e951f227bcc9f0b00c4d35edd980900e16386d83e5833d95a8dc9287fe052231

Analysis

max time kernel
192s
max time network
258s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

30da6d61a464435371dc32c53956f49a.html
Size

20KB
MD5

30da6d61a464435371dc32c53956f49a
SHA1

c0c7c423bd3579f77bcfa29db42ff72eddbf536c
SHA256

e951f227bcc9f0b00c4d35edd980900e16386d83e5833d95a8dc9287fe052231
SHA512

d165d3a45e3dc2080f109211ce4d483c81f5c6355b73dc54808ee2d553bd9480277a02a8b9e0a51c8b4c6b5a21e0d0367f33f24e0d091b9b1626343d394823e4
SSDEEP

384:Au6LKTo0lAt3gYKpZZh7ITHkg7BbU30I8L:plNZ9cL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34D31390-A3F7-11EE-8F35-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409761140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
552	iexplore.exe
552	iexplore.exe
1660	IEXPLORE.EXE
1660	IEXPLORE.EXE
1660	IEXPLORE.EXE
1660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1660	552	iexplore.exe	28
PID 552 wrote to memory of 1660	552	iexplore.exe	28
PID 552 wrote to memory of 1660	552	iexplore.exe	28
PID 552 wrote to memory of 1660	552	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30da6d61a464435371dc32c53956f49a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4bd5e6f4675a6fcf4e8d7312b69fff1

SHA1
2aabe3a1314dd6722b97656fe34e1a6553c03cc2

SHA256
5299c4bd8d5f952785d03338165760bba59f6593dc889957ba784d1cc39edbc5

SHA512
c36c2b48df83e36e0af5bb68042399edf695f6fcd42a8adec00b4e8326d04c26dcba411456c300c888cbaaaca235466b7079f08d24990ad59cbeed46177e82b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0744059e905cdaef710945d7e4fea2a4

SHA1
da2583692627d60718c227e42e0025e411a0e2e2

SHA256
ad3a03e15055bf708deef756c3750a939483ca23a639cf9dae1fb4f94a99ec32

SHA512
58f8d475db3e3715e37dd38943f4ca59c67d4ea48a49cdb48c2a766b8efa476dc3c89cb4dd848f7f3eeaad49c1c69234bea9b6f85098e88668897b901bb7e68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eacdf96f5de737bbdee5f94529aeb9b

SHA1
88d792a2300d112282cf0c500c9ee88e6878a10e

SHA256
c003bb2268ec4dfd34503563a6c6b80a81485152e392bea000e520a9faa12eda

SHA512
74215e2321a65ef87316104d4b65475fa2555e58da61d95ec794c71d0aa4b308b2237b809be7e124325d05b57d282f197fe670a65497ccf9a3b8b6a63300d2ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8765f999c7d4d191032c650c5da877c

SHA1
b3add7e821e00fd2ad7fa80b59e84cb5c9575442

SHA256
5e88be525be90bf6c4f48a75eb6399239d5f0acea198391fd7c5d93a65aeea9b

SHA512
a6207ffa101425ea153d953f2171f632f23760fed1c1fa73daa1e1d2647b1c92b91f6a83c3816d5b3b18277656eaa16eb35a621e87df2c568f62489694a271d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db1da087e6834dd170a9673e473d0849

SHA1
484ce1a205cb9ec5d8aca9faf5d63948819d9252

SHA256
997b67cb14db4209566f56c3234cb510e9a77a26a21862457a2a047847362187

SHA512
b76c4b5b41d54c51ec229d6a690d904438a99a173c25c2209ba51fdb0b3b002c76929e5946bb2fa7ed555aea9cabdd3861e0bf04c73158f848eea021fe4afdb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7b304d074d35815fa25163efd0301df

SHA1
54c76e3c657d53368595ef97a85a66b18aee1bd9

SHA256
c0891bd5984e863478986ea98b23a3b946a476bb95a121d96cc9e5ad7acefc2c

SHA512
1102fb8284f8561fbf0fc047da4e751ccc8464237f49d8a282cbe80c0ca0e16dcecea39b022d6e8b7cc5165a305dcc68c74a98add88e2694a9e0b45c0abd7e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8581f47b0d4d5078b8b6459153ac624

SHA1
8e62e115e25d6adbb53b8ec476a3050da033be6b

SHA256
1f7cc0018e8e89866dab8a65e0182f6035178bb280bb7586a849af1861ce7bfc

SHA512
35c09b43c92a60a53b89dd5bbbb22b3f0dd9e80d2da847f24be576f4b8e271b0bcb77e7c293eb5c3584785e247ad3e088421d71fd9751441b16ea05f4fdcf4f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e569398566d2a605367e37ecd5259c90

SHA1
6328aedbc8a3c1bb2839f412f649caedf50ca1f9

SHA256
4a897a9b971101aa2888b562108f25165f4bd3e9c403d197a84ea876e21eefc4

SHA512
fc18bbb9a4296bf6b00d8dc1c2b662abb89585a503b8d2a8278d9d0f49e5790c26e8ba9b6f56236d0f14c77cc6d3df132eeb8b3d46213879da6433bfdad6e68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586732831c721df91e39f4d7c0e1ca8a

SHA1
d8a83d561c48dad2da9e2b0db6029d09c4ea6061

SHA256
f18775c69d18b7c585e1971f6a168f37671cce4eb6782c4c23128c9cca4d8f78

SHA512
2b85680d04c96661b139a62895603d1a13a87791d1b145890bb7703e78e8bd85c3afa77cb97b24d17d20252a1e25d7c8b0ac7aee640e70c2813a6d6841c28fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab457A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar457B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit