dd16b0860e5ee8393789ef62de2d663546869de7bd7bdbd9fb9c6a7b8c4a8cc1

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34fc7ff59d3a8189b03a454d91b0f9c6.html
Size

44KB
MD5

34fc7ff59d3a8189b03a454d91b0f9c6
SHA1

8a0b3ec23b1489de56292b81a09c564a6d2a6bd6
SHA256

dd16b0860e5ee8393789ef62de2d663546869de7bd7bdbd9fb9c6a7b8c4a8cc1
SHA512

bf68f94330ae89bb76261833417f74b21767ac1cdf22d520f4df17c3efb354f136bba3d24cc5c9246cbdbfdabe79c9a099ce9f3058efa4bd1b3c613728807584
SSDEEP

384:dUgZ5GYzfzjuQnRP+nlfjo8lC9qmUMyaKf:xTug+nlfjo8lC9qm0xf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000046de50e593c2944229c186e7f061c9ae20671d3e2c9c8a6a45a4b320e865ff7a000000000e8000000002000020000000fa87b945b6d287fa66c4f95b2b49015ecd3b3d378b5aae5135cbae48a7346dc890000000e0472565b8628fa40cdd2979db84e20a5367cf926542d69b95666c752b85de57e8288fb2b85c22660cb957cd24dad672a5c9202c80e5c211d18d312a2c053122024616151d5fab13f78f26ee4b2f69a3349ee5e28e016e88d6bec463be6ce3af3f85f8a6002a79d9cd91e274d79f2487eae90a6938e4218e2fbd6c588b5ca7707dbb2e853443a44eefe46aca00650e2a400000004a088c6b26abbcff4fec5ab50de80592dbade1cf28497fbea0e10a21dc63311d3ea77c775665073d247030b0943d6c6abce454607316a7519cf2c19dca2e57b0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409990527"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09a673a1a3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000003ca655f971e0b8fa71072d6320c2f469a9f2371daa05cedd2817a3bb6889f1bb000000000e800000000200002000000073873eff385f848223ab1b87b2f696568ba0e29df355e1b70cac9e78b986760620000000ba9c74e2e94abf53116fdfb97b21b830789a90416aa7fa576b96cdb2179a89e74000000020624fb7f49c2a78fdeebff6bd7d85b93514d12e6feff9cffb57d0bc410c05a29a3e7b9163e07ddc00562fc32b26a3f38ed2ef705a707c830d092d13edf6c7ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4EDAB5F1-A60D-11EE-A80E-FA7D6BB1EAA3} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2616	1656	iexplore.exe	14
PID 1656 wrote to memory of 2616	1656	iexplore.exe	14
PID 1656 wrote to memory of 2616	1656	iexplore.exe	14
PID 1656 wrote to memory of 2616	1656	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34fc7ff59d3a8189b03a454d91b0f9c6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce6b9dc082871072c912d08290b6ce3a

SHA1
f55dbb725374afe334da7107f812e7fdb06ab56f

SHA256
a3cf90728df84b31c5ad4b05ff6e9decb7377ceed57d65dc42f3bd745e664b3a

SHA512
7b9894034f5ec7e4ff7fab7828a8b35ac84aa709f544a01976e21262ab8ed7757a1e2fc6da26e084ea3e5684106da70e4cf8744c96eaafc50b064a059b3c393d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed549aaa9b561cd15bb5c2cfbab134ed

SHA1
76450e60e17824d5d6fdef59cb1cbef42b9d7cb4

SHA256
876ea3731698026fe7a7e4c32bde1be700a903527c935352e6d8d343cbb7ad9c

SHA512
3610638385304e37639eaa6bbe247e8f051e60952e51ea914cb3b2c1fa9d221d02d35d31489938c649687e7e00f1306606897c3a68e66d921f133b01d51ecc1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8650f9bb08340f989c0cd92c6a7da448

SHA1
039df5d132163078f024e9e51855be91c1f84453

SHA256
24bf409d01ec92462f6784f6914cd1247fa09bf4d0fbef079446dc5cb9cb863a

SHA512
c7405f41ce0dc0941d8b62f660ed39ffc75b1482f7a58c43237904512a45e38274d963ba6032be1cd3a6cccde37f41ec90c5cae77cb99255c848a1f6d4e95d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1982010ef23c1a437b62d37144a8b4e

SHA1
4a247f2ce369f8f4708334d62752678cd4ec3c8b

SHA256
d295c6382b960f64fbeaf0b4fba887db1745b4a2cb156f26c54222bc4faa3067

SHA512
d2e2afc0dee4c9c13d2313855ad3fdbd18739f7bb293687a3f371820bd7f3b38b02873b4651ef7324179b4b315a48ed74831c16226f7d338291eb74b9798bd5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5eb079ea909213ae6be169e3cf3bfd9

SHA1
ee0856d192114aa650bf11e7a25a71a732b2544a

SHA256
0b9e1e0c7f8ee0cd156690bb5d049107eb286ea27ec48e982dd1815ca1389987

SHA512
d42f7674fce9891dca6b48c3888c5d139996090f492d37bed87e569a60e554063f751a748a688da6816234f3152b3debf72cfb9f70a88a91f29f0c92ec399bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daab716537095a3caffea722b86c4422

SHA1
fc0f5b9c619e904ec06e6df74bb6e99d26ba0ba6

SHA256
ce6dbc880837f4e227fa70b2a2ccb824946a7a5fb4beb72cba66cd0ccdf5745d

SHA512
6b1d966a2013b53a7e498a0091e30fb8a0f1b2d20372cd056f4a9667361062f03fbace69a74ba47bde3c208ce5c220078971ed4322b4420c1059f1a754d4ae79

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC45B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC5C5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit