7454ad5b9362e29b700d1e81f975c3d1f5618c91b353f17ef27a1bc95bf76386

Analysis

max time kernel
119s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

51ef74c9c96cca28bc6fc14180926883.html
Size

3KB
MD5

51ef74c9c96cca28bc6fc14180926883
SHA1

b7ebd68e5f394df477a199a0f039b96bc0895c9d
SHA256

7454ad5b9362e29b700d1e81f975c3d1f5618c91b353f17ef27a1bc95bf76386
SHA512

562aaa6d317f10b1620d32476022f9ca8b05c76f8642fa030964bc28092ede1be8b7c3d1f6b9c6b61582615abc505f459dc19714f277f0bf5340a2ba2edf6556

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000022331a0411de1cb761c4f7edd3169a92277518c4ee49be2e7e1142b9a8f8ffba000000000e80000000020000200000009618d26f115fd76eaaebcf5ba73aa2b8688cfc03df9afef1ae5f934399ca693e200000005411df0071ac73d577a661aebea5510661e6f40eb7b8a5739657de7420218d4d40000000fbacb1ddb8e71dd365dda1193c472f7a6da8d93e03ad5ad009bc6fa80729ff6c0a32efec33e865c8099079bf29acfb777984397f38c41e067a96b2146d769c11	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005a45559238da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409822234"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000417844dbf2cebd73f31fb8188a8363dae6b9f3e4b27d35aa5eb28416b8ab17a9000000000e8000000002000020000000d7a1c1f19f1358a515124fe69fce433024df75fdeb6948f878559cf86fc3ff4c9000000065988c8419d425ef28fdc632da245849b665865c0e692946bce6b18d4fa4f449708fca7e094e27e7c759c1214e8cb4991da8ab9d631a1c61a6f8ecec4e6feb682a71744f99337742920570d28b07b82d6b8168929e7423c2a87ede8c003deaa229fcea3241c07533dfb6abfb4a22b7852e6ca4edc2c9f56316f2bc7381df41e92803ad7f37e511e433dcacd42d016fcf40000000e72efe1243c0579825b1a3829c0c78ae3e683239205a377f7a1b024aea087e637c42c792308062f8892f23fbb8e50d59cc73c039cf9eed80af071182ac7eabcd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{702F0781-A485-11EE-8073-42DF7B237CB2} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2468	2224	iexplore.exe	28
PID 2224 wrote to memory of 2468	2224	iexplore.exe	28
PID 2224 wrote to memory of 2468	2224	iexplore.exe	28
PID 2224 wrote to memory of 2468	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\51ef74c9c96cca28bc6fc14180926883.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab068860d2152581c7a6fc64ebf85b95

SHA1
e7b98e827143f3e988a60fc7f3ea9d8ca75f38c3

SHA256
097e433b1c6b1b0ecab6dfb587ba61df31a61d058dae88c447433c88237127ac

SHA512
893cbcd829333fc5c3b3814a484ff032f5502c609e7892ab35f7f242022c4cbbb9fec82b0e9f7b0e7d864db04d850b82af1b4bf2d386d10dad87785a89884341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e0d4f4744b502be43ceb8a697bf18d

SHA1
b87d5e9564ee66a8540391672b74e2f6408cc784

SHA256
200d141db55b2cbd6b7ba5059ca452b41b162c0e23d0038c96b2700117d690cf

SHA512
619bbbc4bb77c8485c4470f6a7002502fdfdba45f50d2b39d504609ee78ab7c6c1c37336e88d9f8d22dbc40059cbe7963e09101fbcb1ac94c59e05ba391f5c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d63376ceaf27b99b5a52b89901c2b6c

SHA1
e88ce195729924ea5805ec4da7d6f46f54791887

SHA256
e5e57871d7dfd86717d2bd50f5186b763ce9871c562e4747e2d27a060f341b4e

SHA512
c314faba234f74dae5714c220f684b106068404ed894f44165517c8edf10c3deedf1c0b073da522248407489a810b1b506ef883138b739443619c047f38be0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec7a9f7312d947e898ca85628d26f96

SHA1
627a529fae2eb6d51e6bcf394b5a30d4923a962b

SHA256
6ee1c86e40bae7a08e69f13ab4b7545e7261955554083b1a006513ae1b58a19c

SHA512
e5e39818650183a044bf53c1204e6d07cf2592d6da787a01b6d522320fe06b60443b1d76ce10e3ca859e596d8f8f92e56d4f9de3c1e739b9445944bdb500f97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80fe18f017db4761e2a4db574b150668

SHA1
568ed7fc0e552f5d905787c059aa979f4d609f7b

SHA256
463c3d48596ec7c7ae70cf8f9527f4b3109d5f097dba7778fb705c4f04d0a7f6

SHA512
2daa49822079cbd473b7e604995c52535c6d5e2f88e391874e530d14ac63e7fbeefc9e905608dba374a1ac0e8a7834e5923b3a8d43577b62b04dedec77ec2c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa1ca3a402b4102352913ff3602c7e8b

SHA1
6f61421f85228df683db0d34de03b47b4cd30b46

SHA256
202091ccd50ba274bd6dee642fe45fd143d8fce54652294f8f545355c5ede7d9

SHA512
1be9587534798e956bc46266ab4b97314f1daa5b0d66b617035fd51f39c93d33597d9b9a0f38d041cda8862ab67122cfec16d8d154aa86ad07f7a2749c342a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar382.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit