e2273fa2dd8949c81a7560d72b070687536e2d58b41ba6fda94052870fb8b204

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

255dd1be09b76687c633a5e22657ad03.html
Size

58KB
MD5

255dd1be09b76687c633a5e22657ad03
SHA1

54e4095a76afa81f93dd9e33cbf7ac9761932789
SHA256

e2273fa2dd8949c81a7560d72b070687536e2d58b41ba6fda94052870fb8b204
SHA512

1970ce42c59e904a09cb345be5eccf6ff56fdc48623224f9370f00ea28bce2b00ef2186199abd79a72f328306806999d7803da5a861996a307de392550d1fbcf
SSDEEP

1536:gQZBCCOd+0IxCR3UVfrfgAf3fJfBf1fNfIfifpfOfJf3fef8fOftfcfmfYfDfSfH:gk240IxrzhPhJ91gKxWRPmEWFkeg7aOa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a92ab39c39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409936618"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000be7e4c9d112e4116b3086541dbc6b84e1e45b7f9f33291dc9de332b5762fd574000000000e8000000002000020000000186508dd71f38539ca6df122bb034795e529e2087e9a3b61271811a9a3d7a11b200000006e69c28a2c2fe52c933dcbb23de50c2098f99fe5f80995b8b86d1166f606860940000000c5aff40809f934a31629ef532570e02b97943c9158f86f07920e1124ce147ebc9fee2f3a72f5ca64766198f17f2859b0cd2e0fc1896680ce764e5e6de402147e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C28F2721-A58F-11EE-B1E2-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000009a8bbb2b7bb1bc7c6dc4c1863f286640a61440dfae3ed1ef6bab00742846c55a000000000e8000000002000020000000a63a624184745bab384fec6986b1d10cd09a46300af44f576a8acb408c0c345490000000c544f5a1155d6457411991b4a3763b7d773e8725ed7d807f8b2256193bb79658682a0959dd28979c55c4cc35481cd3db8d44270393f54de8c2bdd0733749856886d1b4b402a8706d0459b8ecfcb0c5523e7aa19ceab35dc4a97e727d0a4982e311ab2920512970ed4cb61657ecf99cc563011ee7d77af16c7dc1fc831162e71f5154da38135613bd87496cba58b9ce674000000061efb1239fd4350a26ba58712efdc8a253538d877fc710bdf63b529cdf7769d02d691991227b9f6adf786e780d3fff4202d77212a57fa795721a177a1ddb666e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2968	2112	iexplore.exe	28
PID 2112 wrote to memory of 2968	2112	iexplore.exe	28
PID 2112 wrote to memory of 2968	2112	iexplore.exe	28
PID 2112 wrote to memory of 2968	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\255dd1be09b76687c633a5e22657ad03.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69d7db949b761bc78a150a6b7abd2395

SHA1
c0264c561fda39c26b537585977e60f0eb809c93

SHA256
70fc6185ceaaac0e24d13941a3c477d68938c8cd8eff980dd4ab24463870e593

SHA512
8a454c8e26e17b563424ca031b06bc958eb3555c5aa2e824d4e407977d78ed28909b1d156ba32917828448f7b5ddd54d9f42f44dc6693486ec8e286d5f6cb7c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23560d34aaeff642a6c385eced3d4ce2

SHA1
32bad860ad61c7be811ddc252ac02572e91dc6ce

SHA256
d6b7ca2329abe1782adc9133a168eb72680fea975c1a232468996d8f98785b62

SHA512
04f679a8198b5e000d3d334e8ccd0933d66f4a749db49531a7a5a020332390bcac1e0e850a353f5d6629587f501c5b9f92a3dd9edd312aa8264b209828b3ea77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b83fdaecbeeefa7cffb7b9fe6861cd84

SHA1
653eff0ff74695837c6e7d6fb68d99176e597fe0

SHA256
0109464c19f4dfb6c96c8d0e39aead576d2005dd5c021f2eb0e6c2ac8def0e57

SHA512
e8e4e7b460b97a21467e71c08dd46c648eea2c6872f7a0d652484c81138b80640195b95239633b26fdc435ac8da040bc53c7740283fba6d92f1c0b82f374bcd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4eb669946c691ab04aa83653224087

SHA1
ae9848e48ae946b461c10076511b67dec15302eb

SHA256
3a993dfd7c8bf1f318abeddc9448efe75ec3cbeb9390a7769ed4551323682f9b

SHA512
5c84e74f1cc6390f2341fe9b0e73f9205c274e12533c8976bf9bd5f2205b1b71faf1bfac4438db7263f4744b62773226c4e285faa110fab6332a5843eecf4ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86c0060860f20c60fefa86973582d84

SHA1
851e9bd1f8d6031c44136a9ede99e01d61691ad5

SHA256
da70308d5afc2749a426ea098acef99633aebcf4471575d78d2f33e9903676bf

SHA512
475c4c8877246a91c1062bedca678e71d05d69263e0575c1e400525dec71f9042fad0067921f3e99b99fc1df539d0720f392f3989f32ca17a99a3c1e2dfb9766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92afd0c088abc962fe42a0384cf9621f

SHA1
a0d2fa6d70d89a92d24aa37b8d0aab1560ec1e53

SHA256
9d7525f5a618a8ff84f0ece83905d3e23ca6771b914e6800ccee3307034ab741

SHA512
64d5c95674f2bec7c1d3d2c944501123df80a23d8d060c617a60b9213491321790048183510b6b28e118873958b65bcf1ae97e41b395b9c9e9aabcba4e4d3eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d374b016998588e3c4d2ec6a2e9a915a

SHA1
b9f5cda2382399227ce9caaeda800c8adc18959a

SHA256
2634bc3028e01efd61316069c7304f1a9bbe188781528a9e16c57dc9dc846b10

SHA512
d8f8e791bc6b6febd754db6fc71e475859757a6d28a0f4a9d59a88e5a6b5fe02773d8c079246416eae0f3c94f1694007ae036466637e74c9d06dce956ca395ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB991.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB9B3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit