a22ec3de90148ea72e39a2976bca8360e63d84407a69f03494c93bc337570c7a

Analysis

max time kernel
122s
max time network
167s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ed8f3bf940387b2a0ca2bf44c0f3dce.html
Size

225KB
MD5

4ed8f3bf940387b2a0ca2bf44c0f3dce
SHA1

f11c22a8559fcb6544ddbf9cc04215d00047f77a
SHA256

a22ec3de90148ea72e39a2976bca8360e63d84407a69f03494c93bc337570c7a
SHA512

cb2887ee06dda77af31e6aefd3e6f4cfe51273c80eb83cf2bcff0d276ce01ccf2b18aa0e861819bb95c4b274827d0a8a12b55f64e698fce68b07df2f5ecbe655
SSDEEP

3072:S+MBmyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:S+MBjsMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410376516"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8B5D661-A98F-11EE-87FB-DED0D00124D2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b6e134461820cffa40d2a0041545224462b597da376ca7ec029e46ab8b214227000000000e80000000020000200000004f5e212b0996181e8312eea4ac700632612d314be486908daf2447537d0d09802000000048d801a0e6dabc51da1f3ed218f4cfec3e2f4255b632a41d884a67e579c1172040000000dc231e97ae30c7f8e10e388501d58d7cfe40bce834c27c566ea7a90a15e081fbeabd5b5abbf56e2ff7de6fc47d43a3da7ce61e722e495df1de66b58fa9d88b4b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000393afcd8e98cc6e35bff358dcac30bf2b307505b8755b6eeae4e22359e77fd09000000000e8000000002000020000000741f1282c26b98a702f0cc3a41275c73fa9da8a1ab202cd0ead9d1dc26dca28990000000464e0061cb88486a1208bfa026cca82eaac00e7aab5027d568e96f989a58f23960bbcbd5616f746f39853b892248d943ddf7e21d059d62812cf97969c8bc01d0ce99905d1b945b0a54cfbf73b2db1900cc8d9488cc0e77166391994c1fc46597ddabade58dd4b3f5f1d01bd6a60e84540f82a66247ff8cfded74b5baede6bb01cdb49378ac46bedf12f54a428fbb4b7b4000000078093b48f0cdfb87e6e8912dbdaef344f7edd15c0023bc4fbe5486f06c8a45ebb9051445c73e054ae21da7425ed6647effd3b3ee3549d4083312ad231d00214a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4081f1cd9c3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
612	iexplore.exe
612	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 2676	612	iexplore.exe	28
PID 612 wrote to memory of 2676	612	iexplore.exe	28
PID 612 wrote to memory of 2676	612	iexplore.exe	28
PID 612 wrote to memory of 2676	612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ed8f3bf940387b2a0ca2bf44c0f3dce.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f98c35bdb04fe6d1ac29fb618323122f

SHA1
499b0f43c9d90971d4810fbcd5f372a23d98c490

SHA256
ea2f8d72dc27484d33c98b5062b4b851471047cfa8b309329578be22dd20e06e

SHA512
810ad83b8e0d462605a5c51abbebdd54cf8e85b964061716ef37ce340899d0e8dc9cab31ee46199bc31d168fb0f78474c104e16eabd5bb3f1504583c26d3b9bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b52b0f89ac843dac8f8d8c509c84f0e

SHA1
f0e2ef3a34767857c15b98cb56761f4d8ab1a1d8

SHA256
b4a09ce213fad6e7fe73a7677676bb83dedc8baa0ec30454d76d94bb1958082a

SHA512
195e5b311c30da8559d5c221913e9a19791b7668eb0890699405a002feaf3062051b366616390235c1149884da9ee4786be101ddea37aac2f60bde1b40ab3748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ccb496c3507302997e846196dbc33cc

SHA1
228c94bf471fd86fc467756bf6238b1142164d36

SHA256
bf9a5b7b9215ef2af9155aca8e8e133b79fb7dccb9c340a67e1de0675e767feb

SHA512
d262543ca4e14494d24735c2d3d5dfd3eadc8ae6e281879aa58cfa24437192dc2911141d1a74cb46efa0bf1fdd7c3177c41bf977b5b79620c0e4682b443f48f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4d7923f57472701ac5903f17e97f9f7

SHA1
20839d71f8ac29bff5cb5413e61133799433d808

SHA256
787ba4ac75cbbb1f804685c6c62895ff26a9835b2e1ce01fe92e21a3107270b5

SHA512
e40b6d9f6d5a4d6fc24b2de4229384de6a78902e7964cf3a1758347343bc2212cfc2358f3ee71a48df28269bb46a27755d80767c7687d3decfbd63fabd13f490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae229b607b65deb502e618520f2485e1

SHA1
561b161abc7b8f3c36bbcf8dec69665fe2cb9d35

SHA256
02f3d5aacfed1f7aadd2746699dabf0e1246f9784b99d89967782bd87ed0eddd

SHA512
aa28ac3fa7d7fd3309adfb6783f673594f0cddf05963836c9f672d7c7b6c29d7ac8bcb1301b74835365a29b22cee0e2ee8e395a3be975f90be85a051656183a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd82c729dda1b6e375fd9f1fe09b83e2

SHA1
0981fb1c7a7b31f60e21d51a298299355b7d13af

SHA256
acc000d89375a955bd6784afe9a74c48d479c4d06447fd0ec4e84ff57d71b476

SHA512
ff21b7f8074a8aa79988be5542e4a4b9bed12828d8f368b6327e52238a154557a95f6309357880b4e7421a3467b31075f0ba17bc8e0fe0e66044eadaee3240fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD75E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD935.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit