23f098e538a6aebc739dad3344715dafb1c368b05a73de50d9d15659ea91f2ed

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3845eccb6418aee2d277da763ef8b4a1.html
Size

53KB
MD5

3845eccb6418aee2d277da763ef8b4a1
SHA1

b6e17192ec9b439bc9672cc4ccc1dd7dc47f1bc4
SHA256

23f098e538a6aebc739dad3344715dafb1c368b05a73de50d9d15659ea91f2ed
SHA512

fd58f4ce347e8d9a67167a80ffb126601b80b1a8a5a2b8c394e7b48b227f950223dbf4c2883c09bad60ea2a73bf7dfce5f3e47e4086d69b257ccfd048f8e1290
SSDEEP

1536:inPl+ydz02vxrsTvb3izVmIaJKIBsIpHl6kG2kf0SUn:inPlXgSIpHl6kG2kfe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d8b9e82538da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11B9B951-A419-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005377429bb9e026ea6030cbf876f9667dd20abbde2d270ffe4ac20885addbbcf0000000000e8000000002000020000000e30ede4838cf3483031b4918bee739a702892ee7dd70370913ce8955a47b7a2e900000008037c32371785ac446e65da6ce5abe002bb0f96dc0200f655bc8ff69fe7cbacc54c0bc8576adf9efdf7272dc9288946c1f3fb2367d01ffebf3b7b32ead16e0964f223cf4a7850ecefe1174350927b9a5732bad93f30ec84bbae68a7bd9cdcd984db9c93b7d2127febf3f46ba6045e0507a3956f8a57719c14185216215264b77d13cba2d8314c6339bf95770a5e2ca984000000089d2fc1534556b7aa91f4e68c55aca9bf1c9715ef294fc8fd39c688c6d7b553561c7ce397330b107881c6c9ea28c9f9239ce2a0870a5d4c1c1e9577cbe1139a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000bb2ec0608f0f186cc43d77e1f0577e02f441475fc1dfca7d89a2c10408c30610000000000e8000000002000020000000e34e8ac64e3f1756e406b3bb83fde245c86729b1dcc4cac65950e22ea8a1b2ed2000000044aafa15cd28ca817aa22e83325340a9b9c8ca0950ed7fd9a371a6f92018181b4000000075ddbe3dcbf3b1450bd7e969ca6fdfc618d963664d2cc96933a79784f0ca0a51624f445ab2e115aa747b4e47e330d3c7a1877d7f2be79a145a9ad641f9454a4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409775676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2396	2028	iexplore.exe	28
PID 2028 wrote to memory of 2396	2028	iexplore.exe	28
PID 2028 wrote to memory of 2396	2028	iexplore.exe	28
PID 2028 wrote to memory of 2396	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3845eccb6418aee2d277da763ef8b4a1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c176ad6c4032019a9d1ddea94fadfac5

SHA1
66c3b32e15b3663ec4add04550cd2493633119f7

SHA256
9cfff04c771b7c12a1963c2321bb8a997a6603add7ce1a3108089278b32698ec

SHA512
82d933e6fedc862913ff89c8d2aeb2239f715c5faf59ed8ba686439420b83366e5218d36f5ffa0ce1226d6ec206e62dfd4f15a6969474b34a797a2dd82d09c15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dcc25783491fdc4563e2dc90182bc61

SHA1
5c9a0f85a854eb23adc7b1fa33da0c6bdfc58424

SHA256
2f2d3ad4b383cbce4e360ef803b3eebc18ed5da2cb48bbde206d12f24b7c2024

SHA512
d96e652777b682147a1576d22f8ca02bf362bad270bf2b5248cc053d303305840f9a4d804229cac52740fdb578377a336d7a47745f7ce131d3eb7db3c9cd5dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdd83544c27fd588e3f24010d66fb424

SHA1
ada74f87e9fa238fb626f039679c5715c62f1ff1

SHA256
bdce4b1106c785fd6a26abe9a63859a3e1214deb2df95cbbccf0cd6f63706381

SHA512
d926529f88ec30638906c14751f630435afafd5a28e606f10fa50ca9c61da441e0ac0a53a714d530a749448de6a1bc114adef319c5c2f9b7d5ad1df1a145eedb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ec6b3fe61e0b2caa84f6b518218609

SHA1
192b31c025db221eb7e59e95292834bcf7cd71c4

SHA256
e41d3ddcd8f18ffcf8eeb67a423c3e1efcad90b5d72c081f7af808f5ed4a9efc

SHA512
d7a483ea9afd8c59025e1690808112557c42bc85b0bf24a91da1dfe486ab9d80524e996d27d12c6ccf337931ea0b387da54459c487fd88164a2ab66b426a2cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
180672da0116197c47bd6968c58dcd95

SHA1
4a457af20fd5a21e82fa4c792894aae8db10baa1

SHA256
1c91f33a0cf809793d5d4ac185f497126a5d544a3096d1de9a13812d6cd68ab6

SHA512
e21f8954d70b9eba91bcfe6ab6f7a8f2925e54d3fbc1795286077e114f37824be9466a2a415a5cbe735ded03aa7ec89b5379babaea32637865e529a054f2e515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2600f3095860309f6fc1a03982085172

SHA1
ab3b4528f78e313f0eed9932eeb6a8650f246210

SHA256
f7eb9e5825dc6f11e83707141aff0525f4eaebdbd3069a93992cd88e64efaef6

SHA512
c8caf78ed44e8941147fe02b2c322a57ed700b9e8ceb1d92ab969aff51dd52bc84dfa99a58763865d65918ccd5ae71d2379eac8581f85c89a2d2f7c7d2ab2578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c099617c1173c4062c967a9fdf163bf3

SHA1
1b34f12c02365f5399ad26ba2a1e9f63b189ad88

SHA256
940a1e32af907be179dcda71585b672c925a9be4143750365e49b0b23ddb9923

SHA512
b93de345bafdd931b134bcb3b9b47111ba107913058e48e6ebab7f39dc61730231e20efc2fd2231a691355873067b5957ba093f10304c698ae59d1d4fac66c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d564c0afaf683d76143b75e815498a1

SHA1
44296ec5f2811fdc367d3a1e89caa3ac72523124

SHA256
224f2108093196691c8832313dd6c1e3ec62291e8c7e07bfe79c4e54904e2baa

SHA512
b2064c304aec8d54707249ac7f5fa3b093b3a9ce1b9dee4c75f4e2ff7b089a314c31a2724883f69574359da41921912a9cc949ce53bbbbf1aa0f8cb5d5d8119f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f632ef23661e09f2dc757858e855e09f

SHA1
f078e55862a09db6f380f0be8c4ab728e88961c5

SHA256
1c3fb3c32eb2e386900b8f226f337356948b5b810971ee35ce5d07e359ed0005

SHA512
0246e48a3f1344325e968d1459c64c89a800a62e4cea9ae32c1ccbe9996d067d8a3312f6c2866c18b29ddaa68f53f76f1615f3cc4d67ee69fe4639928f7c64ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B87.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BB9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit