e4e1d6166eb226c4f10307237151565b37f315351e5cddb0d3d774423e4bfe2c

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3681c3cdd1d9f73393da8fc709d043e9.html
Size

17KB
MD5

3681c3cdd1d9f73393da8fc709d043e9
SHA1

c86f353e28b9c3d79e5a7fd468429d17652d2752
SHA256

e4e1d6166eb226c4f10307237151565b37f315351e5cddb0d3d774423e4bfe2c
SHA512

bac522493506e4df82dbf9d521c7af37c72f3f97cd96ae605f6ea5129a0f5fb6bafe4135807eb57ea4bef9ae38910a9c991c36474dcbd159a2deaf472e0d3727
SSDEEP

384:sTlIci9DJnlx8PmPuP+PmP2PWPSPiPSnLPEPEP2PePQPiPuPGPSPePiPiPWP+PON:3n0gh6xLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9835DEF1-A617-11EE-B0F5-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409994950"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2200	1924	iexplore.exe	28
PID 1924 wrote to memory of 2200	1924	iexplore.exe	28
PID 1924 wrote to memory of 2200	1924	iexplore.exe	28
PID 1924 wrote to memory of 2200	1924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3681c3cdd1d9f73393da8fc709d043e9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68141bf4e47b2d69ea5005b8ff16b65e

SHA1
d6a785bf2848e4906747213785d052ea22d1178d

SHA256
9a9e4875e5e0237f693681d1e978011482603564aa1e3124778d7506eb3b18d8

SHA512
eeb52c5d06e0419aef71a6c34c2ac1357ec64efd100f4be46450fd62d867ee4ec1184a7f7bd9e963ee77fc4b77af4e44c51e80428f3245a3f5afac804b8af52f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4903808fe0bd02278b935d4265dd377

SHA1
d2db034bc62862da7689f3bc4401afe6f186d215

SHA256
5fb00ef56aeb6ec9089379fdc5ac70d2f11be8118fbcda7ef2c186aabee9cb5b

SHA512
178bf856a1e1be17930fb5a0f119b35106c8aa90a59ab8ff88c45e628587c41ce9eb517783ec01b31c59541feb226064e5367856f77f94a411feb514e06cb643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72a5b1a10ad36bc748c4ad53d5b2ced0

SHA1
5cf367f80df9bd60182f1363b40e7c5a00f383ec

SHA256
c5125d88992d0a09f88014140f9ea5c3ca43f18880cf2382d03910465d821396

SHA512
952758b93fa2ed7b0031575759e32716efa7bdb3a8e40f24b618803c63fed4172dc64e9b732cbb93b9d9e9f59da8a242694a142c6dd87a7184d86e2766f0eb41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e56222f8c1714b326376a4aac29f40a

SHA1
ec79ed1e3dd7a54f5cd1d82df254cd0138001196

SHA256
8cd4b5379704031e65af37519932c2b6285b2b158d0cf25e838c9c06b7965a72

SHA512
f5263ccd389698b7006bfa978c32d22ff0aabfa886a5ff42c9ea31ef15976bb3c0ce4b1b13e2bc9d302922449bad54ec2bb599b28002161766b1d3147513604c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37cbc71dc7cbb972b5bc46e869b8e04a

SHA1
14fd6ee5b6c33a1a259a9cd851f5f89487904ca2

SHA256
1ab4fcffa623e504a3cee11fb29fefb84d7a09fea74abea6335471fff17fdf78

SHA512
977e9c6de21c1ea4316f9e02447b68965fe220170bf76fc2ad95876e02d1cc4cde9d911936f1e9a89adccab41e9a72c88dc9c73424cf8887ac1ae07a765b30ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e20beb15476f92de0d1ed1ff1be18d7

SHA1
e319ef3178d5eee75eca9debf23d111ca14f46d1

SHA256
ec95aa45ee6930daa553f54eaa0c8d883a526561a098995322039003186b8d16

SHA512
86abe51cefb3fd19ed0c6cff9a59a2f30aada46f0c19412658876fc68b4ba7260fd08f97392c9096824c1eb9287c04da5930c99e58bc253f7d44165b69227ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3914ee4dc1b25e01777a8e12629d5ce0

SHA1
c4c3d4faefb2a622ac88431dfcea75fec623f387

SHA256
8a1dd44df47d85ac8a3e69014bab9349e81c1c27159f744e9a9bae0e86dd4d8a

SHA512
0af10aa8d556bf4ff09e9a898c02e4544d3158fb6f3b07d39c8e6117414f30a5dd3be14a1cba3c3b835fca72fdb72d995df630f68b983da0402bd8d71dae980b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9e2858ab6225177139b0a2a3215825d

SHA1
7c3c5a3919487920ef527613b407e31658cf40d1

SHA256
ee63d1abfa4cabd42ba4ef315137216bfd11d521da7349f701e82b47c3983601

SHA512
c23e17c65fbf3d7ff1d38d57799bc14502bd8d10b107078a80c01c56eec87054898181d7f01e1e7a4085d514d3aa807418dcde3b1b6c0dc3eee7559679900dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C3A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CC9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit