e172c9f9b406a6cd536e0aeb5fa941a84aa9399c0298638ca866ce030416c382

Analysis

max time kernel
1s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f8747756a37e9c201b6a2c60fa9e2f5.html
Size

53KB
MD5

1f8747756a37e9c201b6a2c60fa9e2f5
SHA1

5889052d8e271a455d2eb4a1b01a581b16076b9b
SHA256

e172c9f9b406a6cd536e0aeb5fa941a84aa9399c0298638ca866ce030416c382
SHA512

32362718967e80f51de128e099c1c32f47d9aa518ecb4133333ab860fcf8063ec7c492899c96c73c9a9400d3941c7448f9a5352d2586a600a1ab839308a36264
SSDEEP

1536:CkgUiIakTqGivi+PyURrunlYs63Nj+q5Vy0R0w2AzTICbbCoV/t9M/dNwIUTDmD+:CkgUiIakTqGivi+PyURrunlYs63Nj+qx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48E4D221-A559-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f8747756a37e9c201b6a2c60fa9e2f5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0e3f926d719cb55cea4d4291989011a

SHA1
b301e8ba34c84fa8f06e4aad545279a408700bc3

SHA256
b33001d458e6ab6f9e9be117fc9b5c3fca3fe113f6467452176ca7a3fe8563e6

SHA512
557c7bcf1972879650b7f2dd0e398879bc5e95d5c9b832aa4d96ce487769353bc43220d824252fb7ff0506d8fdbb88c5e100c237b3d9c3811a176fc73cfa5600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5ce1d03be6a27294714b6bc0bf86608

SHA1
7d99277dd1b964d0228b16bdf6610a57e24d9c79

SHA256
ca7d0575d7b59e4a679d0ffa59741d64e928365e09a79c75a415f91308459e87

SHA512
77b9d0bc5a1721a3becc8e80ad3f738c3308d7d019fbd424436792a2b94c488662e48c89d0e2c3147b0680d5905826c332d5049239b9b881d23b0fde737d0c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57edd0d123d7003ac7fc0f93d99170d8

SHA1
e000d8863c7a919574b4abf88c5807309c715a1e

SHA256
fa520cfcb660328253eb8de908b7fe36b4b017461c3ca7ce5cf71f340e12706c

SHA512
ac7c95c7b8b1dfc489cccca659fa2fd8367efa2e1df3046df0a1039fb481d3b8deb0fe71c7afa897154e110591ddeccb0c43348a75f28c2b060463f3a5edaddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4448d95544ba79d21f3c4034cd7acdca

SHA1
78cb43fe379919b49a009a762ae0d2289a36a5ed

SHA256
e2ae754fcb5da471aa8c3e1787305536736fad2c875d4d9b083392fff2914a95

SHA512
e21ede18ee93bf73116711031d7dab77405bfc1087a92d86e35cf45ce5ce7e54e5fee8d1fa8a1716fd5db8999904d93a7700258812c9dfddd87eeed36c5fea0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c971039238a31656fadd8e9ddf7b02f

SHA1
73c662a902584786b74eae54464fa0fdaa9267f7

SHA256
413ac3724c6445e47d8043ccb3503f37c442489b79f2db7629e86b3f68304cf5

SHA512
02cff9e0c7a298faa9336ddca375264688b2d628a812d1c71922cf88d8dd607894a8d074cdda89be5c74973942ec5bc144c2e48c50226e99ba3b9d863775b255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ebcc76794d6c41f507b1bcaff6f5f81

SHA1
87af9d7c4e6fcf9e00c5eea4ae1c8630e9b7d74a

SHA256
fb67242b5df0192940c41a6f7f7bbcf0c88a65d6d77d78b903de0944520bfbca

SHA512
e437a00c8ee2a1355ef35739b73b07b9595898b6773753c1dd1737f7e710c4d48baa14f43cd14c133d1906bb8cc95dddbfc7cf8a6e2e5c0cb235485876505452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\star[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4125.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar598A.tmp

Filesize
31KB

MD5
c5c6dc4b516684a30a49d2bf451c9c6e

SHA1
7eb6c4b5920c99795edff782d959a23ba762491a

SHA256
aaa49717860155b9eabe6103016a70e21c5655815557fa5b138cf087741d2f9b

SHA512
d3656cd83e24d7d1024e95d552636f1f0a3352f380cfcb739d9105e1cdc396ee28957abd15ab5accb9c1f7a29bc866f9845b515fda681c107c413cd1301abb8e

Download Submit