db91d0ffa206ef53e1a6f6bc7271a1303761629393ff7945934199cbe85279be

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20662707553e702d277382d9961af2c5.html
Size

5KB
MD5

20662707553e702d277382d9961af2c5
SHA1

2aefca44d9fde5410634ed80a4541ec243f14f3a
SHA256

db91d0ffa206ef53e1a6f6bc7271a1303761629393ff7945934199cbe85279be
SHA512

8ef1592fa78f788ed78c093150c7bf3531e7d07b7659e1be8b14b9705ea36549838bd66b1d0f6f21c7215f085b6f62716c50a4bf3b94aaadcefb0c75ba960b49
SSDEEP

96:G753J5eoIfP9NpQnzuiFfSNVfV0oOvMXhA4fCfUI/X0QDOKXVFqp3wXPfiI9xoz+:855YoUFTsMOvdcI/7DOKOp3EfCAYhe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA175461-A3AF-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409730405"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f18f61e80610135fcd753d0844a109cbbd2721b8edf9073e067960314b12780e000000000e8000000002000020000000475c7289525050173641a962396b62373163a3f469df76af73115f55561cd57020000000f2e663a95e4184b6097cb39deceefe19e34d53f7992064834d72438eeb58f0ac40000000dcd4f286ca4ef300f24c4ff0c07c14a0d8f8af0fd0dde5ccb07ac249bdfdd0402b45304d3228187a05467b14df3eb9da45972433f2f51be031f2f4b4a2fd0233	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408b7099bc37da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000009013e4d5940b53d52ae5c6c269355db5c72ce93f01d17eef9c2eca7294a57856000000000e8000000002000020000000aa13ba5086464d5e5994b455e199e9410bc1d83937f230e88a20b2601320f60b9000000041f97450448e3db21cd566e5aa8986a5b1073ef5d3c96199de53887f07098858cd8006a4cbafe82c540e86f8dca6d3762ca246a741a70107e9ea8c28948168f208a8c5a1c5e92d80959e1f1dd75c92a91c65ec03abcff7ffdab939f547e3329d2ee26c03a1b69078b5dcbbaad089b968b116cc307b7e5df1a7185806fe1809610388deb08404b70d40ef6b280191eaba40000000fb68753f97aedc85d910fd86d03144d5e4ff4040a582fb372f2f84350bdaa7211a59b96fe46071a2553c2cffb1f2537ffb43ca71935a46c731463642a3db06ca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2608	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2608	iexplore.exe
2608	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2232	2608	iexplore.exe	28
PID 2608 wrote to memory of 2232	2608	iexplore.exe	28
PID 2608 wrote to memory of 2232	2608	iexplore.exe	28
PID 2608 wrote to memory of 2232	2608	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20662707553e702d277382d9961af2c5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8124d156b4c618d8ceeabc6e0ee493e4

SHA1
0ecb00cd84708ddd002af9da578fa24c099087be

SHA256
1b225fdff962a4ddc47ece0d3668c681444b63b3ebb1ef35b3a017df25ae3574

SHA512
161c8181438f7f25f6e8d4e10783496075bc2579116a48a8d3dbc4198574a6e4699c7292c19e82167dc97dcd1b9a2d8795d1eda7eff97d9416d5451052f9e788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
160940363ad14a343c580af744d4b241

SHA1
3dc99314d706dd13d503ee0924e664c7b95dda0b

SHA256
3ee85a426e01b5312f3272f6239e839bed660542f31d7c56652906dc34672c64

SHA512
673d366201fa732001e819e18a1fda3fedb97c4fc4ef05aaa371fc5280427789670f51000ce92d6a2538ac8e52ca0a129dd81850f956cb4888298b1bbf269815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76031d4ff1028631d0b56fd4f9d54718

SHA1
11f04403b667fa3a5e14c491dc4ca5f41fe6d2e3

SHA256
ae77d8b5b78c2bd9661ab1c3ce2e3ba7e5e4bb95980d29c99f03bc21bc7701e4

SHA512
aed2a0c92c1b57e37921f19a2545a9b6bbbc32ac0d876881e58ab64560102c91915543e859ff618ce5e516bb0ecb9dea36bd0021b17d45b88943369b3af2aae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c773e5b67f3a8800d4ac8e253cc2ab9

SHA1
b5a0f35dc6e23d8424add57ebd7e68c2a8b691a2

SHA256
3e6a1f91cdd44504e0b1962ae423273e3fa4cc9086ca96031ad88e3225c03458

SHA512
d622fca88cf6a29d4c9774291b6b3c7aa4a8d4ee6893bfb195f622c996231f5669cfa90cb5fb6c74bc6ed00e128e51fd9f5ab91b2500d0f8e07146f360441c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb2a974fb6a2d575a77455eb8047100e

SHA1
2810f835c30e48d0557fb4ed37f4e35f68028432

SHA256
9f74d90f735d5ea2b12da349c41b8c507a7870040a68c477eb05a951ad75b584

SHA512
bfe08ebcfb9af557b8d538370b1aefa04b70c0fe73b62f5577fd229d08b5a20b886d7012d65b736d3eed3849c37e61833a7ff03ece9904ac6857321425fa483a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
337351ca47a2850644be41815b96411d

SHA1
84b4edd4223d712a8a1f8fb6c32f4960fc090bb9

SHA256
5e826f2f4bc45db6866c8c28a4b7b57d487042135f51052bbfede6f3e9b18eb8

SHA512
aef0d8879de4d06a135ed596ca959fb6e3e0377a6a3b2fc7d4a6bffea9e11e45fe5f9382b63336ad1d2ac783f69282ff1631be00d6e806a2dbcbb561ee5b1810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc037649e5a27478ddcc7114e7aa709c

SHA1
07878794e8f4baffe66f193870a2411391e95308

SHA256
46379029e0e23046026e6bbccf4e624c86b71eaad93b9d82f541ddf20ba0ef3e

SHA512
6e3ab673569f86ae739c640b0af87237126731b2519d4e144e0515351d55c74fc3d4ef4df4016dfe043dbc2bef1a6bff922576edcab7958a30ff7056382b0c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2227.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit