7c98f1c8dc9ba698d47eaf2486b235ee1166922608d47f52b802629decc3dbf1

Analysis

max time kernel
140s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2131224ed4e1f50f4e909e30ca7ad274.html
Size

5KB
MD5

2131224ed4e1f50f4e909e30ca7ad274
SHA1

5bb40e26de8cec83f37292ac4de6f4736867ccea
SHA256

7c98f1c8dc9ba698d47eaf2486b235ee1166922608d47f52b802629decc3dbf1
SHA512

267aa3a689e453145ed5909558f7f832540c64c446ced6fe3e9c4acee6ae3169d8564f5e741f57ccfd02f4f417645550467303e3a44bfb80fe49ad471b1a31b2
SSDEEP

96:BoaHneI5cvPsVKlsoUW9WPkbJWFkzWPkBWFkeWPkoWPkE:B8I5cv0VosoKk6kgkWkhkXkE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC1BC081-A569-11EE-8CF2-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a618a97639da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007322eed6193f69f4ad5de51e84281206de96a2189e41bbb33e7bbdc178b72b0c000000000e8000000002000020000000cd3c06d5d43b6a369abfaa93ec930760d4ac60ef02e02462fe70344a0415eb3820000000be211160dcb11ba339f763f96c7a4a08fb84bcb6b0716603e975a313860fdc74400000002aa01a3a85e46f166eb2947fafb5fb2df3fe6673e4b696fc89c6560e617a2df504bdd75d53e18dba4cdf8290781dc752b7bbb89a68947cc4324d2b981d3df1da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409920303"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000016c0fb4bd354353290b2f00a16190ca505e110144edbbb04fdadb8527beb3fb1000000000e8000000002000020000000b9c6d90427e2876819833471988b26d359aab04732e9c69b044e0e305042853a900000000713f4026727f3aca449e59b82278f4dbba673a73dade1ce9f2bf7ee7726d3d9d127421ecc4e54a07d8a57760c285eae14bb8cfd7946896453e878d255cbd34c0f8f9f26a5eb0da7e100492458232508b6633c7e3f5d94621cd5c7dac8f4320ee31186511e3b0cd7ba5ed5a67e095fd0c1f78c9875378f708752f6679afec10d6c8018a6f4c28d685423189e649001b34000000094f9ab29f0301a000ed9087ca9e298c7652db40c0cace9cf85553189112fdc423889b1969e90131542405ecdb67bb96a1de80d4ff1d28d5e2f822618e40edc1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2352	2212	iexplore.exe	28
PID 2212 wrote to memory of 2352	2212	iexplore.exe	28
PID 2212 wrote to memory of 2352	2212	iexplore.exe	28
PID 2212 wrote to memory of 2352	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2131224ed4e1f50f4e909e30ca7ad274.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feb30c45291b9ed3c2bd03cd97760c1d

SHA1
a96a76f472a9b5219d6c5d31005c65384df111a6

SHA256
362f40626554e4384677ba76420bd02d675590dc777668aa77f8f3b9cc28d2bf

SHA512
40223870a834b367aecad449d97c777ca7693fd5bac5cd291d58ba05f43c907498f274bdcbc173d0d10500c1befca058e204dd5848e3a821453d10a63d2bfd02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0502d2984748f5a1bcb30d0de1e1e96

SHA1
48d23ca35ae823ebfe888c0f86ded410cb482708

SHA256
f4f57fb6c65b701ffe01e31f52b90687d10f8b31f9d7ecffb992b8974934cef6

SHA512
4e7c34adf4ff4da8d90609c58eabefd155f3a09a404a21364632ccbfb01f19a2a16b963f1e7176fac9fee119beb0de32135900a969237768b4624cbce4ed861c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d48dadf98cd0ecf3c5fae7c0aba0ce0

SHA1
888652f69334c59a26c1b13ad122f5e285195178

SHA256
384ecd430f3545f8503a618673439c41d7c40a9e29b6ac478e82ff5433bf9839

SHA512
9f8f6ddaad310f70855b82fc0e31b4c6e48aba3267e677d2b22d466ed350e11cc9e2b4cb99bc4cdc4b23a089620d8d5ca7a18226bd27fe55b673b95b5fc84781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f0d3e6f7ed8740df5cf1453c29163d8

SHA1
fdfc140d190ca7264e4d0be99765d9e79c807a2b

SHA256
433f904c93af9a484e5b297831e8edc49649a5b52bb6c9e7da9c9f8c68de3bbc

SHA512
b5f910a0452a6f0745b735cf94d66524432347b86fdfb20ab11025ce334c008aa8bd2bf0e4afb82fa37846f98c3e6c302cff02ca9e02c5a68e7bcb8ab0c774fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4d497622818212158daa1bc85729dc

SHA1
41e16bec6e0f3c23bbd71eba00c70f2aed45ef21

SHA256
5786b0cfad91b9849ac06e250c93e4edf68cbbdd72b41863cbae6e4d4fcbbef5

SHA512
01bac9c15fb7a714a00eda1ad45f30ae4215da6c1533b42804fde144e2d89e64eb8998e769efee4ae48d16c25ab60d39058e7447feee1500fc672c6ff6586c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d45e0b7d35867a223f18014f2ad10ee

SHA1
9445aca5b80be87ed4f493c6e835f1457c54bfeb

SHA256
056508b51263adef22da822cfa33a7ce5f43c913b4ffd4a5f8effe8bbcb80b14

SHA512
dfee5f8973d7c49758beaff3d1d8c7507087eab4f47163f8c6aafe5e0b4d24bd9644769ef0c323c68053097cddfae40489f9c42d0358ea6d94b7dbeee191e4bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c2c3b433fe56e2b2701795d7b22414b

SHA1
a57651be890a9eceddbd54a727278a2b1c33c783

SHA256
00ab431a9f6b6affd6496624f8606389f1d71be766276c2ade3b21504f75fb7c

SHA512
fdf23c2ccd947c84acca0d47a6433a0b678bec8ddb04f6e8e9120e21921a7cc2dbaccfbe123a4fb18b8bc6c8c68051b29e995cb60f0b43ce309c1d28bc9c0bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2f3a2df1d4d940b98be65d58497477c

SHA1
e0c24b61bac8478da2357c72a867942e4b6b1054

SHA256
9549b2555b69d72f38bb93780948a282077f93e6c0073bd621ce7998842bdac3

SHA512
b1b2c4485e73b014d5a326347fd56e751e352540754e109c55f6eaf9b8852995eb74db38689ec68ba165709527a809de712337790ebfaf0fdf572b7048745114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f22d28613d1be16cb0073cc7c1e31f1

SHA1
13949d9e449a7885ccf4cc984c9d8b001b0160d5

SHA256
d80e7cc6dd94f804b10da9f0412b73d7838cde663d5a3536341675876136d824

SHA512
232122cf1c01faa26b63bf828b552f3b3550a270f3046755cbbcd4295ddcdfcf05bc63c1e7ccad273a8015e2089718f23676c858e0f6acc67b887f7b1141b031

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA67D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA902.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit