a9c46d6a29641c258a2491bef7f31442b9ae3d47bf5f021b4bf10054e4c91961

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a59a2813f85fd651a23c6072ffbeadc.html
Size

154KB
MD5

1a59a2813f85fd651a23c6072ffbeadc
SHA1

478a619e63bf32bfaaa5ee2b0dc7b477518537cb
SHA256

a9c46d6a29641c258a2491bef7f31442b9ae3d47bf5f021b4bf10054e4c91961
SHA512

329e61ed5ad0920993834cac56be83c140d7aa0353a2edc6c4e6330fd19d75fa890388d929a2a814416564fcf2994d12795fb51e171c73f9049ebc4c476a45c8
SSDEEP

768:STyDgAdpXH1dUFCbXnD8ri7vVLUqnoj0fkkZTIanRyAE01LrgjpyS+4UzljjJa+S:STyDgAdpPDbRUjfQ1nT0DxvpXa0LOeF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38EA0721-A395-11EE-9028-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409719053"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001cae2fa87aa6521e0c0ecc7bee84c359bf8202d715408d37af54738a0bfd1464000000000e80000000020000200000008e4a41ff56e60b0cc0b93954bc578e11a27e6aa78437d229154d2b9e34684c7190000000a96161fef015c00f048144c4b4533dc0b74fee913554ff8db4958d50bbccdb9a6b41482ea0f09a6a5ac2810a6d8a1b8b92e1d99fd723b8879e5f82dec83c760905c44f0d28dbb2e9f95a31f05ff5316788818415ee04a4db0b210d48cba210d30bd8c290b2704e0c0201865dc79c58530def07f41843edfe4dfe18fc889e13bb97a389f09d786dec6da415c36a3acd4340000000a13955c596aceca44904914eb1d36f62660de52ecc6af378ce6218c7bf11b6782cb8deef4b5f92846a5539b11c78af27ccb86872ac16829fdaea29ab6a459b8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007fdb425db56871341f9fa35364cfdd439cbbb86d16b35156785fd05aac21da54000000000e8000000002000020000000169dd76850da39c4eb273548e5ab95e96509693c1b39f9303f3b67c314a1a04620000000be32cd6c36be55c1d74bb65bcf5a504db9ca405159e2d39ccc0f5b4e6fa7555140000000cb82d74e1c5bfb64ad2fafabe1fc9450e2fd5e875f107869cf30143bbf214529246576c257d953588524ecaee15c9ba29518415f155ed226cb39c220f9764e06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08cf423a237da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
832	iexplore.exe
832	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2792	832	iexplore.exe	16
PID 832 wrote to memory of 2792	832	iexplore.exe	16
PID 832 wrote to memory of 2792	832	iexplore.exe	16
PID 832 wrote to memory of 2792	832	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a59a2813f85fd651a23c6072ffbeadc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ea198557b311345037a64582f6789a7

SHA1
e68322486ed1f9a8876ae6e5e2446aef204f6e38

SHA256
cad4fed1a0891c2bd12f4803d1c7e7a49ddc3706884081c1492b9e9f3a2e8eee

SHA512
4ed73710ade0125a09f5ca45950236db2db4f7dbb90ef5196fb5c572d0bb19f64ed7b2b3b1434972215c89d451969127a15394e45e84830a8bcf4651f3d93249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6387020b5ed324644738270f74e2b9f6

SHA1
e2ecaa827afd09569229aa11f3b2628327f2a7ef

SHA256
f454e6020341d4428ffbf6dfcd7e05ce2ed4837cad9693ee1f4285a0707e6b97

SHA512
825af49fce77d95855a2b218e5e449e354f0da364511a93b701616e118939f67dcba9a9365b0970d3e9efe346ca8130e057adc87cb15487fe2cc0b2d50b34a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce5ec7605b4629b8b569ffbd6f8215a6

SHA1
c31c934a1a23c635271b8cbb6ac8c0f171c50dea

SHA256
5c9da71cac5a45161eb41c89132ee458fbf99258530a460d318d76ed755561aa

SHA512
c13406a63092b61a1717db701d35b0557145d000c11e8b3380a13ee35f6cd0f2ada255db3a1a1b1e2f48e1c67e717d17f541b0285a753d8cb72069ddc641821d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e42749804091311878ca8d45ee5fb2a4

SHA1
bdf1e5e3c8ce7b3a2b8a3823b620df568b0cdf75

SHA256
b4a61e26e0c89897eaa4632213c84e68724fc958e3d7fe1777ed0d3ed6fe5079

SHA512
48b4a4d61ed85eaf2d259c2eb584dba6920200cee7b18fb55dabc1cc274ff5cc56f29f13a4fdb7a41b3bad133427ca766a5e1e4c3032bc410de754b3e245a83c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69cd9fa17dbcd1461ed2a58940bd002c

SHA1
fed0b88336bd315e0450ddbec58d51d8c643e2cc

SHA256
51c5be7ed32937a9554d83d38a0f99577334da7581c9d20afc1417e9eb2c1ac1

SHA512
e60e40508ed29daebee56c57e3520a73ca419802e36bd9b18cb0ff2a7504d54a276e820b21f23689123b41de4c4f6b468dbf9a636a4c9d3e8cc8473d190c103d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de7797a8daf88d0fb6aaa1161fd0f5eb

SHA1
a4b9605950cc5b2a18efd94b8ec9bddbf0af531f

SHA256
eb9cffead9f8c23239cf547500de4983c1fff1ea186612ce550d642c53a51986

SHA512
9d31c7329d363a7c334d66ab4f11354c35d54e458b68ab37b9c229e619178cffe1b987f7c93eaf065cf92aadaa13cde7482d5bd95469e544a2a2e78c6a09a123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59bfadcb4c65f50e220e4f3eca629466

SHA1
66e8ce664fc4586b6e0d420545e5c09ccb98c5ad

SHA256
1bd99d1f770feed719c4dd87db34ee58bfb07e2db55faef6a890dfbbac36cced

SHA512
857247070452fc00d005643ea63e6bca6cad3e377c1cbaa9ad0cb24d434a501cb896777c8051de325cd3677f45817a5f36f1cfacefb825fc1b87fab0134a8c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f28223d900b0475c9c28c1a77f14d97a

SHA1
ca34f341091154fffa66a13e46b1c7247661b23c

SHA256
49350de007492cf1d259a61588a9cbec3ddd62c19b00addf0083d51faab3d8e6

SHA512
9b1e16bd4abe24a76b0ab038bdcc3995c59c10db2b2762d94d97b6a524d38f856ee505eb60c10e07ee48257b94acaa5c63d46034c99125f5aacd7ac6e2f8430e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
021568f8476608c45115415842567596

SHA1
2181538804be3a5718b3f5d8ffb87d501a196392

SHA256
cc815ffa28f1bf773d1a2e2d562de1fb4d2bb6f242b91e84bea703d312ca845f

SHA512
2faebb078b1d7559ae571ee76c7a2e7d8a7df2a4f597bf7ad875b4d07dae11c75f23793894d85875903707318a498f1e3471674bd341b3f682beabb844aee1f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab51BA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5630.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit