cf2a2c5ce8520439db28c74f5adedaafd117c86107d113fc8bb3d5449738b56d

Analysis

max time kernel
141s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2438ae61d1e10d17f00880e634f57538.html
Size

2KB
MD5

2438ae61d1e10d17f00880e634f57538
SHA1

d56534435c9fe48767e4836000614ed48e40d442
SHA256

cf2a2c5ce8520439db28c74f5adedaafd117c86107d113fc8bb3d5449738b56d
SHA512

7804de89ed4352c0cdecdbf1f561e77feb6589a338684405375c3990e878f1c756c25ba7617a02456f2e8d5e1651ba8b1704fd9475cfedfa866b94bcb425861d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6EA6791-A3C0-11EE-A20D-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409737813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b33524321930f5a38d8e573613163e1e23a7f59948e6e9ea6f2a7be7f04ba1a3000000000e8000000002000020000000912889a44d8f00974cbf7c7393965744f4d5bd20e40a8c8e50bea07e057f4b20200000001b1a28bc93be381da478a17f01040908d3b40475d9bcc887e4e2743f4cd851d240000000f64678289936b41df61649094ecd7214bb4c88bc9cccffb587bd9b92a609fd1142b4fe35dad2fce9c126a423a0a37ebca263b5043b16b3ca40ccac3a9fe1f5d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6080a5bbcd37da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d3c134e996c43c3994e229e59086a15c3992348f7efde33f70735f9c00da07dd000000000e8000000002000020000000492383083de81a5ab91e3e239c437b28b4e715b4eabbe4c48cef62fda862358d90000000f30fda6da700046c3c0fd8bc94a1324ec4247e578a02c294d9a6b2c907a0feaeb28c8db06469718104165608565e66b37eb8393e2b8bc6decdbf2a41f3b4c92ce4415d97cb3a741a4618e307c43775efce58ac7699553f1da685fe42156358efeafa29656bb1078c7ed63f855e23f208ea8ac833193d2a0aab27f33bd250d4149f576b7c623e860f27ec1827889e37494000000013701bec703a9434dab2a6ccde63047061d97e5952694b3849f0f398e6ea8d4d1ed7051bfd28400d5ab8de516e64f9c80695cdd161ef2e706bbe2d04d9b2468a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1804	iexplore.exe
1804	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2438ae61d1e10d17f00880e634f57538.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b258d1bf7c8323fe8dc0b87767f61f2c

SHA1
cabb11254c8475f65626f02eb9587d06b050affc

SHA256
a9fb6f4c26b40a266e0a7ca13dc8ec97b8a2d96e8718707ef5f316bf8dcf6639

SHA512
67d8932891adba5c8bc1e0382f9ce334f193fa42eee892d28208ea9cf686c5fc90c51676273191a7585638a28902061086c44a49a164b3a74c1bdb7a47250c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6fd246c4e6ff88738c7355cc07d124d

SHA1
ff740e218b6d2aa43ab7b240fd9d361eb8d1ff88

SHA256
fc73797f7f79c3791d34082671099519eabc282e1297f937e28ac792110cd228

SHA512
42df05c886a48eb736b07fc4939117de83265339b2b473c5bc3b1cb523281d5398f42b8ba1b47dbfaea5f03cbbc61f3b4937b508609ea1e5dca89f32b86293f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e0e486862fd55290c614ab7c4e68074

SHA1
f3d8c47cf20279cdf6365ceb64804d9a259410cb

SHA256
73209090b91ad2170826cff0e37ac63ae9d6744e408ac548c199e8af9a98175f

SHA512
8b75148a3164c441e4e12fc4cc22ac9d385edbaf77b6cee0eaee8e7fe925cc732ec665830d2d25e499c54622cefedc9a2d3d75f55fef6b49364a4bcd3017eda7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0312ba88f6f862f24752c342ac48a921

SHA1
f20567d614c365eeca66a2cf012966241e02f1a1

SHA256
0f4b580cef15c73c8a21502ba5bf21c76d58fac3422f427bef30bc0d3e14b71e

SHA512
7c4a5926b5919641d60bedaeed987e64c0775606768278ab0116854de4a4f8dd3d661ad17bea7440ce4b7005ed7c2df66d57ad6aea96fd7ee94064d88c56a6ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1202b4ac1b6dabd9bbcd8dc0996f3ac9

SHA1
fa2c8f1b5dfed9fd6f315118f46abb8434779ca2

SHA256
ce3c7f4a63c9581c3766a63da8f27c4240bf9126e1446f9c195c55d28fc9d140

SHA512
2c77e52d746dd47c935f319598934f3e6d645378e7d49847aea652a1b9f2d3f2867d42da1ae98d0f3f33c6c57af74f582009f0d5cc8588e230b3ebb9374b9748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2461bee31dae2619191fe6c79e42b20

SHA1
f06b1dd0d41f7bd2af796f628e978f5154a0829f

SHA256
88bf399eeb8ba49d2dec7d21624be40a0c8d022327e4ab1df3a336a6f4efc5ae

SHA512
7d26a8ab29bb409c15d916312292e172dbe9f13c4edd464f189f552425a981c1a33ba9a6713c37ab8b52a548899695b4a3a1d93cb097c0ce88ac82c17010bd26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar78CE.tmp

Filesize
136KB

MD5
61b7682e703377c60d2522d8472ec424

SHA1
205fa2191042f4986eb7d2d930d81070f4777a05

SHA256
8068db10134871dd7f3fc5fff4638410a902bad7822622eeb933dd7e70dc80b7

SHA512
16ad4bfa04927d716b9f64938966c803da8599694c2b0304d34cf57fea4eec03004ca60929930879879f012a73ffed89f7c7f181bb2ce9ed0db3988af00b4ec4

Download Submit