aaba379f9ef6750680c78cb94cae3f782fba33b682934ee0a5581a43c4d77901

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

352eee5da53b28d338ee78a9f4ae6cff.html
Size

12KB
MD5

352eee5da53b28d338ee78a9f4ae6cff
SHA1

b56ecd90f2bc091a4b87d68a117a8eb1b5effdb0
SHA256

aaba379f9ef6750680c78cb94cae3f782fba33b682934ee0a5581a43c4d77901
SHA512

96a0b4e09fa540a3b9b692ee1cfc262e0909f2c8e383162d7c1efce59e97989be32d9f8f368cd1343a68920ac40b1aade304187f580cf84c2cae85de504b3313
SSDEEP

384:FptPNxJv+mMc+tjshk49rra8194+ZIUZVAHw:zf+AB4xXQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009c3c44a0a4dcf0c64c0e4640d8b5a7b483d0039ab8b8087c0df6eb14f4e23836000000000e800000000200002000000065ce03ecaa7e61e9c1b940fc33520c73124847987a27d45d6d0e4eafd1ae0bf42000000099ee91e3684ea24a3a0cc1c6773299ddf08db1b3ebb8f60736c894097550348e40000000c7425b2589ab2cf4034556592eebff3ea086df09e9981426977737cbc485822e5f0f189d3e815fbf7cb0cf60f652ca199dc055a9223857aa8980e6646c87854d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409991110"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8BA7911-A60E-11EE-AD08-DED0D00124D2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2041db7d1b3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000863ca86b66f6e517ea374449a63f4fbf310eb78f3c46b5cdbf0dfa4c9897c12f000000000e800000000200002000000012b2672fc4e6fe940d3d53b23daaa66ab2a24605ea5b862b441e7ecb42e66ff090000000622a148cf3908f221c425da1357341ccffd5990ed3e8a73a30ee8355b63cac683b4c655a3df05abb4597bd67d6d5c0987870cd5c9fe83be3fd0381ea3e3ac272c5a1382e09e3f6a0504d9d84e18a67f89176b9e242f3574c38a7c0b501ce74badaba635d7bfdef8653f090f8ed41fd3cd76ddc9a33581ccd3643ec48ddf4b6d38046de43adba35400f64053a357756f740000000f83be01fa5fcfefdfbec9002aad1fde6cfe954e6e0504f1da7dd79975454354bdd6d82f57721668232b6a3091efc1a8579149f42bbc1b4743112e03380b49481	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2656	2884	iexplore.exe	28
PID 2884 wrote to memory of 2656	2884	iexplore.exe	28
PID 2884 wrote to memory of 2656	2884	iexplore.exe	28
PID 2884 wrote to memory of 2656	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\352eee5da53b28d338ee78a9f4ae6cff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25a416737687e8f9033be9b4a58727bf

SHA1
12450ef1ffb749aea98f9456c3da1eafa6d38680

SHA256
92db5aff08fe21545cc65540cb794d877bd02df48f9a831c955a1e2a30239f8f

SHA512
ec2afef5e70dd01c53bad79638addd7ddee518d3bce3df9ab8619682d91f928d7ffae1f626754dd6f464325f4906623a700e53000e72f40075c79e952e4d3ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30afb37b055f0c8e000a6d2a292c342d

SHA1
1ef443ca5198fc629996dcc8caa32c578b298b2d

SHA256
9d6f1be014a30828aeebd34aa6a9b874c2f29a17951388ce0b7131964364156e

SHA512
f7ce30325e3146103ec13af85a6e723e269a8287e3503756e44625fdda40227704c63c86d40f37e6ce4478947031c033e0793d1f1b48a1e79f1930ef02a7af0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39483e08b1f615a3e20f8973434b270a

SHA1
bf93e1379b3f72bdf466d7a5e8e3012103a118f3

SHA256
c1aaf58889f3957140b7d2ccd02bb4e85fb4a0d7c352257149ebe4c34b814d57

SHA512
0aedfc3b781f00a6f7f1cc551835756cc09928e9067fa976ab6b927ec020c636adda3a0f297d7df666b3e72544349ae00af376f87030543c2f3d85d3e73247c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31017ae124bc5b2cd8a6ba6759dd892f

SHA1
85c951710ec14951fd128228353940e452d41ca8

SHA256
eb2c9271c4f88b4adf8d935f13c9b3e4248ea2dc7df6ea3a98f99d8dd4f679db

SHA512
7dc2c5c8bff7644203c81e74ab66bb8e2562649ee4d0d2ba30ce6d48b7d06f4330d80711083e74eccd5cad5bc64648034923eb010df5063511f4703a56c7ab45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
034640f553f9663e533483a5fd24d785

SHA1
460325a0f85f746e4215e3e7a2efc9d8a56c56cb

SHA256
0691142c30d9c836ab598c5179c12e205a8af7354c16c69468965e3951c74753

SHA512
66858e971456edda93dba1003bfa547bc9ab93434a7e4302997bc355be6db01727896048e109040a6ae40aa316779f9c36ccb12d85ef40cec158180937057576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68478706cd36c3fbf441ed7677979e29

SHA1
2d0777d64089daa8a7c142649ea06c0452a6cb77

SHA256
3da2f7beb3124b13de2a8674c7bf137487c32a8cdd417840edc736e454fe96ce

SHA512
1f1be8dcf036dfb188c8331b95f671c8c109f0e21c2faaf40658b587fc0239f1a90532e6eca0b9f0085d5b6d7b0e5dadf915873481842c790102c859f1eacd3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d108f3ce649776155716f00ed1c498e3

SHA1
d7c0aaec303d347aaac9b2b1e5c099347dc9b469

SHA256
fb51b0fef3fa68f56448dedabbe3e8e9d8974b66688e8a1242b562cd252edab8

SHA512
e5d4b318f9825a146c6a7aadf18a602fc4cb6282a671aeddadbcfa4d392cacac8efbaa77dff37c9c71a671b817814065f17b750fe98bb1ca3042d5cdc7224c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ac827fef405313ce4a22d05994f568

SHA1
cefa0c99d4ef2571613e339d5de538a312045a80

SHA256
b9b807e4d33b4f3237cd0a972c1a3a600c0b49b6211dd77833b21d2d930b697d

SHA512
54a69495b557b6d200dbf191a247727d5354ebdd2b0d504ba3148dbfc95bad60fc1297b0c95bd6176c4ec233fbe0d97bb34c47215a8687506adef303dc4a54d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7b0246f11f65f3fb6b161402590134b

SHA1
caa24f7b64794f2ff2abdfc7e9b19e645b31aa92

SHA256
661405ee2461599ee1d2d6b9b00da6cbd8192c279afb7a6e3e93107f307f5230

SHA512
4c5a7988b332b377d46fa1d139aeb479c45ceb3bef6ae5d7fd82fbde8664d76e4ce76913b2d2496cea9e14d7510c1de64d3612ecccbef839031975bd24c65a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595937c2316f8b3ed375fd8f91421b92

SHA1
955c0407d418fad1e6520ddbdb3108f92a915345

SHA256
0ffb11b734b47024cd698e695808febd2042aae20c5926b595052aa172eec5fe

SHA512
caf6f6d422a02881e11d30bf85494618d93f291dec3684bfc21f26ada9f6efd5ef2bb06b138d5b14d972717be3699ab76cd8c282c772c9b3234260447ebd4415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818afcd7ef1287f1ab60cfadea94b764

SHA1
abe1831d15f3f01995cf8a4bc28d69de2eb3d093

SHA256
e7b43a6f55fab1153d3cf4a4c307bb406e839f9afea1be6afb22dc60fee6b446

SHA512
177915c964f102408f9ed0dd57ffde3108c1f4b92a6cf215a74f1a8d84f517d6b84d59ad5ae85fc885f03219f40d2d37d6a4e978b5cf7413940c64fa3fae564d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9743.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9802.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit