e1639ac5d9539324d65b274c710f519824c37e871bd5c1cd8bca309ad421942a

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

375af8862bba53a786c5756fc17cb137.html
Size

6KB
MD5

375af8862bba53a786c5756fc17cb137
SHA1

3f5512c46e1523e77bf3622758e88a5bfbb99be4
SHA256

e1639ac5d9539324d65b274c710f519824c37e871bd5c1cd8bca309ad421942a
SHA512

d98381b1dee32f9dc429bbae0f7eb0431f26f2518e054d3b83d091b40ed62c41f3016e6a835ba56605db619a885290e5a90cc7e52cecb7691f1f69da303bb9c8
SSDEEP

96:uzVs+ux7h/LLY1k9o84d12ef7CSTUfKcEZ7ru7f:csz7h/AYS/xb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000bf12b467442c139f2dc3d7abe0b6148d05857f9a574f71dd4c8facbaf6e1c757000000000e8000000002000020000000c2a83a2fadea8cc024e0a310c4bd964371e1bc6bff6ca701b32f0399b7963cff200000002bf187833a4cfa34a19f0de954b2d8e98a9b816b70af9fac8973303b9be09f42400000008ad19853febf9a02402e8f6bda16c7a38b1977fe1f6ec0e6026e4368a87d986fafeff1ff4a0643af055467107a85ccd39d640228d36a2eeb619fd559f2b6c4fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1041bc712138da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409773756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{994AA821-A414-11EE-ADCE-5E44E0CFDD1C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000186af6ccf20464a2932f1a73609723ae79d769adbcdc9fab4473f9183b855039000000000e8000000002000020000000360d13f26325a5a61db58bc171e2b175a9fff2ad08a029ddd8612b6a78140b2a900000000fd8f52dccdeb8e1651dfcb0958b974de77310f37bd0967a9610fdc8ace172eb0f2f0875667d42e4a0ef8b770ddd59de731601f3258ab6d4ab03cbde47532910beb9c6f767fd0be2694d56565c4c6c428233e10ed375347598037d2da1a42dae73c120bfd1ce829f8c62b9e13b1435ffeddc9e35a6c3e448ebd2b053f689ba1db36c113e9c3cbbe3f1e1b98af69be47040000000c9cf944ad4709b4421f76c304ccc238246f91ce2a82b2043a46dc62b878d4d5416a6701783639365f64cc96b20387f4c4aa48c40992e5f69bf1044b921aa69dc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2320	2888	iexplore.exe	28
PID 2888 wrote to memory of 2320	2888	iexplore.exe	28
PID 2888 wrote to memory of 2320	2888	iexplore.exe	28
PID 2888 wrote to memory of 2320	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\375af8862bba53a786c5756fc17cb137.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ecfce204ff10ae6f7053c1d71b591e6

SHA1
990a64c904806bfd951993ac49ee18d29ec5abe7

SHA256
2b3ff2f74eaf6e8e90f540027e7ebe3fa8903a6485eb4857d3fa82ac5624c984

SHA512
e510a15168d6e4d08225ef893360f8e27eb54dd3f81dbd04214a45e3d37426e1f8761f322c4fb0632ddc3183dd3a09f57ae11045f23b86501ab34861f7a2b9be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bc642c572339c998f9bf082db1868c7

SHA1
06ac8226d13b8a5266ce1a19c81247a5ad55c6c7

SHA256
b28403a1508efbba5821f75baa74ce90a67f313b14ee3334aa354ac9f69923dc

SHA512
0a0446b2a9fa1f14a5ee3400e5a42ced0a1c065a253ba74f6edc15488318889af22247acac93a040d92322132823bd85545b1c807b30174bd965461253c061e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b2ff9fc8b5fe34a95c5fd3b9c2eb0a6

SHA1
f2a8bf21857fc0e8a4318d3eea7cbe3fdb5e09d2

SHA256
b0eefa87200adf1992db6dd67a42a7ce1a86e85c87657f215821b582e1a21b4b

SHA512
ec71b2306f06291854992aed9c7e9f286eda60042b2b2d54dd0f49fd6d420643e7f5afd94e4b1733edee2f49a8ec695adcd2c3d279b551e2538592a9b10dca0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2016320524bb88dbac4fca5d3e1023c1

SHA1
8d5b6b97e4363aa1704386f0cffefb45c90ffa1e

SHA256
3f2125ff12718f4e49c16e027d03dfe3b3d27998e17e4ecb362b96f4ffd899d4

SHA512
55ea41b1386cc30798382694b284067a53c4d5e77210dc2d369cfdd232532f06ef029294e38ed7f6b699e2d2964cb6c213b0635cec8f8bf8235056dc0ca956ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03dc7170508a04ca5dfde04a60632411

SHA1
f10d121c58bd12b5ebd1402050ffe8e4934bde95

SHA256
e376ec2249bf1f6a9a391c69f8856ebdd5625fe63ee76dc8f3a67721ec3a1685

SHA512
3ca057e06a5686081855e886a027f830251df55c0d965dfcbe855c4eabac94f5980a29143943d39d6a163dabf028ead7a31b67586635d4217d6deed67c5bcd5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79dd2687c5e6fa9ecd8e05d23b84ae44

SHA1
5319151ed880544c076a1df268aca2f7731ef11d

SHA256
49d4ec5b5b2b321ff1a6a8970bdab1d2161726cb53ca78fecd335de720e20c89

SHA512
b1a2623eabfc5701bff79178644092deaf37064bc34329e461a3018c9f9bd6e711dc964a50a3a0e440e60db9b1ff7dfbe5600712fa856e97fbacb9b8ff578f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29ca9bf7a12834e324cd8fc51a400d4f

SHA1
d27f2db0c77662c9000b8bcf347ee13d1954610f

SHA256
34acb0a8b68c85196dbce32b751edb71596de071b40b422da876e777b62401a2

SHA512
fa3ad7cd3d23d0800e826a95259368dbbfa264695a61da7f13650d6a03d6cf6005102174151139e09a23bf1d7a79620d685b38064a758f82578d38c4c71ba239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
783f355739d66e3e95f2c1bb113f4368

SHA1
e2725a693a6906c61ff39a0fc523b4e5159596e5

SHA256
30e88e507bc51d65a4fc9bd4819127b89c1654480d03d76a4364a3c191cc8413

SHA512
00a84a0f606a484f39c12e6e7f46d0d634c6bc5d3514e92f33d0ca31ef365a5def65a52b48e9133f3e1aa2fd29c48d0e00932d5fb686d1f1983a9eaa91ad44fd

Download Submit