b82aa484c11ed5fbcd4bc9f2507da5abfb5da31b3b3d8929e5f92efbda0f8b49

Analysis

max time kernel
127s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2746e5ae8b7c35fd8bb6080ca73819f4.html
Size

12KB
MD5

2746e5ae8b7c35fd8bb6080ca73819f4
SHA1

5387c84cc5827d1879b960bed9811781445c539f
SHA256

b82aa484c11ed5fbcd4bc9f2507da5abfb5da31b3b3d8929e5f92efbda0f8b49
SHA512

d187511a9483dc84fb8783e1f3d77e573721683075d33f8237ec8cf4e89425e9554779b137d835055811453ceebbe17e51e10d45eb124f7f12765c49d56d771f
SSDEEP

192:SLJOvuqF+eTVnxGrI1eA+T1apCJtMPv4YJI2mZZ1hItI:SLJOvuqF+e1xxeA+T1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409743109"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34C46771-A3CD-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5022920dda37da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000087ff2c13902c64747074a4058c229e993e81d2d0dd653de9bb9d3b902fa0c3d7000000000e80000000020000200000001f2956982485bf221a3f8a188231a34c19bcc49105eeb75a47fe9216074b4b0b20000000e56514035b3480fd244b66e76c479537007be8959012200bec5d073212bfd820400000006b0746f9df3755a8591e6fd76330bcf8479964ea6a49ccc60362eb1905ac7592a58ac8ffcaa8fb52667798aeb7bc9008e6fc1a43c32bb200707ef5ee4ba7a316	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000000ff5ba846efcc2891fb4160c0846818acdc123a1bd61ee3a29d6d24de7212772000000000e8000000002000020000000b8eb441120972e5f63aacb6a2bb301539682305b9bab42600733503a1a373d0d9000000070a4ab2f5b03d2b04a52c505411e6b64ef45c34586188b081c69c219cc8616eb4a8e817adafdb29a5fa0f8eba853b272b944d22939c8ac7ee32dc662d3fe5d736a987ad992d0dbdbb91bc9e4441a0681cf22994554eec613aeed7ced6002b5490af2abeb8c5c32fac2777b683ad0c2796d43f444ef7e50148d739fca4292450ff98c3436a51b3a7a1f2cbbe6b35c443940000000ff37cd20c846685bd6674ad39b9b07e4cd1f889695ea145e690fc61198853a7ef1db49911b64b4a69bd61f4f1ca967c38eaf9d6d2850c1ece996c8ab8231b875	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1224	iexplore.exe
1224	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2676	1224	iexplore.exe	28
PID 1224 wrote to memory of 2676	1224	iexplore.exe	28
PID 1224 wrote to memory of 2676	1224	iexplore.exe	28
PID 1224 wrote to memory of 2676	1224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2746e5ae8b7c35fd8bb6080ca73819f4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
234ea8de0eee711b769528286649c218

SHA1
038749eff037ae40c1ffea69601d0019e9429f0b

SHA256
60f10a53b986bccaee1bddb0fc80fbb2fd9f964a0d317010958b4d6f08412471

SHA512
f552c5fa08534e8b0e137be8040a1996abc9161dc4d47879d4c8b12a57966ffa45e929443c02e81e40f989f60e37bf8e7a4a6f4917025424fb8f93fd3ed0b15d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfba8fc5ca7802bcead62bac8acf731e

SHA1
dd6594e7b8ff48f96a0ca370d6ac61bc0f9b1483

SHA256
a4b51ab4bfe43fc1d9486bcfd02faea46f42e16a82094e3ed5b2e21039cf2a0d

SHA512
51825c0821819e86ee0e9561ec3095979efce12ff8c0b29562d6b4b8181d8011a8de58274e55a5460385fca69bed72bba03de96fc239f9ab492d9cbacc99aea2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
981cf22191ba67019acf70424b4c4684

SHA1
2c5131fc887bf59c815e9317bc494385a155aadf

SHA256
1e03fb33ea210a3ebdbe166bc11e6527126fcb3dd89e4a8a605bdfaa193a7728

SHA512
1935d51f9766792e4b02fc1d10a4f7587572a759b8cdf4136d6b61f302a0a69bc8c550ca0bbd47e0d858207156956c456a0d756fd59a04fc33578ceeba7beeae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271ec99efc4581c25dca04ec7f1a29df

SHA1
6937959d2414ff76184940770795bb1f32715d92

SHA256
df17e4cb009a3d32049f12d7082fd361ad2da7921b620fbaccab688ffcb2a546

SHA512
55c2534babe4a9350f2a4ca607b43ebf213cc1b32b39b1beefb25030acc841032695efe8808972df01f591e83d8efc6a09411f0bc01d1f585ce3d02fbb1bab9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d87512e0f05d8ed55a70fd4cac8905fa

