e552e5791c59e85a2e84bc923de0a094854f0fa65d8f9229b0cd03dfea115784

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35e6c24682d878614ef9c5bed06153ae.html
Size

14KB
MD5

35e6c24682d878614ef9c5bed06153ae
SHA1

0efd9fbcfd55a16205a4149f1faf43451c38713e
SHA256

e552e5791c59e85a2e84bc923de0a094854f0fa65d8f9229b0cd03dfea115784
SHA512

8303c41838c14adccd07c9ac4083b0248193d0de72ae419533e2cd044f78d7294bce76d7d63491ba7af991e81ce6a939736ce15adafdf508080ff1ade9d64847
SSDEEP

192:msRsUhx5jcLHdrRVRrW4J20WyUnR9O9woJuF4iBl7f9geIqmK5yhwP0cgMG5aeur:mCfpchr9W8b29jKknf6epmxt9J2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005629ae203ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C77D6791-A613-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a366ff00322927cbc67b2488e03f14eed93248ee6d38ac4251ece4d68ab95e06000000000e8000000002000020000000af65f88e10ed65642077ce10030fd2776adadc51ce6f0077ce343ad5ce8a7d46200000009c8bbf9c3582c106cebc461702f8033cdbb083ae90ea684e4b55ba4895a9bcba400000005cad3be968d2e56c0316f28805d0057b64e75cec6c69b6552aa920e4be6679c35fd27a3785eaeefcda533c6481a416fdf199185f2d125cb538463c14db9bcd5a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000060e901cab80e5151a9dee822e366aaf04d61bdf6c7c6edc61ed76f512c3a35a1000000000e80000000020000200000003cb8ba33a736eb7dd5fc12d0e30152626b4671373d61126610238c498c090c4590000000a1882d84003376aaa913f4b67fb7befaf7233c8f08481a54c3e5f7261bd44b29b5dcb692c9fc1272a6509e1b88f1ce5c728db6e04359464f722a45724a3ca37f76e238a906dc85fd25b9e01b49ab4a4ec1c66d96d81417a8ce95bd595c0c7d9f9f32904265ead6653544cf0976398c23462ea12780e7d455941f49d88c078f5343d75e7ccf30706b0636642f58df432c4000000048029fc41b5c4fde356f1313c3395d5bcc2038652c8d28b138dc60d3a28a67ed328735663e5577941957128db763ccc59f080cd78c43b0f5e6573e8ce0724904	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409993312"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 3008	2612	iexplore.exe	28
PID 2612 wrote to memory of 3008	2612	iexplore.exe	28
PID 2612 wrote to memory of 3008	2612	iexplore.exe	28
PID 2612 wrote to memory of 3008	2612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35e6c24682d878614ef9c5bed06153ae.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0042c19b48210267cd8d9ec7f02be1bb

SHA1
428a25f34e5d856feee0a4175281f3db86752a2f

SHA256
6b6cde540b3cd133464408ef9fbb220f941fc35adf69d8e810158a0d32118b55

SHA512
b770f2ee7fdabef680cba84c952635805704f2822d8abd9bfca43cd269378dd3cddb7dd923b91fb4df4ee4a9dc6bf8041357e505de079920c8d4be38ff3d4e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be83e5414519631f52aa73f5a07287e

SHA1
224e120af8fb23336ddb423094c2be15c659d602

SHA256
3dbd98b35648db4f356ecf35849f6a5e8076849810ec640e51e59899b7c0f85f

SHA512
94346ec2b33af9c9dff979d28649128fc57d488fd15096d43755b5370998190ff0de1d6c117089da36e57541cea7c95ebf1ea399c2478540ff9d1cebc1b316f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dcaef967dd1502804593a093b73a42b

SHA1
850bcdbcf8d513a6846d9ebacb9fe8d130c2f770

SHA256
c86cd8fe25d0acd1dd93fd641745ea48b3e752ae5430b5a0e69a6c738f4a2971

SHA512
bddeb30da6c4426201d571700eb407819c7154f071e5ce211270d9265b95d4137bab0b60ca73cce20e5478d93b07ba52b862bc5e35afa2d61b6c65cba6127cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8a2fe1ab143e18c47f72992ef0bf2fa

SHA1
0b4e131c31084c3cb3f4d8e24cd427b937e5bde2

SHA256
ddf4e5ca7b6a97e06d2520bd8bc7ea92ad931c186441639ad6e18865cfa19de5

SHA512
68e61c7ce0f1862374513b99107724206cfda38d35894c599b8bf35f799ee0591f81703b9ec40a98f439a8c2046162a24d8f422038c8ad391315ea3e561a1495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e4eb2deeb2df60615ab344be4e5cbb

SHA1
e35bb5646ad0678c020bf1d34b10c4dfe4227b29

SHA256
f1c61a7be7abab4bf0a3e70e534bd61565035204bbd899431d2f135b6f67ac40

SHA512
ab5726d2ac095ac384bbd44b0f31155696f7e5846f4d32e960085619c58ee67e821fda6266a10f3f0c92f182723ecbdafb56b72bd5915c4faf1432be2d954748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fef422b2101ac8fac8772d1575495c4e

SHA1
d65e589f22e341b02da351f4941781694af8419b

SHA256
8646d6ccb28da70d3ebe69a7e12fb85cebedc3d1650c8b416729b0c60a8e6067

SHA512
6527251ac403de37308ec7a9593a6c952da664f7cedd39cbcfe516018c9ee44f4e4946b0b71728f6048e23cd764e33427e5dc19452fb0350ea1a540d0f78e530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af2c66c54ac2ef32db92a73235bb5a4

SHA1
551fe7d377534c63edc6da086c5c53de8b47d8c7

SHA256
9c2d2fc9e772a4152bd301a41a051c4f39f7280a653dd01a954ebf45f369dd4c

SHA512
6520b80af711fec1f356b8b9475fb3e0122035defe7a0ea0f74f676802b16a0c92a7bad345efce499a491214282b5dbd398785589816d0f7fc8fc7eead93cd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eed36592dc1be95482d9f601aecee8b0

SHA1
b9bde5d69a0b58c8d543afef0d743538a6135977

SHA256
182b5f15408046e2a83ec98624523c87d7e3380476e1ceea49da532e13cfe991

SHA512
83a10d0396826fb17c742b28b75f4172bcbd5597ec1c6f904c6f24bbc425c5d1b8dd5f27055fee3bdd60f276072e97339ddf88c96e306eaed3c5334b606dd0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3530e9619ddb97a4766c615d94d8bf

SHA1
c48b717073eaa565ff886b7bfe01290ec86597c1

SHA256
b590d77f1cbb5e80e74ef124adfba5f60a1fbcde6cb26be0bd313b4c41a54b81

SHA512
b53f6a068488fca8e26f056abdba1aa2755d4bce9904b54fce33b027499351a41e7a199f66995c55b8db760b1a65a2540ab869f5328e3beb291ecb140ef45701

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4C9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4CA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit