9257bf98f6d2d614fe68ce5fa39244b61a9b7438bbed1d60d3d4388c92058375

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fb315763034a6af3b218510465afd80.html
Size

83KB
MD5

1fb315763034a6af3b218510465afd80
SHA1

6c2c9ef83d9e4ae11ebd001094752194042239e7
SHA256

9257bf98f6d2d614fe68ce5fa39244b61a9b7438bbed1d60d3d4388c92058375
SHA512

950067cb1f6f68f803c6427a8d70c831e4e288b1b532510311ab22a9d4dd06ae126d47b667f6170949e2567033c3da35613fca6c7de4abc33d0de8b64162b658
SSDEEP

1536:CJze9vScQQo0NcNtxNSNeNBNYNoNJNbN+8xQ:CJi9vSca0NcNtxNSNeNBNYNoNJNbN+v

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60825a00b937da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409728874"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000d5db2a9bcc07970415ca3cffe7dc571fdb88ad9500c0c28339495c4104e8396d000000000e800000000200002000000069a5be9294cc1aa58a507e98dfd50fa1b36a1eef26710d206f7a94238244aa57200000005ef15bafa9f53f80ffc5c25919f84111fc60b3a90b27de77e11d8755693a9bf64000000081d35b3681ff6172c3bfdb301d4ca3353592be285353bce0373ca679acc1c60aeb2920a7ecdfceefaca06dd94aa1217898099911ed7843b01adaf15ec0811611	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{161C2E01-A3AC-11EE-A675-6E556AB52A45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000007eda3cd2bd3e457b6dbe008055e1678ab9ca46f3a6761299b8813c60bcdafde9000000000e8000000002000020000000c108d67f645946916ee42a3526ecefa80bcbd7a6d23cc2322c9ce7bdd720804d90000000d69ed486a58df6b3a70efd40e588df190417112598b9ef3e35b604e4c57dab7042e12071f293bb27bb9bc76dc850aa8c0164f646859b84f090d0b61e9178cf1ab458ae9b5642ac870bf8983f4e15436397ac66321b29e3bedd1b0ca8676f9c766044e099f6cd26e23662ab27fc506e8c84f354cd21efed8a4654807e7b8e5e73dc2afac08d5fff7b04b97178019ff5d440000000a631057f2ea029c90cfa07d9047222c730ee7e594823ba2ad4721bbaf1ea8a863ee00f66e184bca0012deec5cf6cfe5f182df507457f7676eb22edfb9327ca8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2056	2228	iexplore.exe	28
PID 2228 wrote to memory of 2056	2228	iexplore.exe	28
PID 2228 wrote to memory of 2056	2228	iexplore.exe	28
PID 2228 wrote to memory of 2056	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fb315763034a6af3b218510465afd80.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
4ea0f61afd52af85f04a48feaca9ea69

SHA1
9fcfc85796020d63e933f4c425200ae9a8c5080f

SHA256
d8beac6eae5e39a34ebb48e02b7e6763b4e97679fbd5c843686619c0236c2c23

SHA512
ba10cfdc53fb1a27ad44ebd03d3e864d0169d108b425840d504d25e96dd616835408ec61d79c3addf9080695e2bc89ba3122d99371a819d5c3dc750fa7317c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4a949af039555b01deb89b8f5ac25fba

SHA1
1c0e12079578fa8f3cc1fbd320752ba7e5e6f600

SHA256
5d01ceeec9cddcc026c3838ea4d5ae65c5ae5ed30424689f6ed896055c5451e7

SHA512
8a058ffd1bc93c7fc6e4707608c9936c928c241d451f8f0fe6e2f870efc73fcf7e71cba67414176a37818791490dcd7fa5d28f4e5e97d4539ef083bd64d4e4d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175e81d2381f9111d98df5980b1f846f

SHA1
126cf5cfe09fefda7bed7fa033355f8c7950f2a3

SHA256
bd37b7046592228992c1923e1d52d22d600c1831859030da28a7ffec6c74a786

SHA512
c8728b5cfa5e5282cd1d3148a2a24c407527cf689d4cd99603ccf0cc538e30d71d4f69d267c3eb6e641fe1c1be7eb41f6cd0e8d162a6e8c7b117ef00795c1c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf9499d839443b3892ce220740073e7

SHA1
80ac9b0418705e382d05f50cea7a441a1f9e5454

SHA256
89e0a202c4dd8a7e3b9dc8ed60157ced0f71f4fe653c71589568bd3703d4bec5

SHA512
c80f855e22c65ff75000f87c2e55e6cb637a4f7ed0e54804c9464a8c0b4a5bd9a08d490ac087f320a9c7dbb2cbdfaadf17df871ef60971eec2f7387f950b4805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e855503e6275382e45abfb2ff921fe

SHA1
81f2446c6747e42b71c9a8e97c0de74350bbb5eb

SHA256
c688eeac4f6096f5a91aba0c9f4c9e42e72169139fe198248804434aad452e6b

SHA512
50fffb29c24713044e3aa2b5c266b9def296637e8eb55e86826e438736aed7c609fea83417f7717a1174e7ba0f6409e066fe597210ca2abfca654db9caffce43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7f746a779eb59dce27fb9c75194d49a

SHA1
59e0d7107c3f1c32d563cb0329d059481c4533ce

SHA256
eea52c4a921b728e5fc0b904f0bf6e259e2782c0860115b65dadb5550310ef2b

SHA512
9ec3871a1964380a40d4b4331f43d0df6d2ba30b9f4982606433c3e8ce816157c8b90de0a37aa7a6eab37b60154c68f68dd9f57508023e687b9f121c2b595f91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf027a9bc1928a4d0f9e1eed9b339a0

SHA1
1ff6a2f12ffb5efc2a4be20fbed1ec0794157d6a

SHA256
060cd49b90d9a57d57e64bc0b70b26fc3037742fb92365db8907687553a9b7c4

SHA512
4145f646060666f036015c842f9d517989df7dd96df7916d4c8dd7accb9a8ef6175944d98d111397267446d128e7b135eb2eb80868d09cd16cf4b275de27ae62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BCB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BDE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit