52c54a7e7b5873498d2cccf664af8738eeca23ce1988f147ebb6925d3c362b33

Analysis

max time kernel
186s
max time network
222s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ff2e412dd88cba6ee1dbc6d6fd60cfb.html
Size

27KB
MD5

2ff2e412dd88cba6ee1dbc6d6fd60cfb
SHA1

fe96610fbd9b190f9a6a9d2d43ee360935eb3759
SHA256

52c54a7e7b5873498d2cccf664af8738eeca23ce1988f147ebb6925d3c362b33
SHA512

b316ee8ac8cc24a3344ff434d313775c024a69e76103654b2aa85e78a721073400131584f50c4be52f1e77afaa64a33e755812537c00cf4330dc5de1c2d3e279
SSDEEP

192:I+fTDsf+DxtzQY6wypr7Un0/tzqHNx3XSax1QhahtcFa2jEyPZKOmjNZkL/6TXzs:+2DbzQYNc00/tzItUh++XU7BOrBcF7s

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409759273"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2DCF831-A3F2-11EE-9C4D-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2892	2612	iexplore.exe	30
PID 2612 wrote to memory of 2892	2612	iexplore.exe	30
PID 2612 wrote to memory of 2892	2612	iexplore.exe	30
PID 2612 wrote to memory of 2892	2612	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ff2e412dd88cba6ee1dbc6d6fd60cfb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f243b9b9b3a88dd2c98176dee834b6ca

SHA1
0bc820d8ead29e989758e237905840fdfcbb4625

SHA256
aaf6df1d3494720d33bfc18ee0dd02094f12be2396a07a6426d447882c1294cd

SHA512
b03e1165df9e1525384ff653123384c5639a26fc6d23b6ae46e38a329ef374388f0cab5c5f56e6330b3400cfdc82462033e2300fbfa2dd23f7ccd485cbe81ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2715dc3dc787594c0b8901e72f36546a

SHA1
b8c3d8633b6e888d765b14d5dc309c3f43ddfd03

SHA256
bca8caa0b103bd57c15c838da795095a05e695618883455aacc39015ed48be3e

SHA512
9633b3dd93c48d9bab36d1ad04815d9af9ca0ed0526139a6f34d345b99f26cf69eb08aeee25ea9352df1ae0f04f1228cf97eb31c4a0c72eb5b2e5be3aa54f319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f6be1e2fa9b8ba55cff8a30a844d164

SHA1
aa73d4845f45fc6f2e0730d5da390c9d1af08968

SHA256
7016da7fcd2f406c5f71114189c99517dee7b8a2ea683cf118965095e44e7780

SHA512
60312a805bbbf7de4b8e536d87b4f24ff7886c7fceb7e688b7d3e446fe15e3ff5c28e681e375c1e95695995f64624c28ba1067dccfcf50cfaf2a3f48bcd8afcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bf46ff960c42fd3f14c34cc3d4f3c3b

SHA1
a745743e924ac6dcff08619878658670106601c4

SHA256
3f293816c11015ea0c1ef2f129e37d7ae18ff20bf1979030ebd6be7a04dc9b48

SHA512
d328972001c1fc2cec475ffed2739a92c1d890226d6507ad0d731f354aa6769b0bcaa0328d201bf060c1a0d49c5358a327c6fb2f19bef6960aab4c4ec126712b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d157b5c90daf35d969a30932481f7560

SHA1
5ea5c16837722c2206b601662e8f80f4ee1775ab

SHA256
4226681fd02de645855ffbcdc983de8aa7926f547d91e5a47269a38c77e947bd

SHA512
2d905ef4685e6429a87255413c70deff2fb1a849debf5fb8528f0213ae8d4606d2110f54c8b2196c2ba459b32c034073501c919df6ba9c7f37492d72d66a6d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eca3e21b41f0cca764ee9ac4bd1b512

SHA1
015cf92c2d6851f6b964da58173e725daf27dc3c

SHA256
7df6690f16c84632c9cf595c78f8ca2d8eb2f1fccedf0835b955f143e04187d8

SHA512
e49bc453df8d36163ee2ef61e9d29433160660f89cf1b5ef6c5d4fabfbfc2d2e2ba53944ff7ff87f32586dd8b7a70dfe92eed88a1738d41a036e73f2347de972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b0387ae9e82c864104775c8a42f0664

SHA1
7cd315c0052bcfbf3d13bf609cc5e1e19a46c5b2

SHA256
f22186bbc7078e8040176707571bd7900a06bee0eea997e3f7f2010d4d6a9f00

SHA512
12ec3256314e89bca4f20a8592b545a134eab15e673e332b75bac931f6ce31bd183c305d7b00c9a87c35ea149ce098cf83b8061bfadf300a885175a60b24c3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7cd26ecbd5fc15476805827af821dbb

SHA1
5ddc544817590c6ddbd871155cd47e3c84237c4d

SHA256
abfd3413304a6e260fce05d147990208429d2a74bded9dcc11cf57fc8d0a6046

SHA512
d5bf25714c1f49333448681359118da25019423aeedde6d140a0a9ef423da8d2cc1fa259c947cfc9a70b9b03448793182079c647d5f19f3a25e5d7ef2f273162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c91ca24f28cecfbf845330b112da7e8

SHA1
438bfc5c3cfb8c099683fa6fcf7b2952aece6d45

SHA256
994f58c8717154943b76b49526972d5465fdcbab6e94b899a07892dc0e9675a8

SHA512
806f8750746108531e60977b476522ffe4db6276244bb128dca9d7605f4835b911ac70f1d4958a940d806ef8c566dc8b67e044ec6e999770bf2189d2ef034d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7facc7a60652b99066c5d4aa68345893

SHA1
61eebe20bf8618e3e3a9297cc21d4a9c9c9f52e7

SHA256
c82680a3f4f592b774036de9be4edfe542cc089d6a1c4d0b47987cc9cb6e4c9d

SHA512
55d2d959be3af1d3126b73b34065be0c533d2c15857ee14a3ac9299eae350496544c055ee7b3407deab381148531e5381e3c4ca9acfdd151cc4181e474fed9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07abfa45013b339dcbf823af133ba2ef

SHA1
d77d74b5b0aedbf993bd3ddc9309458df757c2ed

SHA256
1f22a4bc321ee72576aa9cc7a2a73c5e74f8adb128fce4ad4b409bbd0962e70f

SHA512
57826f7b99d7d9a8088d7f5c5a2c42c73578b6ef7747ba6e82f427383a49f6fdcdac3ceba1880025f9fa929c8eb8382b68117f187274946858cdc71516369fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9119.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA93F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit