dc819723c76e4858d740f4f8370b7c3b282ae75492b0274e5f9d8dc7359ca839

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53de169e4d119fdabf18d03a780384af.html
Size

7KB
MD5

53de169e4d119fdabf18d03a780384af
SHA1

b08d21d1f371d9175ed7657c8a836320efaa1c56
SHA256

dc819723c76e4858d740f4f8370b7c3b282ae75492b0274e5f9d8dc7359ca839
SHA512

44d9520d2a238bb80d1994cef5728ab1d114d5d8bd484e5bdba4252a15f236c6355917a7c9a98be76b62e2b001604a80663a203fe5258ec342406b70e76f0c9d
SSDEEP

96:uzVs+ux7bKlLLY1k9o84d12ef7CSTUqzMcEZ7ru7f:csz7WlAYS/Eb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409825151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000cc9ff5d81fac4e673e3d9f3d8c9e4b0d5f9bfc2685514a6aec4f27770b3ccf85000000000e80000000020000200000003c8a498eb3423fe26aa1f8ea500ca7b5eebfe1acabad88fb24af3a715f45e9a720000000dc2525de87e3683b6a14c962c20455cbff7218b804e2d208ee2b54678bc3521640000000dc35bf1d79d74158192c99195f5365f05806e5deb330aa7436e4fdbb9b4ce860fc59346151117e862addd69e7a8aea170e13f5a2e6b6c52a2f79b43cc9e104e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35BC9481-A48C-11EE-B0BF-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ae4dca9eb27b0079f1ff89403297c551b46bab115fbc32f2a0f3f43c77d06702000000000e8000000002000020000000f4f5a02d3e321d827043d347cba1ce70135fdf50e032f04dbe09372404438647900000004550e10e7acdc4d84c19e0c5d92ff2819a9330a633fd67b0040a55edf09c8688b0d9f4d48c8034a41175ace7c62c3392064b1c931d28a5089e4bcfb23a4141f9ef144d2b84f27b2cb94ed02d82f1b5ba1e460cea00443e179f71c045711ca7e0b0803aae876f399a110333a4013f60bba9c417fe5a6a089225fe8155dfab7c0d4be63c39a3e5ef53f8ba75179b67cef340000000c5f84935f7f8771341eb9cb8a2416f897e660cb727f010c98d2f065e1c6f86b4453b8215a498898467b4a239bebe921e4fa28c6edd73d00a8ccc8b41b9d195fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0cb680b9938da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2716	2908	iexplore.exe	16
PID 2908 wrote to memory of 2716	2908	iexplore.exe	16
PID 2908 wrote to memory of 2716	2908	iexplore.exe	16
PID 2908 wrote to memory of 2716	2908	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53de169e4d119fdabf18d03a780384af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a4cf77664a66613aca3f2fa3bfa9f0

SHA1
99fbd20a509cd2d64eae8d2f9b2226b7058a42b6

SHA256
c534f025bf6fa9f6232931457c92fd08f966e9b66436841921e6f9f037bc2716

SHA512
eae63145466b474c1c37488016571035fbd873db17527ea8ecf91c2094f551ae11c36dc2a8ee5b7a622ade915c34fad1fcd1c60a4d0a97efefc849bb6f8c3ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f06e6aae3c8b8f3a3589a672d66af478

SHA1
c8c5be8527283667494024b4d0223df79bb1a684

SHA256
36451917e1b2342307ffa4a2150520eee0175cf07155150ae43aa679827e57bf

SHA512
ca2d23afdc2183ae2c3c28d73cf40b27441678aba33a7fe502f8028b6f2db100929704e81edc1338a41ffe86f08ca7b21139a2fe28008185fab9474f4813f876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fafd52184f41f46bacee7b2fb50c242

SHA1
5d564a9d45adff8ce3dc197f8800a4a6cb5c33b5

SHA256
fc67cb8bf3cba0df968feaf72baa09d73a4c8de939c03c651b3a6743c0d84902

SHA512
5798ae7876b3fa62bc20ac6838a60e990613b6f1758d257c8fdc3a48b89badde4372d2b2952f3f3f59bf2da25683cc440d8ce321389f7a1d2d70478de6d43d83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aea56c9ce46a404c34d68c124223b52a

SHA1
38510e192ded76086b5316fbe4c8c2f92dd9e720

SHA256
07e47304096b6e2aae1922f2e1d7afb576819329b2ef51f1f636ed9e9d29f9bb

SHA512
b4519c7f3ed0da5d34873a833b6bc787d6a477a228ee443a3e74eee5fb62b48a72b4d8687a0ab651feb3b0253037a6838d93a0eb6efd67917ee91c0fcfde422c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83373ed8cdb30cf3747b1db41ef37a99

SHA1
0d0e57805bc2e69250ad57648d51abfcc21e2af0

SHA256
88ab544f7cded2310f13bd76d20038ad7723654ec2417dcb3ad319c964314209

SHA512
627a8a44143cfeb669dfeae6e6bd7455c7a445e21188f4f94e5f27d926079842ea9b2b568104a2a1afd038256b6c593d8cfbee8c9748c6c73edb5cc502a2166f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0725222463a47441df34d2e676b4d41d

SHA1
dea8ac0105f1c811f78c11a928427fdd07ad804b

SHA256
963a4f142c14da8bab612dc219eeb7b2d3bf0ddeed818153d6d9211e134b7991

SHA512
3872f5ecdac761bbe33beac65f96ba918539a8f7d05f669135d7aa2f913c39969f15a8f9137d7869af93d049e71758e17d7ca1bc37f726773ec35d957a36371a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5948.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6963.tmp

Filesize
93KB

MD5
5b1ed52915bc0c45334e6cee90279c78

SHA1
575cdcbf9011a58be5a21e63635d97707b52a48e

SHA256
6b8ed7fa04931250481c248f33619bd5f218dd193f6ac1a6457dc3c918568b18

SHA512
315a898c7f842c4086b85ec1cfeda775728ad35c6085ddfdde84f1654385d5b7c659566330e2c9af45583dc51a3da9a8b3b539595e4c1654bf2d42c2280fb613

Download Submit