1eff9cad181f142d0196bb55843082f19a8e9b9e5addcd5e9902c3808220ddec

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2775c6da876bbe93007e6e70cd467145.html
Size

19KB
MD5

2775c6da876bbe93007e6e70cd467145
SHA1

4759850d48af91f5fe9dc842ec850cb12cfa549b
SHA256

1eff9cad181f142d0196bb55843082f19a8e9b9e5addcd5e9902c3808220ddec
SHA512

722bbeaa7eacc14925fe7a07877efcdab31f7e46af93507ff390f22de084158533d54f4b569bb9467e6deae4e8ed61f25d66f4d9f94a5422e4e1c0e9472b0b10
SSDEEP

384:OYqJxxycF8t1AE12hhARTtY0WUcZljbUJdGzRaIJ:a6PXY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C78CB621-A5A3-11EE-8B4A-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2280	1220	iexplore.exe	16
PID 1220 wrote to memory of 2280	1220	iexplore.exe	16
PID 1220 wrote to memory of 2280	1220	iexplore.exe	16
PID 1220 wrote to memory of 2280	1220	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2775c6da876bbe93007e6e70cd467145.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
574f0af68f06e8281094c61f3bbb6016

SHA1
fa84ab40334667e8279f74a7ac3b2219a0b1c2ea

SHA256
a38e2e0efb47f6825b5021ebc211e3f932e3d34069862ee643439173d256fb62

SHA512
a36565982ff843a8fedbd2f49c025a0107a017f4c1fc454ada1ac0ba1e1009efc9c1075f3e5e0d246ccc3924ea1b376b4befd227c73e1ac375010bc9acb1b117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
564f00f3d33d00af674d6bb64e50d2f5

SHA1
647a96ed7afd8af4f90e587562c66b6e0290fbb3

SHA256
029edbdc4de0570d0fe0d3cedfcabcf4d130aa81b2c0ff47a89b2cbc1ec8ef26

SHA512
d43f81dfd631f47bb07dd389e4ec49a5d09dbaf97c6356f18360e4db46c5749520db128301862430fdb815d48996dfe358fea8f1bb65cc8f11e8097e7863d426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356d1dc33f4d9dc9dfcf879bfb675d2d

SHA1
64f17fd9e5929f5c3db858dbe072b5c5df629a07

SHA256
5f75afefdd66a662cf69ebc503b7f3a36ed237472024a8a533baf5232b493728

SHA512
13b32193f0c2cb8738e04268f29a7a1a8e8ef7fd293f833025e789fe5693f5be76544592a81c656d4573393b5739965ba1a7af3a6d9cdc5d77cb0f4d9685cb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
def2e28f9b22df4f0d7dfeafcb55c0c3

SHA1
3cc1d1f651a597348e2573af8ae9a56887f2e83a

SHA256
9654acb067aa3020d9a277bbdb8d139e55f40cf819abd2c348b3647d3078c1e4

SHA512
8cb52b3c12e0160a1aacb2e5e58ad216d877ebb5e72066c075b308d96aac393912cb3f3c1d821bb60cca25d8822c9c556f29f93a8f504997a46c69a08af61cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68470052d2e35d6c37eda339fdf04186

SHA1
ba08f30f86d006fb48b5f649105408f2dd4995e6

SHA256
b66bb7c85de88015cebc48055b7a33d2a607ba82877d0323d2dfdfa84dbaa093

SHA512
6f3cab413d75043a4b211c5da6510168aff095b4f1902e5b5dc17a678207516efe6c3bcc04f64c76cc0d1988247676d1edb2266e538e1b8245e8e34aa02f5b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3b6da91c2175c706210a1e83106c165

SHA1
7bfe376ba012fff8d902890d546dc051f43f0fec

SHA256
48c3a83f5fc478f3e6245741b326bb8a99053d8109f07748024dc084a9d41bcf

SHA512
51ce0a4f99f38b2fbbb9dbc9e42b79d31055e53ed7de6890b6c5bf0fdda4e61f28fb2dbc5b58d9b4b6c5508bd7b3afacce341ede4a028fde5593b09bb003d5b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8061609a218ef7265e05ac24b8911162

SHA1
7e8ec41dce32d570682a0b7816dea4e88d26df38

SHA256
f92afb7f10ca99207d0de54382c91315e37475f26655a9e5399ff5a7bb8940b4

SHA512
0c711d95ce783f346d6690cdacf816e42744c13c462d24091974424dda750877381606a2f5190d3bc927b2583bfa26f32998b60d2cae3932bc29723dee7b879c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab602C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar60CC.tmp

Filesize
51KB

MD5
a2a5eb448183524bc2ed6f28eb2b1d0e

SHA1
cf128fd8e413b55118e0f28e03ad07c2eece3a22

SHA256
e9f341a89cba7abc359b7c9dbb41a688fec6590f2d3536c563fd734079e629e7

SHA512
7871755db948789f695b74dea7f536f5703f59670ed9e0dfb8ac99e2ce6bd9162100e140d2958b04dfa1025b0f2d70bfcbac8978f27e3d7ed94b68a03637b0a5

Download Submit