SHA1
6eaa7932422611097ba832e3c1241af723e14b33

SHA256
6bf8c655aa8203b0aa851aa2b2685efe80d1e9392193b9888c807eddab32c4be

SHA512
00ab1cbe46c527f7979a2538b45f8339ed16e5b0b6fa71d7d1b3b6c8cef0f23bc1238f49af6f93f14e3714122a6f3000e7faab8dad13ddb1d3dc13aea0db6ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9cdbceb538c5fda56af9fdfafa76ee

SHA1
925084ce2234c9aebdfd0e9622f7bcbf5e930fa7

SHA256
98bf7da9cf3ddb09c8c04093babcd37414a6c383dd32861885ac20028013dab1

SHA512
702984580ebd40da76c060df0a1adba85a19e4c1de15f100eae16f7ec1384f8cccf0340a0b8d74b02a0d891ebaf42596a5028a54ce8516c7dc609a12aca3a834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2be5c79209e00666792deba3a5aee6d1

SHA1
f0e146e4ba7980aff114baefa7d05f0042c41574

SHA256
cb1a4fcb21882f56f8b5ce63846772983e6f77db86be62a9fa21ae080fb63b7e

SHA512
d12faf6145bafe653eca3441deb7d773b6b4c89db6f3b3c5001e904ef5bb7a3ac869804b6dd464f2b39f2e5ff9590ca1e4f9cf85f104761f22eaa1cf14b6fa4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
925830fe6ab5f13fa1ce8ba02458824c

SHA1
96ba314516b92bd1cf04d191eabd1ccd5fa9a86a

SHA256
8f9e87b0fbfc03ae6adc5c0166471727debe2a801c848412e509ace6c26a8682

SHA512
744efe97ff7a8c5e13a5ab1c9be6ceadbacda1b8b92f1f0dd8cadd32ff58ff8e020696fd9bcbbe791a7ebd43e099ce20a2e82b136c3252343e6037767849f043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b5ce9b6f28419e755899f0ef4fd900

SHA1
78146c17cc09b943e9c0514fa8475c176cd2424b

SHA256
ff88b5d416db5c9c094543db81671dee41a213e89f2f1eeecbcc46562683908e

SHA512
3b32b49baef7a95dd3991dafc529a21807a2aed86e5384b83ebd752f8faa68e5d027dba4de41f541dedf2df94ea08b91a1f6f49f6f41aaa4e4fdaba87b545585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1781a0ed3ebba59145e113aaf2b0a19

SHA1
2e62e04a135d0f1f1f7e298015125be250b560d6

SHA256
bb7dd0963499b1faf9cabcea869b8cbb2a9c3f3c2f5261cba9dc88009c5824a2

SHA512
a48ab6afaaab5e67672f9daff87bd9d2aaa7b70f79814de2ec4fd64be1c561389dbb41309dc56208fa07246d8992086b995407135ab4483d4067fe32935dfed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33accf1b594532c0b16d932094f6d57d

SHA1
3c9529389773dd693e99e060ddfa1608fb8354fe

SHA256
ca47045f36894dbd274b50316ed3604d2e908174e8580fe73df45998ea60d0bb

SHA512
1e7c35d77f1306d2e0a6285a8c733ec3a6a47c1c1e510a6c385b0a37989779bdcf3959508bfc0b757f61b2db8591cf474d8833048d460f41f4551654231e7c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc7b6cfd1338e60730ff089e49447b7

SHA1
2e3ca99399672db829ed23b87e9ce8e949ba7192

SHA256
b2311d61e8d605bbde18b6106dab6691c1ae08a4dcf21046f74494dfeb696ec6

SHA512
4bb3d7eb5c4b38c1e28819a590b810285cea2f32373b105a255a2fce61e9bffe21c798b67ca7c8544fbe2b47c43711944aa70fe59203a87ed8b05c58450d3696

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4388.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4455.tmp

Filesize
96KB

MD5
325a9f52a337369bbb3667d454dc0a16

SHA1
a3c1a8a5717c8a4405f3445ff6cb5dfbb142b60f

SHA256
f37973712d0aaec9621964d877e7ccafdce6eb9c725d02fae5c43d40eb5a9c8b

SHA512
8eec509108c221ed9fda02ca0548e8a66b2f0f0dd35361cf17903930be52c6abeb1f9d86811f5817c2aa3abca1474e6e3212b51405a2cb4d6ee68e3539dfe8af

Download Submit