6323c08e5fcf3ad9f5e3dcea7604e3a9d805fbceee4a07615469ee803ba0984b

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2272ec34ecf9a5500338b48e795478e1.html
Size

2KB
MD5

2272ec34ecf9a5500338b48e795478e1
SHA1

608657a7b556010fb0cac0535c05411e56ac19e8
SHA256

6323c08e5fcf3ad9f5e3dcea7604e3a9d805fbceee4a07615469ee803ba0984b
SHA512

721d1500d59580a7ab33254d0853722aa34ce9eec857522f8582e5d633f2721eb2f03a2e2ebb263ca937cb3e6b54f57329e88abb2aa2dcf765193075518dc918

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ff66490b1e63e2e8d24dd797fb915cce613874f4e0560634cb3d16517d305458000000000e800000000200002000000082553e80385e3a3f5573d75ef1eb2fd13a7b065de976218ac7cfe501d703e55690000000927a5828b399d49082bc2b5f89fa5d577399994d9a5209642d025c6fd6759f621f0487dab965c381af1d4abe2e7aac3aa5978a7d77de9f7594e115641e48d0190231aab72c90c9fa10e9d69193987062eecd840a69c52cfab81e13f574cc32f638ae127a5946a65e2ff1bc92f87875e5a9769372b2e0d5b5ae91f429812cbb92a12e554d2e50cbcc035c7c81e13dadcf40000000eaf6f4dc79bc3617229c4328bd599184663f4a6956e51279ca0e106aeb05d434e8ff09a87a62438490e0d2cbea91b93d0887e7bb8869f7630ea0797efd301256	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B6D9A81-A575-11EE-AE8B-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000733fd969985a5e2fc5e11fdc2a88d4ff950c71a68053c36e88ebaa777a71b888000000000e800000000200002000000017cd2fb877b356571f28f61dc06b4ab5446f08a738d60c5aba4a2539ef66234e200000009d7981dccd3945e52d13671042ba81152b9b0440ae6cd8b99cc1e53d3cec3d49400000006a819d49fb5f612daea2a9277ebe058135325da39289986722c92d720685e8fca85ef326a2b2369d51cba309d43de6f3ec2351e724fcf8adb8789874e1b84897	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007f96028239da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409925188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2340	2316	iexplore.exe	21
PID 2316 wrote to memory of 2340	2316	iexplore.exe	21
PID 2316 wrote to memory of 2340	2316	iexplore.exe	21
PID 2316 wrote to memory of 2340	2316	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2272ec34ecf9a5500338b48e795478e1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bca31bdb0576c36180dd5e05f47d8c0

SHA1
fdebcf135839a409377388a3a2897d887c5de857

SHA256
2d9aba35bddc4277e8ad31cb6c2ee0cc880686db032d423d851641ff65bb5877

SHA512
01423effbaed8ffdff88e50278258bba9b5bdbebee44533bc79ee710c09e68345efb5f56535833edfa50b9a8283ff59a7bb626b4de3ff5bfe67900c6264ed466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14804e7bfece485a5a3d8c55bd754d04

SHA1
63940c99aada7856e207341abd342e1494354323

SHA256
3f0040ddc8b5ef19965eea81a96eb11ebecc6e3d644b49905bdd75bbd366dddf

SHA512
dda206b9cee8c0c65698cc607a5c060cb62f865d819332319a8d27f69311d7d60a79a5617b2df2b9171b15282bac60c63da0e7f0819497139d0d8e6566aa57d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
718ce5c78fdcfa626bb473d43e2f704d

SHA1
917580bec448bddd627fae0e0a29f3c31a7da539

SHA256
c6a5881d63817902adc1fe0fb1640f54b6f40ce319125dd6bef526530fbbd7ce

SHA512
0072d0eeea094e0ab1699d57608112b8bff6ad271f3fbd70920f9862cf95662c80b3fad3ed9898d9c95443eeca671108272c3ade772734903e73bd8597d57c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae426d2a51882ec46d37946d969dc36

SHA1
2b8579f52c639e3835612e685eb9dc0cbe9761f4

SHA256
9d7fbf89b0ee8ddf6a43c29a1476eee47b5b8df79fa6faae4816df2d2260deee

SHA512
e7af30c6b0eb6265780a5e8eef31965cd9f3dddcd92ee241539a94d6f78aa3d64afe74fe2343d30e988b4d551cdd930977854b1b8d8959516390bf3d6cd32938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce46efdac2bf3d09025002fe5ae950ed

SHA1
d270fe76c22c827e91de93a85e2974ca14091ca1

SHA256
41b058c2bc76d9ca443afae6df579495bc5fb4540331f8678855784637668709

SHA512
ea4adf8987fe7074f16cdd47211872af9ccf58926e31826dc39e83fda6e7390bbac87b20713d3f2044d0fc8d94f14f0be2568d57407487a7f64017207180c3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de71bfd89e6c52b95a8009d4dba4a521

SHA1
b6fe623ee5ad99295864880359873b8c69e16b68

SHA256
2235881cdf5dff7d2b71143fb916a1847877e72af12d3689eded3177810939b5

SHA512
8372b76b0bbb7eb6d4497b013d93cc7e3b4fa863e5ef2a4aeb86c49feb224725aa018fd0e3166bce1cd944f4f7b89acc78646e42ce23d14b866aadf641f53335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
547d039dece533f4ada6efbdd98cd741

SHA1
844a6814d8dd8896ece39e31dea23bbfef7d2f4a

SHA256
47a90bc1603523d906f433c1576b4847d6b96393ee3e87092a9b47c6cadfa5ac

SHA512
2fe34f04189cc297d0fed0f50f0b3a99cca786a7442d82acf5067a9f8b306e1c6b2a1cdf80e23412688edef88e3ed0a84a829e355e750d41836b6319e8ef5a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ac2a70f7b8e8fd61a489aa1c77fdea

SHA1
958043ee531f117bbb78317244d3da9fbd87b7ae

SHA256
c95a36b59f1f83a108046a3b961e62dbaf54947e45b94e9f37bee4d2f7b9071b

SHA512
34f0033b4cce3cf152ab2011cab47b0574bb832fdcacc61c92c4aa403c9d2172f064f79e501b03e51ed7c3b50c5c58f9c378fc1adc00975a51b1efdcd901d8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c64c3ef9ec1bfed931d5119dabc99eb

SHA1
ef5a53a24b1384835e2146bf56a4b931883aa162

SHA256
be4aa561eef9375d216b048df53ab0fe4b53f19fa57d4c5d2c6852d155c04929

SHA512
68876120e2af6a41705235ae0f0ede1a96a8768cb9c8fc83a858ca90a4d8e4bf6ea8ac6fd24a084026c421c86c90dc0f90632db5211f2db4828bd9db223a6901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f9d6915d86c1e3dfb3117b04ac64274

SHA1
760a57e8c00dbab7154af31aebb147b2b1326715

SHA256
5738f6d6e8ddf42e374e43155f2741c87482d531960520948871d3cc1ed2cff9

SHA512
89cb1d13229e6863d02ac4ead70a68a186f708ad2ceb463b4c1b2ed62e15ba27fe0cf0d0bf749f993640e19c1c51843d4fcd049441cc1bcf284505149ed3efd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49d6b2446c7bb1a0449a8cca15a12bc

SHA1
a23961f7878336ae4a8e6189cd2daf44b8ba8209

SHA256
e0cc89c2d73baf19d1c4ccc2b145fa33a932734f4a498d75ebc14112665310c7

SHA512
d5e85afff39db01fe9f09dd4f8fd0a7a8498143ba70f5b3689b1c5dfdf977a9b14aab5b3ca0ce0404b66176ce42e9dfc9ef5b2435dfe24d13636ab17397a6afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FEE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4080.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit