d0ed73ac07ec4ec7ac04241f926a3f3c2bf97607f9f971b632f805282df927f5

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1e8099ca80049abed5c17d24461eb8b0.html
Size

7KB
MD5

1e8099ca80049abed5c17d24461eb8b0
SHA1

b3ba43e50077add42deefc9b6f6d623f7a627663
SHA256

d0ed73ac07ec4ec7ac04241f926a3f3c2bf97607f9f971b632f805282df927f5
SHA512

f103352bd9f14910a226efbb767ec689a98342ebbc20710138e0910eb4874d15226a77f90d34784ecca8375d320c0e8cd63e2aba2f5b6df309bfd6edbe93d65d
SSDEEP

192:ln8uqnGDSSW0nqFwj2oC0t8IlwFDa8a12GnJvPRV6FGLtM:ln8uqnGDnW0qFwj2ott8IlwFDa8a1vnC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{058D0551-A3A7-11EE-A76C-6E3D54FB2439} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000cde5190f82abf262cb2fd8eabce3b4c55f5e0a2da000d0bc82786267fdc9f3ad000000000e8000000002000020000000df8b08a22640240a7d0e6f6fd9ddcad151949955d9a1f9075b2bc285e45f275320000000b67eeeaffa4ac8e782e16d76a38e6914fc33e55bf9ae3b032fe143e1e7779e2140000000a9a1183b407ebe13fa61e172804d574a10cd5e8f89959c6f243e2b686c3c54699669c2e1076b0357c72cd07117ea5322a46e3224a5590b67666c9aa5a300658e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000bd90dc9d463c2a7aadbd70fa16670b447f6e84094832d4e2207d72efb0ce4647000000000e8000000002000020000000825cd2828011be0c7929c094664e95814476023381ef9f190132331a95b18cd890000000643d2653b7e16824d970278c1943df677f2062c5926adaacc37eb9a49b4524d66fcde62cc14788fce2fa09c8bf2fca33d7ca6fbcf65ab8bcf2c2c152838956178e1ed7a21ea39455c3b680acf528753d1d423d81d0e8ce9e50f5acfd99a026a50ac0c071d37a5f39adb902df03c9fc3cd38ecbe1f00dac694230e75b96d4e5649bb54edfc42dd730e3b9d8ae855ff59240000000c29779ee6a4c690868ab3638697ebde559f11d7056e67417a8dc0ada0e66007c4568fd03dce07c81df36c989740f681e3eca4b1a5f9de954673781574c413422	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01c8edeb337da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409726711"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1820	iexplore.exe
1820	iexplore.exe
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1824	1820	iexplore.exe	28
PID 1820 wrote to memory of 1824	1820	iexplore.exe	28
PID 1820 wrote to memory of 1824	1820	iexplore.exe	28
PID 1820 wrote to memory of 1824	1820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e8099ca80049abed5c17d24461eb8b0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a1fcb145ebc762b3099174537ca612a

SHA1
be328493f418b9bc187cbb084c1ca560d642d8ad

SHA256
a572dc4cde9bdc719be658a344083a9cdec497552c4f7cd43f6bd7d451e53901

SHA512
eaba93a89da9f8de676cca602efb18675ab41105d1dfb876a7d503e58366c23a490c48db95f967196bfa8133eef2337d44dcb7ff0b66d2730b63074274bc1cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0fba2a1cf4f2b409497fa443346aa2c

SHA1
ff59a512f28b0984b268181955fb6bc831e7950c

SHA256
582dc875ade3f47283fd10d48f959a0b79bc89f9751f7aaad53bc5d6abdc3c9a

SHA512
656fdba6f5ee3b52006cad17e44302ccf08bb55092afdd0cbf9df2fd1771f6e8422659a03fb69ceecc704c45906f500d7918954aa4836967b472ad7cb39e736c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81adacd27e9698ddbb2006cf6b201742

SHA1
9336175354a4f19901415102e0fe2a66f7e06d5c

SHA256
1369255b6da9751555c173a5e4182fa6a6b9af177a5ca895f1b927b2d5b03530

SHA512
25199f8f6b63467c2b108d85c146945ecca583817c919bab7b11ec6876c74bea584f532118cfedb225eda57d18a9a1901e747d74a9f5b068642868892c60782c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c5a20d964099fdb00f929ed9554330

SHA1
be50544b2bc139322b0304de08c4b854cfaf1fb2

SHA256
c18b65f6e6bb3f503af9264092db6a374e8967d717f91f2a723e405195b73dd5

SHA512
5d908111360383e861b1a658e7dfbef6782fb9925b145e67dbd59eaa0c6e45b512a62a2b87114b6dd6e80c2ec727f384841dc9065f083691a8c28e1fad86d899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa0c3be708aca44ea366570ab3fb354e

SHA1
a3cfb2404a9c8a7b1215d0c692e422986994b853

SHA256
6c10c3f5a13d650dc2398f87f8bed5295aec0c038c6a8ad1b0012f336cff7766

SHA512
2973322862665eb3e6f66891c98cd8adec943c8ac9444bd303901b0986b25139f1e7e70d17bae91d4c88b7e83f103bd0cfb6c2dee116738df587e3fd2e49c41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd8414ebacb0c9beca19253be1869ccb

SHA1
a70a28ff2cb76eca75f045e3452cc1fd44a03c55

SHA256
33d777494402d914672911b8d78f17de47a0f6481a7be49a2f22ae348df1203b

SHA512
b49d925ba190bc909bd3a1e06b28efb8cc618648ced78309b84667f882eb388eb68451d553b8e1b2287c969c6af23d66df54757991b412a36e0a0c7d6bc8089b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95cc2fbc6edc5d8b94e0652901957adf

SHA1
956e935b56309b5661ae8bee0a4cbbe2fefab415

SHA256
b2c2483348ea2a66453ae1301ddd9c97fbb00dab6064ae428f05bce097ba8799

SHA512
bcee906b51f6104993f5cd354a4c611a5ad2d7414d551d852d1627300bba8a9d02cf642988c2e44cc979647a19d57f57d154ef0841980569a7f04b0a09f3ae7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E9A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F29.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit