e4cc03d5e109b871ca8c73928fbc06bced92fdf9cbb765c5148f445d4c19eff0

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a332c828faa74315a60d5c156b264fb.html
Size

10KB
MD5

2a332c828faa74315a60d5c156b264fb
SHA1

dbc0461c7359ce768861b85f02a06ad28b5ae979
SHA256

e4cc03d5e109b871ca8c73928fbc06bced92fdf9cbb765c5148f445d4c19eff0
SHA512

27a2c1c6bcf356c28cc39edae7911ecc9dea7bbb6a33b5de4b1d044cde25d201b64dd7ca996cba1948d2e0dcf0c8b864089578b363b150aad52ed39921157bb2
SSDEEP

192:csz7OTAYS/iUR1iZGq9TdPGD3gGfRPHb76f:cNTAY8iyII2huD3HfhHS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c00ae1b28ccd99a9d7a34c4020f03b886c3fc3b7b01a9d188fbe0d90915ea10f000000000e80000000020000200000001a236baa6cfdc11475c436fcb35403ff344bcfa68a2575d111cf5db491af821020000000dd4a9e9eeeabec69160457007add59ea88f33bd0c14bc753830372382bcd7d5f40000000ac09378136b4322d99ab64432ca9293acf538c93b7da3bf42bd28f6b1e2a53d216b982c24e6506f138c02fe565f6d2494c50ca5302d764720a5fc0ea747cba2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000003f5c4138b8f7227773110b07a2ca7d11cfac6f003a012ef898ba4f970e07911000000000e8000000002000020000000ccfc26a1464555f9ced1cd722e8013a834a56254ce1bb828a18f1e921ab71acd9000000043edd58296d16dab4cf104f5c3ab20978d003959bce17560be949ba77566dd919c5983acb5331f2aab9505278b98a784ee5a974469f04c974e066e9e3eb98ea312167af30d00b998e906a3b22a4103dd368dbafe025d94f9f1e4155f4d18924c2ef22be69f2aa5c15cdbd2de2552970effa364f83844767295a865ba3bedf69a44a5f60adec8ebb4ab72f6f035aa39014000000073b122a224a720a115ff73ea1123f73e1efed6f72698ad7601e86246b4d368cd0bd4f9ed3739c6d2c209a78145c0f2d4285c834fe88b4d1236fb9ced5860e53f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409954750"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDE6F301-A5B9-11EE-B754-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e006bbd6c639da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2124	2236	iexplore.exe	28
PID 2236 wrote to memory of 2124	2236	iexplore.exe	28
PID 2236 wrote to memory of 2124	2236	iexplore.exe	28
PID 2236 wrote to memory of 2124	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a332c828faa74315a60d5c156b264fb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b6fd3d38199a31598d52d13ea710693

SHA1
c1c3a0405b1731f373f8eabc2ed62d9e97b58261

SHA256
bebae0b5264581322dfd5033e54c1de66e9397ed6bd84cb278e35c99b8b42919

SHA512
9ccc8a521c2d154748781469abd08ec5c9a557a2bb778493b1dd342e2ffb53ef46a3c86b2c5e290d4ece890d15be6a268c0ca90df8330fee9c19770d4dde7c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4550ba4236abb3ec5694f8845c276bd4

SHA1
59faa0e9f45f5993b853fb300012393831285587

SHA256
b78bec0a248c9717e26d6c9cd89d4fdaf157e37aca2d4d31a277b99054648d60

SHA512
1180248e58c265a891996ebc1f89ce80520b2c9306d29e568dce56fc8088fcbb51e57a50d301f079c58b3c9870eafe7bbab4dd8ecd84d40ed3628a40787e25d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
febc97edfcfeed8aa2f4bcb42670a264

SHA1
13a27d5af9d618f97059d534142195e5a4e322b7

SHA256
41cfc62163e2974ca8c4671464b2389828fb066b9b451587159a819dbf275e42

SHA512
b3d76edec1b09ef69ef7cc5c99e5478292c77fdbb03db29c83886c8a50b44b45e0b9b0cbe9b110893121aabdec52e30d990bad47d557b19a1c41740eb2f2c239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2122aa7744251f766043990523216c6b

SHA1
6eea197facea8267dd01633cf436f894752e8c47

SHA256
70c51ad4028e8266f0a1eabdf2b192ec068aae16ed9de4e6eae964ff233ef8a1

SHA512
8a987bec52f823186b1961ad1defceafeee174297c3ee9e1a265f9b9f6879d0f7ac3361b1620bb9f53ecc2a8a80646ee3f35b3ccac6e62e2c2704131842e5bbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bd0cb379f5f77a4e79b1a0a308193a8

SHA1
dd0669c4894d515b1d50b8e210c1dac00c4aff95

SHA256
053247010e7d669b3d3d4163680dbd3d2f5a8342331b76f6afab2d89e37353b4

SHA512
ba2e3463646945eca839fa6033abc10b7010557fb2624f3a0a84b335973af33c60d90d65028d211a18f554ced38876729952acc6c162cb54b2a663c6dc46d48d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
397e9699fd194bd2bce13f120ee967da

SHA1
992d5a10d6ffbb4748986bc656df61dce90f34a3

SHA256
c3513be63f0c168e7e4fd14ecd225309d776030142fff60b3253c9121b8bb007

SHA512
a174423fa35435d7792cc9051cc800a62ad7f5ba3cf4f85a9ca7cdb43d56a28d32972c7bafa95efee4c72429ee0bd1808d3263cb20be8ad504e072fea1b4c4ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
354477cfc117a3d8975bd76a1d9c56ff

SHA1
d5499d8e36019b1399b1ceb304b6292e30fe4804

SHA256
b32a6cfdc66f95ec042a4e66fb6035f6b55bcd8ba13fd5a36bfc14248d9d178e

SHA512
938dcb93ed41373712bbbce71670b7161225ca27cf1cd59853a7612b256d40e607b09309da9172bda3e94df28d55715371c59c0b31a7c67322045435b063807b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB638.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6F6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit