e6f2e479b72e6ec9700906e1fe57c0b26f50b6fbfd5d1a224c3e4f18d9b3f179

Analysis

max time kernel
207s
max time network
258s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

307890dc4b0c5d98a78d88c7644a493f.html
Size

126KB
MD5

307890dc4b0c5d98a78d88c7644a493f
SHA1

e37886a45a60d6fda4ac17c76f4e60d064b266d0
SHA256

e6f2e479b72e6ec9700906e1fe57c0b26f50b6fbfd5d1a224c3e4f18d9b3f179
SHA512

cc070637b0e663aea9b1b8c60bba9fd4c1d31c3691c6a7bc110c5cd394c3e1faad43cc9d4eaf7e8d3a07eff6cb7b4d58f4e607082b2319d6ef16c5b6bfc20101
SSDEEP

1536:Uf2yA/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:Uf2RyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{311959A1-A3F5-11EE-BE47-DECE4B73D784} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409760322"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1500	2288	iexplore.exe	29
PID 2288 wrote to memory of 1500	2288	iexplore.exe	29
PID 2288 wrote to memory of 1500	2288	iexplore.exe	29
PID 2288 wrote to memory of 1500	2288	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\307890dc4b0c5d98a78d88c7644a493f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a1adfc92e361725eaf77376ab8e20b3

SHA1
5a5613373e4d465abb557f25223b462fc9e20393

SHA256
c7577a317df31abf11ed371b16f6cca263eb18ac7ff104981459464a49fdc321

SHA512
37c98f94a79794568f8dc850dab26160b335d93206b6b024c7eec1e0a2843206a472472939e52636aa5caa41e73ea7259882bf2f2ee6088fa068ba6a0965bc5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77f8410a2b68d6ee0e1cd584df6e6f3e

SHA1
19919fb013651ddb8af3c0df3ea2571badafd133

SHA256
ccbc0ea10cb4fd4f55aca951f5157caa4aadb62376d9e485dee70c01c4e9bf58

SHA512
9ed92e517a0ca3c7052b1f74062933094b016db5725cf754eef7fa9db0a6c312a0f0229d24244990a66cfd37480ec531d86746c8bbe45c41d504b38601e86a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13f91a6fc0b6aaccbb08265db91f5d8f

SHA1
a4327e0c6d0d9beac4402df34450c55ca41d7024

SHA256
c8980875ab0181168530ec6cca412f929d43a3bed79e151794a2df59a631c1cf

SHA512
95887302396a137760b80f7373d6b350b004caaa3d27706376de12f0aaf7e8102cc8fa33e104591927ca7d4c76a8f634af340e05823a4e878fa132aa936b601e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
407e494531da1c81a265246910b8a023

SHA1
9e8997210f7ffcb9dbdb3746e046f65f07842bb6

SHA256
4059fc900a262c5dd0e938fbde186abd280044e5c455525eeae633b1c8aca9c5

SHA512
39b66a5c9ae803ee8754f18696ceb8927747eb64102716057c7560a81af34992362ae6ddd5c0c44e172d2a027b0ebba885cdb89bb553f938fc0a3a4fbe7145db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b20e032d0b01b107111a2480181696b5

SHA1
0f145ce8e9e5450b8d7874d3c1c1e2c1a0ea74fe

SHA256
c4a5bba07f32787e2239325b3338ca542772e792dbb7c70ad567a95bf363d457

SHA512
d4768b86e01b1ca5c6ffd4916e98b7a05eaad5a36bb81bc4e45b5c981bd98675f80d05872b20bb93f1fe98d0dc42ac0c22625964a7264ec81b0804c90ef05f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fdeaaaa02fcd1a25b5f720fb6ff4f07

SHA1
0bbdf73d92b122d69dd11d4a50c0adcc3ef3c058

SHA256
d74d31dc755d23fb793b142db61b69880b8aed01b3d7e00f4a9bd7652ebe76fc

SHA512
6e824568ac905773a842d9129535298a46c97632b9aed37a21540f2569125035758f63da16bdc263cf0fe2c50604867c191e235c18fd0b6fca815f6728af625a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f1761e43dc53b25b1da0c1ed3b2cae3

SHA1
9564bc963d2e091ea71bf23484e80c5648e19118

SHA256
82a6f04d221d75c4d2ebfd83847ee27511548c0408bd21d05b72ec694a57a292

SHA512
389c9c81cc40b6c0dd5ae3df3ba41a7c4708b0d529c517ec0916112e13c2791ec07249657599c027b46fdc3b868676381018b667e581b13cca29ce389a990adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a219ea533be6777c15d140d10ecbd5fd

SHA1
5553dc309a2c179c8a24fc0cd19d22363f0eaa8e

SHA256
71554fc3f98d24edb74a7b7be03db5b94cd3d81d226c79a729bf305e54b12ddb

SHA512
667b1ddd454c7b05df0f11ca6b1e7760a90aba3af470176e251aad1865ab2ab63d0f34fcd58d5db8d8aec9b1d9abeb49f98f4013d3d2ad1a5597b60a32609541

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2274.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit