a9f3a880b933f49f77f858aa82e49139146a1a1dfc71d5ba64c4847a53ecd60ef15edd7420e53a00dea4c31620529e12f6282d5fbee22f51703b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d46c3a9c99db8ccab346df10ba7af313

SHA1
42fdb5474d2e88a89840953e0c25cefc1fee3830

SHA256
be2ae92837e219ef5a8b0ccfeed89b13489e540506e38fd9d1743309105fbfdc

SHA512
e2c1686a3fae527b2793be3280b113945a07a9724ff41b103f9b59ede1f2d3606daa85ce1fb2be7d92dbf13d1be88ff6cd29514caf1dec1e245452ff028f33fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9834751a92866499ef4cbbd5016a49f

SHA1
14654e2b667f8579e31edb7a533af5e086d03458

SHA256
7c66b8fbf92349b17ea89b9a3c827067eeaa3023c96f795e46ecb9ff8bbfef30

SHA512
08e727b4474eca53777f52a6734d5d5c5a126317cd2af19292c69497f9b1b4447d83e2d8c43673958ba2cbeb6a74462b5b49adc25a7728a9fbabbf9948411fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eb3a1c683cf27f6ec4475274e2d4641

SHA1
63f2791d5c99c707cbb54fee84d6610f57133890

SHA256
e6fcca9f207c53b03b879ac13356fef1bb226a56f86bf05742ab0bbfce16d527

SHA512
5c7e8f974c891f6d35bc48057f68a23b429f81db9707af9c42e8755d4100b350a84de21965a0a39450c2407db9ab9c9ebada68bb238c20bf5a376b18919f19d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d80ed8d2e8ea37f2eab04931bba89453

SHA1
8f5f58cc86f2c52f655b483fbdf218c595d80d44

SHA256
93ae2bcaba3f60d493f266256b19aca4fc2ab2c5e918cb8550b7c78d7ece5bb9

SHA512
51076e3ad8148fd78c812d48625e7be20cf570910f84e2b179d0df18dc2a6b06ca7d3e394ab8da6c5bd8b9d96483773692370a4630a7a5036414c219f78636af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3351.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar346F.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit