e84a22fa4b35bdf3ff0da31157121fed9354443757fe45bcc433456a242147b9

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2901388cbb77c8365817b0ab56d0b279.html
Size

24KB
MD5

2901388cbb77c8365817b0ab56d0b279
SHA1

2409d2595a3f4f6d2e5d42dd8f758ca864cf7dbd
SHA256

e84a22fa4b35bdf3ff0da31157121fed9354443757fe45bcc433456a242147b9
SHA512

f4d32f2290d17208ecc28ee29937850f6bd201fd05ff09d073bc06fa3c60fd1d33fdcb47a46a092959e87564eef5e16513f96286dc84304d141a37ef72b23c52
SSDEEP

384:uT2gaBUyq/2HsD7v21ouje6fz944wubYHGZPswwZ5JVXkfLwe:xUyqhv1Ee6JhJYHGCwwZx0fp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703f8be9e037da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000b0b4a8e6f31fcbb5fd7f4f319fb6cb9fbea4f20973b5e819588a8679f7ce95c7000000000e80000000020000200000001008f63eec6684180f045e1d60186f9b5fb7ef21f6e98c7df37ae242d1a060b520000000b8a934da28680515f27464a1c40d0d70db1bd10900842f7f11b52439a5979c25400000007e0724c2713ed115295e86fc43dbeff1e3d6f0cc68196f4f3d1eaddc3d41a2c2f4743fa0ee777601aa3746aedbe9b364662b1369f1fb90099b91f28bc02c5ea6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d4c4af6b38086b1039f75d68824ff6aa14a06ba6a44215590adebca3974b3b17000000000e8000000002000020000000ae097035c3cafe7407c4dc7628e9981bfdcab8d5099202c2180bdab75071b147900000005d657f06005eda9e26ae16f1bf9404aad48bcb36ce2d13d618368d29cbc33666120b5d65a3151d2bff74c5eebffdc328832ffd11c84874824bbebf2acb01d91f69b1b62370d324f6e37111c0151cbf50e19b04cb72320bf226e70252addaad7356cff52ba12608de02898f63cc1a4b0a2f891a8e5dc9dfd5c4c9ef2ea4bb6fe025fffe4aaf2ce095ec358e05ad71629d400000003ae2aeb124c8b4c9e2010b758be4887e6b13e71e710b18590ab0c46647e85fab966495e30fb39db30fe6644feee5b2f7455e1906ec6852c559f94cba6d937e45	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409746052"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14B51CC1-A3D4-11EE-A892-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2988	2104	iexplore.exe	28
PID 2104 wrote to memory of 2988	2104	iexplore.exe	28
PID 2104 wrote to memory of 2988	2104	iexplore.exe	28
PID 2104 wrote to memory of 2988	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2901388cbb77c8365817b0ab56d0b279.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a6c1b0331b7c461b975c5556798d82d

SHA1
a69c01958607dd1ff4699fde1a4909a8b8c314a8

SHA256
d2f66892710cea8ab5021bc86edb5674ada566b15b2249f1279264bd310f6d72

SHA512
8a969338394760931878bf186269c88e2f08d9a9e4138ab69030bafed0cd042e2edd29d2c9aab6ac3f20541121c0efeb9d9e393b2bc8d967681a0cda7ab3428d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04d995bba9c9fb56088ca6d1b3ba1539

SHA1
1f1eca6002ae1a1fce652306f341e922935f9c38

SHA256
028e1661b7ecdcf787074d958b13a5e6f9f1adef028a2452587e4d0672cda96b

SHA512
1c72cfd30eb8f2c6668b4ca4b84b5276e9e754431cab6631c67f0615e6b41eb68a7abcc6d5389fe76258e198f1791e3b07320561a80c61d9765fc8ba50a699ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de7638ae44a99a8366a9401e39a72477

SHA1
bd8d1f1c7ffbadbdfc6d8f5c4116678dcb995fad

SHA256
4f3789f4b6313de851cfc80fb8c6e95722947628cb17be0ef7956101f85b6c7e

SHA512
88338f3893ed179e134047b3bb8ec14613f5d96e2e50b5ffd6857374c7fc45d75023130cf693337e75eed5ffc97447a03ebbe8e76684e7e441ec6b190fd6ce83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2026ec7b023fe05535adad14315cfc05

SHA1
ce2f39dc5d06931a5fc628d8ebf28a0bea6d1e0a

SHA256
03173effbb5b0ed002f2e2dde64a3fa2c65a754594140e0124daa16cbe81ce36

SHA512
b0c5a0a64655d702b6acf3614769b75ef2028bc2e82713a75eabdb136ff7c21ac431393937ff8919e067adae1b47ee7754a27826435ff2f4f29f00b920ef50b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
894002966c366c09ac4d35ff27f9ac0d

SHA1
ecfd1601fdf88cb1f10c49cba5f1ad2a0093192a

SHA256
203b04dac5b7a3028825d94a6c56154d0932a447caacdb4746a66cc1d70fa0ce

SHA512
39276d58e826b2d2ef39dfe3962bfd2019339f909782a43f0c9e51063ad77bf471d562c9557b55033d1349324f7aaff49995a549e8832f24c7046fa9714691b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e56c8e951bf536714d54e76bbad6899

SHA1
f96d00df7a82f6e01a749736d2c5eddfebc9dfc1

SHA256
ccb6f81379032d9a43f95d030696240b8a067fa17221c45aa94517b99332ff85

SHA512
e64c2df3bcf3f1e691b3ae8701619c4f550742c99e1a43404c763f6868fcf6ccfa05b8fc7ba5451237a4e2ce966be17f4b5dcf107c1e68560dbe7f241274b669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c110e9df6f314ced6d3f07a978c1e15

SHA1
574cdef68cdf64473e3cfdaefe61c1b2d9114487

SHA256
bc5bdd25817a1dd96d64f1f5d88c561fbfe23a99266398c0e517586cc5f45200

SHA512
f58ba2418c916c459de964f48a4f9a2511b26616843a4a176a7105ba8ff0ac8454dc62d04c035caf628d4e3a53c596b8444f06da0cda42eec8092e7fc8e8792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b66327b449113eb3b141daa720166ab4

SHA1
eb7231f4cd6de00cb0ac69f6222edf0aba6940a8

SHA256
914caaf2b27ddbfd0454e468334c48218ae345e1348637580369c60d677f2374

SHA512
0c53ab822721d562cadd68c8b7e506fcb287103cdfbc633c6cc8304155806806d6851c2be3e57fa57462b67700b00b21c6308d700f034d37f07df3f92a885daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42569e12d75ec3df0ba695f1b69a6909

SHA1
0f1167dc5263bca5186b09cd29eab8457c7173a8

SHA256
319d038964ff97e1e7805e871c29bff725a6ee37b2f0a47603dfd8bd1698103e

SHA512
c81fdf53fe5b5577d9a9a4e2ab2ce34659b7da3327b1e9893e4e5f146dc598d6aa296a8edfd082278b9f2dee63d7c27319cd3252dcd9b1ae8c739dc4813b461e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
154c0ee8b172b322403fab31d98745dc

SHA1
5992b37ad2cf145496dc2b2331853a79131be286

SHA256
77ef393d28cc1d423c901fe01b80a013aa597d1e4a234e005a796710e02cf33c

SHA512
907d9e8d4a4857267cb744209b6d75e0447094c0446c785ac4827d653bad0fd436712cae4220470983885c1b452569c14f2cdcd39406c5ac85a9fb555f66cd67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fe57e6b595adefc097836406fcf007b

SHA1
61037019b1b28ebe11c4a0d0453ddbe002c1695b

SHA256
b760df216d9140e7138ffc1aa78ee8f3a45140b9a5d9b81660e90614bd4d4311

SHA512
1a134311cd643cd3d409960d37d3e69e1091b59d832e2121e4b969a51f9abed30f3c3b09da209e57040e48cbaef5aa207ef3491f8ea3d3a436b1b40be4ea2b76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8660.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA71E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit