e796f10324f2201a132f3bbf9c66c1e82c93639f6620bb2b27b6e746537de171

Analysis

max time kernel
118s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26d4bbf12e3ac0a5bf6d996df6fd0164.html
Size

6KB
MD5

26d4bbf12e3ac0a5bf6d996df6fd0164
SHA1

fb651b25c47fc780b54ae1f58c1bbdaaefd86d24
SHA256

e796f10324f2201a132f3bbf9c66c1e82c93639f6620bb2b27b6e746537de171
SHA512

ede76a0595fe5fee10b34e44ee57a25cc660cb9aa0ce35e1a2b21f792268e8bdbb992250136d770d36f9af4dfef4d7dee0ab3b62be54444916244df94c5a87a6
SSDEEP

96:uzVs+ux7IvLLY1k9o84d12ef7CSTUSScEZ7ru7f:csz7IvAYS/eb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002246954faca2eda0b699b3dd3d24d9d8b547c90773f794ca259963440ac15b36000000000e8000000002000020000000ea85d021fa2b4c668dd23b362910da1819dba5439579869269329f89b6f100fc900000006a8a44a96de5667de4a1c2343a06881a4dce3c73859edaa710cc9c09faf24f1670d220ca0da2d113cdace60de8e3f6e78b683ad64521980c06f1ea1f397f91084e39f6797494262b67065213794b21c3eb203844919873f890e36f40d3ffd43bb6ae8201e124057364d6402c7b30be05d23aed801d39444aef4fcf7cd743973d38fa8f0ab238bbd01befa4786fb9262c40000000161afe5f4cc4f9c161e7a260b2e81a0d4103b460a957dc931970e59ffbfbcd37e92fac00eed3f56f148786363f7aa4bc71ff21867350525f159e6701e8a5e2aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c728edd737da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409742192"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{180C6491-A3CB-11EE-9240-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f56645cea1fff5d180d46035d3cea1d1d57bbae6a425342f61e00675a4e58fff000000000e800000000200002000000012c7a1dfff1b33edf04b2af49d2ae7be3da93448ba7305e4126581feef8ba6dc20000000e382cb15fa2af8c1e117cb4cd4ded56de538cec5076026e9d93bf533f040037340000000d140933f8bfe7ffd168e9ceb9316058e5b5e2ce4a6a330771018bd9a9eb9696dd2a71f784048adad2cf21db97277a31bee4bed851e17e39b7c4de29802367185	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2336	1984	iexplore.exe	28
PID 1984 wrote to memory of 2336	1984	iexplore.exe	28
PID 1984 wrote to memory of 2336	1984	iexplore.exe	28
PID 1984 wrote to memory of 2336	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26d4bbf12e3ac0a5bf6d996df6fd0164.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c03a5c23c27764b7979aa899aa7c1c16

SHA1
e4a2d282a27536551aa5341710edcf9cdaecedcc

SHA256
880a78f59521fd2bdd04e7ebeb7cd6ac4b4cbfcdf49a2c90f0d5b1c438bb5c44

SHA512
8ada2bc434934b7f6956643d8c42570a332106bec46f3be5c410ba3ff6ca67be6be63f48be015cfe42b5262235f4e5e214a7898a6ea8c846053325b68e6cdd07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7df96c0551c96408157daa87708194b9

SHA1
c46e452158fc8fde12bde6bdca4ab20962e9deaa

SHA256
62c8834449e33c2ad21735b19bf1f87de071dad5c049c62c1f40c99dfd5b19d4

SHA512
94ab1cda14fba370da9599f45df0e28793587d502800946f2f656c33b0879845f8c6c5759dec124e3bc5bf48881a7e3904bc1ea76aa753c24636a83d41a1eca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85039cd567264fb855670b7d6b20b814

SHA1
e4318708ba731c2fb17cacc8b5aea36e4ec24811

SHA256
31ffb1f627d3cb946c952e599f0b4d2ecef01a972c88efb3254a0b4d50f83c14

SHA512
912b66364ca7717a84b35d52225fe0702be21035b6962bae20a5ce521c0531def1d2f57fec1816b89678d84b309ef69c5fcc7fc1cb4ee7496c081928391670e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efc497430825dc2ce1c2ce602d1445a9

SHA1
5734cbf29738f5d788d10e86c83f25e456885034

SHA256
accbd6e0e4bc4949c09676d42bc5aa76199d0e619a24f87720b7bd93c27ef30c

SHA512
9053463562f42d8df3885e53f4d28b88c04214e40cf16f8cc906034d0048b6c9bb1f6ee498b230529a0607f6d45359e19453fc263cbeb044dcda638cda42dc39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5212cde1d494c3625eb322dadc0d32d

SHA1
508c9179485bbd6ba62d9e9979524e2997c85a7d

SHA256
58d574a10bcb8f0774a442fd4b967ce6fcb0f5e3eefcb2f632dade1f63ea331d

SHA512
8ab8a94f3a53c1a62a94c84fc820e08e3dee107ad496c474db9a79f3dc49a6b68555402c8263e51770d65e3da1e6bfdb1cfcd0ee592233561cea3e14df68a7db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ed3deeac7ed6cc4ca40fd646c8afc64

SHA1
5b43c137210719eda788e082afeeb0ec0beaca91

SHA256
43914025d725a3b263885b1a125555e9e62be0444e5809dfa2c24eceaca49ce4

SHA512
2be3bea2b6e1af973cf5d0ff7daec6a0c3bda7ce4a33552dd9786695b28cce4d613ba7688ac5ffa2e8de00b436cc87a8353cf32c1cf81f000c07e0119ab2d948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b38f3abfadccfcc7c9a520168ad78174

SHA1
ce0fd8c8b57e3750e1085c0459a57656df674f7e

SHA256
e6bc30b56691c1f3f27a96625dcf414fe5582dae3f4d3abdb4350ba91d28d456

SHA512
91061202f5f73c3b4f1fe16478ea3ee692073d981dc45e2f7580d65b269359c3a7d52b931ec8ae19c22055719418e6d2503bba67a53d72e25aa6f47fd2ba8f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BDC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C6D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit