e10e48c078bb2d0c55f42bb1d82970ccb4e4a6da5aacba180702859ffa64898d

Analysis

max time kernel
118s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b4064217f208b83894b03c13e700f1f.html
Size

10KB
MD5

2b4064217f208b83894b03c13e700f1f
SHA1

c31a66f7ef52f53927363c9f884d40e4c7122148
SHA256

e10e48c078bb2d0c55f42bb1d82970ccb4e4a6da5aacba180702859ffa64898d
SHA512

5a4fee7fe0e3e3f9a504ed4a7351fc1e9e8b39297b0cd107fa44974cdb9e6198851e15547009e6be61956891b15a2f34e048fe78ab64d68e0e7162b7cc9fce4d
SSDEEP

192:+2jJyN3E5H7LoGc/3qLvClDcawlcW9itUTN+OCVWmqwM:1yN3wHnZNxNXCVWyM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c1040e3e0ea322da3a45801167df84e5ca6bb7ae6ade37b1a8851ed17aaf5039000000000e8000000002000020000000bb3ba587f0627d2d3c65c2a4e9f36f6a8cf60ae080ceb7aa5b27ad844b78fc5820000000c4f2f0da06b4af6d7b43a6d23ec47e98da287300d0aae2ae2a9df1e4b6e7170040000000ad441acffb844794d1e8359afb298c3720a7c540b4fc6d90761e66ca41ddbe19acd65719e1d0fb10838ec0430354489225506a10308809edec8799984ac9f904	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409958894"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ef8a8bd039da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A77B8580-A5C3-11EE-9843-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a296902e6fe31b3e71d7a14edd56d6c488cc8a608ac98f4a072e042accfea3e4000000000e8000000002000020000000375b826e0dbe089286ae466138546ad549802cb8d1366e9d7910e3b2d649b76590000000302df117ff79831a4a1000839a04c817c303f737c4b462498007c1ed33d1bb048782086e05e21371d261a6a20bc8288028f796a1d84f229f574599ea444d1368e9973d5c9605f8d8cd26cfe753c252dcdeda5afb21eccc29c67cc158f0f0d2acecd9bafb12c83325b4d01c1eed6985c670838c0d327437eeac3b7cd05104cc041c6144e45230e7c069db4b5c33e2d37240000000fe1d93239e2c1cb49d9c96fe8adcb9d6a0f9ceccf10dd7d49ba37829b026a956edf037ef9637932b2c7801d205baf0516521cd29e70dc8af97766953691b62f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2700	2988	iexplore.exe	28
PID 2988 wrote to memory of 2700	2988	iexplore.exe	28
PID 2988 wrote to memory of 2700	2988	iexplore.exe	28
PID 2988 wrote to memory of 2700	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b4064217f208b83894b03c13e700f1f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a0f087d04968985de0b0a07fcc16394

SHA1
8aea8d6194ba666a1c128a84832c61127471ad64

SHA256
2ea1960b73aa47ff13ad8570053a60ca6433f945624bc42a155f3df1e3b4cb3f

SHA512
b40f8f95aefeaacbadbd8554a8a939500c8c0f6a85ec05686cb89ebb38e62b9b66d7b522d46b3ad037fc663b0cbdf6c7d97e716519626b5d8424dbdcd32c6978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e3306fa0c72e2ed0fb415d4099d1d90

SHA1
a22fe18c03ef8d052b75d25c9b1158f8f68a34f8

SHA256
ac32241a8caec052236a8a2e40f2f08fd595f8b896468f11e2feee8e5a2b8866

SHA512
326447a60414c907e60d3aceb60af0b111fcde52d8963014532e7d00df38df30a07419be2913527c91a523721b13f07dd02773ded9ef2620374c5434344ceb6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bfdb67145620d0aee86d1c1ce3150af

SHA1
b22ae255cbb5675606cf0d1d530b0b6dc591c725

SHA256
aedcd5e836600389b9f03e8d4b5d60705277055af759e166e381b5065a85b2b6

SHA512
e23c9109d478359fcb9149ba2ebc7fb5c7aee371132b67c96a77eeda7f54fb36b4ad369d3f164cd2ab48ddab43757350fa1d71a49f3ab1d57b677ed66f46af42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f002e3afa3d84ae54c18912a0f3d7f1a

SHA1
062e5554434f7f8f2258fff98270dfe420fc02fa

SHA256
fe4ed8a2589afc3f590dfeac2b5b706b9f22690fd925e9275ad391b67ec8477f

SHA512
d42b18a6e527369ef5dd6b38be78b38290b3b45fee5b714c6b2cc6c0aecdb2309bcf9cd841af49e7a6c5b30dd3cee1804eed1fbe7c2b1f8091c97f5701c1b767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10894b36dd5c95f43819a0bdf2587595

SHA1
049ab05901257eae42f8101c0a58f7b0ca056f4c

SHA256
16db91193a4532f1da4df2805da5e3ef8024cc3e61f88d938e46f947bcf14cbe

SHA512
769a06696d93b937cddf0bd92cdaf7842c1177faf012700069f9b9ee9556636c8e0e8ee7451c7c3a848eb431bea180eb4152fb7ef195cefe7948486b89ecfe03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f169e3667108c835a15cd7071c5c300

SHA1
0436f45ea5b6dfad218d2fa49511f55dbbc23981

SHA256
f73e8f67fd5037a612e8d79d8de140aa57e4f0e2db9caf3e80b1a66248b58e2a

SHA512
86b1ce668e01dd9247feca73e6e64059c018a4c7cee8e37bc04136c0a3b440b852f3fc6db21fa8f56de4240eeaf97b19a8d930c7e08207f7619fb4279c7bfd9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
427d22a74e21c37cfabb9eb04740b4a3

SHA1
18b08e0d844b2002f95c04b2b7570f1c37f2dc80

SHA256
a7bcbb8aef97476e65a7b274af9349de3e2e3064a43d808d6e9c3db1e7988c25

SHA512
28c8c463068129ea205ad8f1365b8a7cc867d800a62bc99468f45c9c9ca312f4847e8c97a60bb7cf880e41d790e92085d4868d31c1d11006b64775864fedfaee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e82f53e529deb6cd050937445a1f3bb

SHA1
28aba191e3dff222418bca259242f2d5f5e925de

SHA256
91563b040a99d8682155000c7a7cd01f55fddf8a2a1d834a410f54f97f03d8f9

SHA512
9329fafcd5e0fb9afbdd8de08f65d983c38875f393fcfafe9ea803ee39ca1f882caea50b7c3c0c05f949bd703358dcd830f0a2dfd87617a30745176b065f5e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd315febb278bbf4b03e6a179017046d

SHA1
ed0896d34fbfe68ea60d2b70ddd9faec04917722

SHA256
7f7f85fa24182d0410acd03c9556f36e7dcc51abd8547db370579fc2d9484d0d

SHA512
529906bf8366cdac2ff3d7933bf84739704851e6f9b4476dcca294dbee0453e1c7907662e7277704afe01f4016ab1941b1bc99369ca018347828fb805b108888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc03f26a9efc82db0988639736952d8

SHA1
219999f8fb3ed7977133011bda35b93a777be736

SHA256
868e4ecf859e57fddc5e296d46ac935eeb121f56e3a6c91156c940430b434c30

SHA512
bf7f59c2a4a2f1c42c6ca322348a8aaf2beedfb93df771826ccbc5efb7956d2181a85cdd9ef77c99e0294718f0e1aea027ffd7fdf33b27d2cf79cdaa19ced29c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C7E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar327A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit