ba0b89259d39a89845c12c00a86834f7659a531267505d5e0d15f2275a18996b

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f7861c6fa814738777b33a86298bc85.html
Size

25KB
MD5

1f7861c6fa814738777b33a86298bc85
SHA1

651918829016feffe82b26cf8ab124fd5ad9f5dc
SHA256

ba0b89259d39a89845c12c00a86834f7659a531267505d5e0d15f2275a18996b
SHA512

595aecf05943816bc02245ac5dbe22bbfac342d07c02cb08df6bccfcfc3dc60cf7b17b4019fe0dc3489570bf359684617de69067ce9f38206a5cb6c2b6ffadfa
SSDEEP

384:FaTPpz7jFJi3okQrJDXz7jFJiHosQIrDopp8:FqlFtrJDjzFIrDEq

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	IEXPLORE.EXE
File opened (read-only)	\??\V:	IEXPLORE.EXE
File opened (read-only)	\??\Z:	IEXPLORE.EXE
File opened (read-only)	\??\B:	IEXPLORE.EXE
File opened (read-only)	\??\I:	IEXPLORE.EXE
File opened (read-only)	\??\L:	IEXPLORE.EXE
File opened (read-only)	\??\N:	IEXPLORE.EXE
File opened (read-only)	\??\R:	IEXPLORE.EXE
File opened (read-only)	\??\Y:	IEXPLORE.EXE
File opened (read-only)	\??\G:	IEXPLORE.EXE
File opened (read-only)	\??\H:	IEXPLORE.EXE
File opened (read-only)	\??\O:	IEXPLORE.EXE
File opened (read-only)	\??\W:	IEXPLORE.EXE
File opened (read-only)	\??\T:	IEXPLORE.EXE
File opened (read-only)	\??\A:	IEXPLORE.EXE
File opened (read-only)	\??\E:	IEXPLORE.EXE
File opened (read-only)	\??\J:	IEXPLORE.EXE
File opened (read-only)	\??\K:	IEXPLORE.EXE
File opened (read-only)	\??\M:	IEXPLORE.EXE
File opened (read-only)	\??\P:	IEXPLORE.EXE
File opened (read-only)	\??\Q:	IEXPLORE.EXE
File opened (read-only)	\??\U:	IEXPLORE.EXE
File opened (read-only)	\??\X:	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409728497"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08cdd0bb837da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35E63331-A3AB-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cbc6186f461e16dcf635cda56bca413f14e6ba45cc84151972a03efc04b37d73000000000e80000000020000200000009147eaf5bb39d279382502c600d28efd6d9dc0b8dc80468ec111469ff36a9b4120000000fb4b4f087d0523315f5a8678d539ae20bc813e007f522dceee09a6a317f38247400000001d3e612ca4c1e3e1f2ced6101c87343b4b58688c179bc7f4e3dc6aede66ca5df6ee1a26fd938c80ac26933c5fe955eea1674efaf3816e304a5f70be36686c79e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000efeda827754c478e6d889421a5d12fa63f177642cd5041b584748d89658d8b6c000000000e8000000002000020000000c3fc8ea85e46dc4f7d1e9d33ec1a679f4a1d61a399cd77820f25126a1a70281d900000006be236f3ed38c628c433c9622a127bee32e2792a0719648500ef76ab89038b3d52497b00e9a775a6a6ff0c3aafee9d450a20eb6fc289a59a2067b2ca2d549039f62e2f9369f9a53d87728670f722fa965c1739d4c261e0311bbcceca17ffc9003eb392ed1ec0a835cfc6212ec8fbcd3d81f6d2e83ee1749961552ff4f89456b22f02e83250f407a76752f352ddd0e3b840000000adef454437a2a7c3fd5c18370cf2ad43cfe6d9a0b104208496a58c02ec2c337848c733ab5fe5b01f2880327af71c24cf64563c09ec67f255ba0be89ad08265fc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f7861c6fa814738777b33a86298bc85.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Enumerates connected drives
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47149c12c8973929bbbe60fccc11abfb

SHA1
5027b1e2201cfc5df866f670f2eecb857d5ed71a

SHA256
9bf533a01d82e8b5358cac50dc3b4a8f91d1fbe342f2ebd677f387009f204d90

SHA512
338fe36e99ba18be8412b1598c99b1372d39be781dfc6b5ff0cc0eec811003f2928d4fcda8a12da1b8295e0ec5a52a67b5c1e733b3cad3cb523fd9c1690e049c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f9767e6c3c3e9b1d9ed5bbcbf17e046

SHA1
ff428eb4a487699873327e3ccd9c17f70c73e520

SHA256
4359dc493424e651a134cd31456dbaa6b0c9138f03c2bc36198618b0cd26616c

SHA512
d2a867a3cfc9c04b617e92b64abe4cb83cceb82dbe5d835973cf4d7588fd660b7ecdcc04b6a16e335bd46f1271324d730df7f753334c1ac2df54308710535ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a45f5416a1782d463429dc70f89251c3

SHA1
04b779d2a1620c8d87cf2e57acddaf02cd981ecc

SHA256
6c57672e04f9dd3ab450222446e1ccfe45f8d3753fc4b2be5636378042aadbaa

SHA512
d0ceebbaa3e77e0ae7cb9bdd0c48e736db454773b22a43d485ee0ebfbd80fa3fbe4113d313838331125ef74f85c200b0e61d09d8a29ed304486407e82ec3c8d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51068715b1b236760538fa3a39bca125

SHA1
144d282153fb5cfd48882407cc81a2963fd2650c

SHA256
a39fcc6cfef59a587fbb26164e6d1eb206367f700e4a0a0792f96d0732bd82e8

SHA512
9dfe7cf8db2fb0522b2ea7709530196ee6548f93e53423fbde93a9ebef002f56aab85a43ba89160584d61e3786bb0abd218d111cac67d627e2cddbcbb4020685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba14a8b0101a051cdfd361a9e7fbe111

SHA1
c43c5d812215a9dc335816be29cb13193f84456e

SHA256
7a593f12cf20579b6f3bb27eba217ba1876dfce58d0d81d607c92b3416999326

SHA512
de0df989e4f77206df39ef00a128d3398e2dded7333d1e7f7d26609ca85c3d02633b328ce8746d9fa29ee16665eded6e5415d4e4a643b8dbf20953a654941464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094cfa6ae9bc33125b691e02d1d230c2

SHA1
2fc6424fb3cfb435f29af2b807195db3894ab471

SHA256
06bc78d5682e549adb77af135295e1478f414eabb064a4a8bb4aef65d12c5606

SHA512
2c94680c48d5892071b72b44a69dd102e44b5eba6fd3e4abdb37180ddbf312a593cf08d9c0a6af4a2b10d386b1d66a2c143986a163158525bb0403d8cd1d48b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84b720b73cb9aac2c926963f18381210

SHA1
d4875994ff20ac19a1a791b8249eded6e7b140af

SHA256
c88cb467e8be5e5e4ed9896c997c8ddb99d13eeeed25d85ea8efa772597a7f21

SHA512
18b584e6f0ab8d5c1378967e64d1b5f056a0aa778ade8d4d1a074953edb5095f84796f4e543f7dee61ecdccc6e6e6eeab9cb002b9dc552e6fbc07e3bf7d6bddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac394be68639338963eea0e69622d497

SHA1
734adf2e643839d03703e56ee7fabf3cc684b529

SHA256
b5c480eda66e1f3779a89620382e38ea5a6d8f95b0184a9b82bf28dfcdb2bd65

SHA512
262fc1403cded18dddf2354e6b22aeeab24ed2fbbdfb41321ef61c77b98cfb10ec6075105780d53053d4f02331809701b1e161f649df7710fabde3341815be81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e269a505651b0fa28f1dc0d12356c09

SHA1
56294eff25a149643e62bebfc1ccde7f09263316

SHA256
52ee4a3e4e7d390549cd52833886535a87fe546e6fcb6e9760dcb37a02f0f57f

SHA512
10bc97437312c5d9bb7e0ca6a72685bddd500560ec948c405c5dddf40df8efff26073f2aa48d2e4f9b011fde790a2bfb496cb3e6ea114ef4e97cdb08e8b693a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de71ca36d1976d227c432c8bf8bdcd13

SHA1
e7d1ad687ab2bcebde93d1a11f0325137c8eda85

SHA256
78772e5f10e7c7de8b75748a59304390b29c24865be8b5d25a1e169b7f57c579

SHA512
356e65e8d782e8f590996a5ee70b1216d2d78dd75753b5281162408adc6f9a18c372f71e36beac2b2ecde9f451721b4af69da657cc288d6d602324cdd436d229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74e056fc84a6919ef47fe7608ef9b143

SHA1
d361de8414301a7f4ddae2d9a6b1b69faf756055

SHA256
b5d9089253c8f28385e7dfb88310df804eeb10fb5b593e81fbcf35b027fc2f2c

SHA512
9ecec6880f6fed845f51881be574b2d38881b472e4dbd818615e3a2e9f23413429bdeeadcaef743359644a7fce7e6901c8df7dfcb54c5efd542bceacdece2edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e8877be2d05ded155b77424e4f94265

SHA1
58da11ef7fe4ee9681090a076a41581a8a9b9e4e

SHA256
ce4002df216aecfe5fcb277e09bdf124dccbeba5d400d4908804cd66c3d776cc

SHA512
e3a0aca4cb483caa8498b08673ea0712e1989bf3b64f0b434f86305bbc62cbceed7f8ec6719e2a1dd9f6c74ada4f356daf294619a7dcb9bb1999c64cbe2efd71

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC1A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC5C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit