975fa545af4da1efd27e61ed529e1cb330f34be0d2dedea1b8fde4a64998cf2b

Analysis

max time kernel
67s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a2efc2562f6314139ae7a6c398997e0.html
Size

60KB
MD5

3a2efc2562f6314139ae7a6c398997e0
SHA1

ecb1bb841e2ce2257f3b79b80636c0b0975fcb4c
SHA256

975fa545af4da1efd27e61ed529e1cb330f34be0d2dedea1b8fde4a64998cf2b
SHA512

3aaf2db544ab84112352a90c5286bfad661d140eb37f2f1f347ca27232a8d34793bcea5ef0117fcf8e1a1285b8dfbdfbd755005759c21a049d0b7e5e39182ebb
SSDEEP

768:1aq1woZw05aWsKaOmCBVZuUv+uLVsHotE3AGU579OrYJCthuEaUbtk65spXubv2D:Jnw9OL3Zu0+uLVsItEQGUp0kYuEoXo2D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{877D8691-A422-11EE-A3D4-6E556AB52A45} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2036	2224	iexplore.exe	28
PID 2224 wrote to memory of 2036	2224	iexplore.exe	28
PID 2224 wrote to memory of 2036	2224	iexplore.exe	28
PID 2224 wrote to memory of 2036	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a2efc2562f6314139ae7a6c398997e0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7C

Filesize
1KB

MD5
bd7dc3608548274f62534dc0999b824e

SHA1
e586b4c3afd183231c3f97f28c8a3bfff0b0e040

SHA256
edd63d8bebc852393954f904bd47245af6320eecb82ada54b0b5e4137ac093d0

SHA512
7a39d98ce9fa6ca6d8d1b0ddf2352694c8cb2569adf66ddfb749bf798ffce6070f342551828a5c29427d95cd9f3c991bda8c875bc24f181f5aee5442eb617b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fcaa9a065bef651bd1641b9af425120

SHA1
ed32063d82ae6fb37924e7010bd6a96e717462a6

SHA256
3d136eb62e3e6420888657d20d49e6a6d7c91ab42a2b7b5c420b4155c3ef6c7b

SHA512
c24e3b43914ed7dd5b0f6a0aabd15bddb97b8e4283cfafb4632a1b74675603c83579a7bbb3dd89588d7660c2101a2bc5722f5526ccd0133ef06dc36e20946409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd12b800ad88f6acda8ec8a077eac562

SHA1
d3210ece9e4797d1742cc9549af2515b8eec0c9e

SHA256
260f5650cac650ad418e52c75e2ffc2a7565b73334fdb6b407fbaa4c44ec391a

SHA512
4a997d3a24af8399e6c81b216f14cd3dda86fcf025d3484f2f7b22f93a57078e4f7e80c15cd31fb45dfd6329540939d284cd628c4e4ff0cf5817f7b72ddbe1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd9b969e5e3b9141e042c9f1ee8c2bd3

SHA1
1691c8f3eef053f12bb4fadb4ed90db070836fb7

SHA256
51b654c212b7fac7ff2863f13ce7bd70ebdfac246da409e08a18d719930c50f3

SHA512
dd29101065d165892ae48e04db76a229a85cf49a2af2000ba92d51475e59dd5db33baa36eb0929949de26f784ae84b0d7a6f0a4e13dfeca88438e119b6712786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6af7dc70f8a80d6385338afe0629cba4

SHA1
102c432440c2f948679abc0b2627c03a9c7ca7ee

SHA256
d13e8643e75d475c8d63528660b263b36165f8ebf2f651e1afd6f59704ce024c

SHA512
6b94ed58ec5f73a3cc1316c09b3818e94873392a5a9b1f9356c6c7715d08237edf726007dcbd5d8d50696d41388b2d1238805d949718753bee5e9846975f9978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
865961f095f7db5a5a2ccf419ddecb32

SHA1
24bf9c2cdb01e82ecc50a3301e02d8cce0536215

SHA256
44fda23f6668f3ed6ed66f33f986f6a8937502ccf0969b03ba5cebed611a4afc

SHA512
6d42d9ff8951a88660727cc3753267d8c27994b98844a42b022342a94399b2339d99c58782a28adfbbf2a092637db21a01edcb152a79ee3d557d5bfb3b46a875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\96722256[1].htm

Filesize
178B

MD5
cd2e0e43980a00fb6a2742d3afd803b8

SHA1
81ffbd1712afe8cdf138b570c0fc9934742c33c1

SHA256
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

SHA512
0344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar123C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit