dd0fa8a12e20c7d748aceb86e5e0f75bc8afd8508b0c0b24d8944d6180d74fce

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

563ba3e63d5041f65b5b9747c04c5daf.html
Size

6KB
MD5

563ba3e63d5041f65b5b9747c04c5daf
SHA1

864f0b35eb6f1f9698a718e3a89b3832a9a4ac8c
SHA256

dd0fa8a12e20c7d748aceb86e5e0f75bc8afd8508b0c0b24d8944d6180d74fce
SHA512

7d7fa33209abb7851afa3f6f29e0ede3d8b7f2f8cb7419f5f697aaa3b5155f95655b84f0a62b2b1e4949f19d33319fa9b35ba0b3aede9229aa1c8641a9f0e3fd
SSDEEP

96:uzVs+ux7lJLLY1k9o84d12ef7CSTU4ZcEZ7ru7f:csz7lJAYS//b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000aa83cfa151e92d6991dc075048034e1d8d19c9921b98a87ba36aab6e904a6ace000000000e8000000002000020000000f92651a31e66febbfc170bb40b6a188b4ba01c0374576ce21b54a9f3403d3412900000003d27d54ad15bac004c80f50f38aad5ec0d4bace00846be67edb781ab63afe85b5dfb8b31c0af3923b0108a60e7c387fa9daaf716b3930849ce894d2c81e053f88f396f61b0021d9d0d0db6697b728c835b262c770be97e34283047a3538e83cb7532890149928a2036fe924909993cb651ed9cbc1b5ba2bcd9253c58f49a14f5507111acb011239cd20e8ad1e4cfe78e400000007a0352afecaf52fcc182158be5bec848e6bfaf6a867936b3d44322f113c5c612eee9bfe617a7a35a7a913748af13bbd5e59609db3f646f86d0edf6855c937757	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08381a22740da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410656031"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000045051a1feee53b7dbda1503ae967ede848e306cbfbc747cb6184df15e375e1f5000000000e8000000002000020000000b16ea1e7aabb287e10729736937d30852b0a5d8838a2d5f172b65f8121638d58200000009e9a47a7b4f0354bd0c5686b07c99d186ec5a587612c827ae82624cd76835ac140000000d822165fb319ec0dfd6973904bcd01ca3a12f3db9e33c81365f0555387224f39d56c28adfdbd28d82ad087d5842fbfa253f17e4860af2eda2a6e9df2d4118f06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9692371-AC1A-11EE-AA09-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1372	iexplore.exe
1372	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3052	1372	iexplore.exe	16
PID 1372 wrote to memory of 3052	1372	iexplore.exe	16
PID 1372 wrote to memory of 3052	1372	iexplore.exe	16
PID 1372 wrote to memory of 3052	1372	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\563ba3e63d5041f65b5b9747c04c5daf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5440d97fa9d8e1582208decd95f80a6f

SHA1
069d7b9d60a04903718fa476c67b1c361d9daa17

SHA256
992557ebb49823048255ecd9581c0db9bd648ea80108811c283bc6ae91f5efbc

SHA512
46fc2bb07afafc96a6382662956c3bf86592aedbb224e09722a19caab9700c6b2a8f80993321e748f1cfe2dc31181a6dad4ae43d5be72c65c40c0257805d45ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583ef30e7f98be3f78849fda6500a8a9

SHA1
9889ecc705655198eef54de59ad8701de5896cc3

SHA256
8713b0dcdd3027f35a2a3f12817fc8d60f3c2902a6978218b8c173b51b4a57e9

SHA512
6e6b10147367fcec7879f05a5b605eb75e45d1b0003175d83e11d4aee849996dbe2d01b4001f5bfa87caf2e5972db55c8518dbfa7b318eb565280a5f6f316a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8d99762cda668fe978af808084cef1

SHA1
968c25352e857f71688b227fb75e749fe7bdf3f9

SHA256
d039eb9fe1b851d0720d1fe11eb857678f5d26e07a82622018fd808b5fdde49b

SHA512
27460a32fa8b0e21342990cbadd6410e72de1921a2f8ca643378cde53e61c525f952c5384a5264c91e8730c27fa27f063b09d443d600e307835a1cab7f8ddb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bd2abdb957fa4223940bd6ce67193a8

SHA1
7dcb39d81a881ec64af8f323c54b685ebd24f78a

SHA256
b16559a215e22f58eced5ded7c41af94208fb90349fce3e813154fb0c950a420

SHA512
141eb2c89b03f806522cf6f6ee53f1674ed29e8da1a08cf9a331d91a6fc19e58651820e3a0351acd7a70137e32df5fff8e1cbfe145cf34c19e82fc078e1813b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6851c13a7c37bfce0a41365b3f191321

SHA1
a590768d4503cf4124856c6757190e6550b8298d

SHA256
daac12e2a04f374d1ec2b8ecea1549f47d13b7df396bc5841ed3d18bf7a03175

SHA512
aaa36b81eff7bbfa90214ef4962b9cd9b26222805302204b71abc2a46f95bc501131ec85a175c44dfd30bcfc5318e796615c3b96ca3c3942e65de9bec3e79e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7af95a49c5c478c15766fe800064bb

SHA1
5807128eba2d46bb3318d82b0f86d1b6cb9a4490

SHA256
46bbdd4fc733d01cdafb2eedd8a9a4660685172c056ba6b0d8f4cf9e5573700d

SHA512
7a8748038ac7453d3434f4e05b7acdb98323e88d3cc444bbbc86dd4ed52f3367b0d0cbba18f59c9acfaf1e34ce458feb9f3c2542da21f6ada2215d9f8c4b4f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faeeb8251faa5c6eba9e086d3265f702

SHA1
e3f99232e10e22fdc41e509df86a2c1a9573610c

SHA256
d06d035585e4368f1ebeeea5497f2a8df3bead9432065f242851a16ded403695

SHA512
d90243ad3f73aaec4f1b3199f2864fd18dbeae9be7b620123c7a370ad9f9ae9581cc30fbcd11784ecf43d2a26a44e056a2d98038306391d111b9a897201191c7

Download Submit