dd0afd75a0a432e5c46561f5cf456503119c6d8ac20864cf62442cd13e0a3f2f

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f1b410a7b9fcb0701e140e8e79869bd.html
Size

57KB
MD5

4f1b410a7b9fcb0701e140e8e79869bd
SHA1

7a3da372ad7e447694e4008f93c256c9a471e496
SHA256

dd0afd75a0a432e5c46561f5cf456503119c6d8ac20864cf62442cd13e0a3f2f
SHA512

2c6b3eb221570e59f0ae568e1e0e3e54e6984e5bd5830d2248b303a1dfeaf3295c65f4e763b5da41330f70edc35544e035fafac91ca33d1b33de9187a954daa1
SSDEEP

1536:gQZBCCOdC0IxCoD7KfAfHfGf7fVfOfbfFf3fMfkf8fffDf/fAf9fXfjflf9fnfNi:gk2E0IxwI/OjtWT9fE8k3r34VfbNVvli

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ae96ede94ad3ff16483c2b22d6159c0b01daef1ac6bfaf840e19e27289a79874000000000e80000000020000200000001113ff8f9ed62f995cf57c4b3311aad3d6b0b736df67d5a6aa954f6817719a1e20000000c31442f3e6811cf1940289089be542955600607fd87562235474e51c39a2eb3640000000bc8ec876284949943b4e397d00f99efa7c35015eb262a777bb69d55e0f93beb71bb2a39f0884805dbf1efeeb87aaad9b0cc4cf655f7a5a34a258e457391901c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F1D6B11-A47A-11EE-B36A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7082b0208738da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000297be77010132823ca78261983346b95fbc60e8a56e8c39329924e24558b7dfd000000000e800000000200002000000011a64d9fa84f08dabc7f5486795b3389ec91c1fe2d7de7400441a87ade7295ed90000000bf989626f31edbabba9a444da5cd74cf17c576a5969675aa555b6ae8e407f3cb70c38a8b9ef75f5857eebaf2ccb9b6be1a6fe39b9eef574eb7c239477997715477c840bb88a8be6ea51e8720b647bd15b57b24601f795e612a17410cc79a23f3ea9c62e46fe7a2c63f847775d13d7d64eaca90e870affb756b4e1065629c279902644efd558b9e275c1d49d96f31e2d440000000ba3c59b17ef330ec49cb64141937fdd000f4ef1502b3c1aabdcda039815ef6e61ca4258892e74ae6060581fe0e865b5b11ea46b7e1da534382ede413ae8e321a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409817446"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1072	iexplore.exe
1072	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2640	1072	iexplore.exe	28
PID 1072 wrote to memory of 2640	1072	iexplore.exe	28
PID 1072 wrote to memory of 2640	1072	iexplore.exe	28
PID 1072 wrote to memory of 2640	1072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f1b410a7b9fcb0701e140e8e79869bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a283de188fdfd0af13d227455dec7226

SHA1
baa74886cd5550d9d4fab8117b272ac8c5ba881c

SHA256
6fd68f43e7a339b19405ef9e71cd95493245f89f353f43e0297bd4ae221e0b8a

SHA512
a00d09dcbf6ccdf44ce796592172f4930776171d6d348e371e9c9930b168b3b124e8839f79a73a7729045639917288b3ce1b0a6eac76586752d7a2b5563707cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41153573bc5e88a123072895a5592c0a

SHA1
a02b221b8dcba6939943822c34183474aca9d9cf

SHA256
74e6344a8a9f77eb5725d9346944dfb18e8e79b35e19849c6a31bba0d1f71a04

SHA512
818cd649bacef56e43f2d4eb8997b331ee2eb8f49f405e75f958ae19b77c521ebba786406fde5649d077959e879bfc36204db38b642a6efcb6960a0e6653f1f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09d0ec3c5e16c56370d6c8ad41ba56e2

SHA1
af328883386a4242512f1c79d0e004574e8f5036

SHA256
0fd64fd137bed20bb7df1af9ca07d708a1b73fd90d3ced1f778c3beeda6dae64

SHA512
ee8330e0927743524a983bd6167e509824c6271f6027e91234d12ea9930d8d17d4adf1f4da85ec907572e6f0ac517f061ac9c2b642902033d3fc4c328f2c0043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
615b8b6dbc7f5178cffd8ca5ac04ba43

SHA1
1478f2ee8fac3dd8e1be16c6cd82e9305e3d042a

SHA256
308fc75644b9f87c9b407ace6836fd7e15b9328802840427d7bde6eb5ae97dae

SHA512
9d2f03ebaa5b80cc30125d7a3591ca5386a00568d84be78ad409d2f464fee044eec901e80842dfd0e5585cf1f749482f2138e8f35cd12d57ad7635ba8bd8fc58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc8841686c3a3793d230b3953ae27730

SHA1
77531bc5df50ef9c4ae5a15c458a582228534407

SHA256
f5beb415352ef1c2e538e5dd3802964e905ed72696a4db5eae82743dc9535325

SHA512
4653446921fe18a71d543bda2fa3b20aa127a9bce76cf640dcd152b2e27eb63497869cd1d8fab4bd38811629836ca7d7957fd919c121b13cf4a806c2f56b694e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4DF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E25.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit