0f3eb74207456eb6be8eb0fdd1d8751f1b61ec35c6e2fd2c434b8f272983ea5d

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2976c84d4b917c85057f09f06727e2a0.html
Size

43KB
MD5

2976c84d4b917c85057f09f06727e2a0
SHA1

9526cfc92a11d5a3883c61850e55a704178aad28
SHA256

0f3eb74207456eb6be8eb0fdd1d8751f1b61ec35c6e2fd2c434b8f272983ea5d
SHA512

8f6dca73942852ebb4aed6472cf6b8c45b616f31c3ed0045cf182ccf2ce3e049355904179955fca82098004cb2be5bdaf188f105f72590292c01d284095a827a
SSDEEP

768:SQUCRCfVl5/FQCRYpPYrD6pYHB0JOU2vB77huKfQR2F:SbCRCfVl5uCRYpPYrOKB0JOU2vl7huGn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b3a5c8e237da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000005e97333030a9552b9bc60dc1958a16ca1301f68bf7569dbf31011cbc6a05b04a000000000e8000000002000020000000673630f430547f00d76b626cc475014309efa4c9c09ab5ac9b0aa0012fe9931390000000e0931968ca1ec171a35b470ce09b1b42135f4aff26f9cc4d54ad810ecc51a50bb4c071990247064d06b9b833c02efd0e95cb9aca7171848d98caa43dab82939556abfd60746c8670ba7260ebcec344e7c5e7d23f0c34c9d6fae1c791ae5c0da070d284e65b629d1f0439265ffd14ad2534c51252d7ba501304168bbcc3f124d75855c1bde4cb0859716acc1f9d1b67ad40000000774da6ce2d13dcb3f81bd9e2996e48f17ff342569bbab2ea6e1df83db7c31a75c672d0d9bbb30ce115c13ba2c231fc1a5450c03a07e3f5deca04e7f1ca5cdd1d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409746842"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECEB28E1-A3D5-11EE-851B-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000000b220111ab7a0f7bf2be767de8bb8c4a42809361110a9024dbc9150a2d1021f7000000000e8000000002000020000000614c5dea5e8f64b837e7188162993398c5cf8a4d15d32a4105997c861aea7a5320000000db77cb44d3820058b12fcb0539a13a9be38c0c214d864cc584f7e26d2099f5c640000000a56f06cb87bcd66e062bf8ef25b377a66cf1c944d2621edafb6ce8175108b763505f3cb7d65f101a9ad0a99cd83232252302a48301480f482230810b4c7fe059	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2168	2108	iexplore.exe	16
PID 2108 wrote to memory of 2168	2108	iexplore.exe	16
PID 2108 wrote to memory of 2168	2108	iexplore.exe	16
PID 2108 wrote to memory of 2168	2108	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2976c84d4b917c85057f09f06727e2a0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcf697b907caa67fcc21f662bcc75237

SHA1
492366f2d58098a8ce492e998f23cc6a39c98add

SHA256
8fed042887154a72c4d220e65e64e2d3dcd5efb719bc28f4abfe3996d8572cff

SHA512
0f4465b0b2b28a87ce7482533ab73b485de7a4ac4089af367be52e39eb15f06ac049968813dc9b0e355ed0d7104be82a884e70cd26e1bc951618a120c3224bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f84e1b21f510b630015a8a4502a92eb4

SHA1
1fda584d429c2ed861ca4f5f68c0c97f8ff07037

SHA256
554e643c946859c10302295cffa21bd18b64eee66c31b6d2e7343b7e09e95666

SHA512
488fbb04d0fb55fa1958bdcd5292566ce2101af288b27088536437d90f114c97b5307936dbcb587d598eb2ea66c37adf512b16962267e29568739cd3398045a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51a655e44e3bbdbc14f89d1f35bad685

SHA1
591b5de74802cffe8d001f73c5555e80752d103c

SHA256
221db123a6357f4d958786ff77547c3c03b7b16b3b1c1e8b2acc491146a81eb6

SHA512
186c700aba9d3f2a2658db2b0bf8e77cbcda33706026d181a5e6e1d2e4ce92a32a891a05ec9854167c928de8ec3fc5b2b33421a8f3ccd56ec6e04bf2bcc1daa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b682542dfbc7aec76c44f472cf6377

SHA1
982fac70fd3c282daaeb78e284e1efd214158c2d

SHA256
bf92863895d7dfd04bf5563ffb230fcb03e0475d08a4c83a7ce5dd3f97328042

SHA512
c233189304dcbcf2582926c8f94f90be181326ec21f3231d4f67ebd539aaaea45d2059dc2a3dfc234dc1cf1f7a77abbcc44b949d2e61615bd8dd2f5f515330d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0862789d3a9009735e3ec262eae0eafc

SHA1
69ef6a52ba297ec2e2e8e8ddb2009880b59d68ea

SHA256
9d3abbeb5f117a1c2daeff10de76e7d0ea04280074d8b6985b22231dfee5278e

SHA512
ac059542498ec19b0b4bb215ee8bda9092492e0be18725cc836430810ba944b7d073bce36e308d9f5d5debfe9c64a2364d6b66c0d694ea98f96890de45d4b1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b6bbd2d4925e5c6a26b2ab6f56d12ff

SHA1
50c33412b4d12a227c20d6d3853a1abaebf9f1d1

SHA256
c3c17cdce6b58255a464a75304f0a63fd6d30b59f86d9741ed37d3dbc137e04b

SHA512
db5e1ef45407dc59a87d0a7d6adc642452ebcb170a7520efe143f47c4aa61e373cc5873c40bdd036d6fe97df7903475bd68f2c3642e8bf0a9c75e62fe7946d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4ee8074746defeebb7f7cec74afdecc

SHA1
5ed2c0aff9f760d9cd8fb6d67296d0f10ef719f4

SHA256
52e08d8ee3d12dbba1708f8bb3950752fcf78954a001fa1b17fa55e486287f06

SHA512
4193f2ba03f935b8ad22f85deec3e83122f94e30ec374412c93261472b2354ca14a4fd1610ea6933542f8c1b97b749601d2dcdd06ff88a0d4e376c7f2ff325de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46d4d4d663b74243d66225f7aa542f4

SHA1
427c12ced5bc0c709ac57158cafb8c9151c61f75

SHA256
f0f7f4cf71aba908f49c6067e4f50e42da1d7881cd83f365501004a67fd1f274

SHA512
969d7b8ec20ca040adfa3bce32069e50854895a6c2b38233498e2b91010c20d58d84e0ac59b6a6e86da29d37e408b83df735a8094fb212496708e959d5a78ed7

Download Submit