774f562801ca870022ff1f01a16ca60ea1a649df16843ab21ab4050a173bcfb6

Analysis

max time kernel
143s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

56381f500628f815d72cbd3c188db7a3.html
Size

4KB
MD5

56381f500628f815d72cbd3c188db7a3
SHA1

131fd445bc1004dcad952030c1bcbfc8a4b90a69
SHA256

774f562801ca870022ff1f01a16ca60ea1a649df16843ab21ab4050a173bcfb6
SHA512

13ec54df5e6fdb49e999a09562a5c6493dab57f2fdbcbaa07018644ac1ae3b4abc6385f6704e4fb617cc7b02f1b6394615595ef30d3eb7303915daf597a38588
SSDEEP

96:1WKLSQkTtY8IolkPTrcWNwuwmz2P8j5B6gNDn1y2Rtz6:bLSD2rrHGQ2UFxryKz6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701e5759a238da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f87b7a0811f990ef040e7fece1c336b6d40484f8fa99554fa59029b13bd68325000000000e8000000002000020000000d872f78bbb025f77a1c32ce11382b134403b0fee45bdbff2bb6fc254a35ab3ad90000000687cd4e6ec4a542eb32b25efbb33f71950332c490a60dbbfe5648b316502800b836dbe142a158afab3a3c9dfacd1755a7adbb8fbedaa9cb465e116af20a446dadaf11a63d922f2142a94007858ed2ca2e3b85638d91514e784361a63785c614014324d1a1e62677655ea4fee57da7e226071c7712772c018dea782354326f2b42db9b39dabe75cc23f5c1d28b0efc60440000000059a01ae095f3aac9c6904a2eae0a2cf485187c575011da63b041a716afdce0608d54098fe86c12a0ae13b6651707a02ad88ba058ec16d1a8a500b900e29b10c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84504ED1-A495-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c77d4118bfd9d891b693d37ff37cd1bdc85a67be1fae75da179214fb1239639f000000000e800000000200002000000013532228a667457714ba6226f09c127a8c4a1d4fe28f4bbb4c991f902ef2d62120000000e21d5c74729da75d4846a1fc88f5919e7db020f030a44dcb8f6e6c8c4dbcee554000000077133e76f51d7d850257a4d81488f0ba3f5775049425cd11d1015eee0cfc52cac1b6d695592263b441f78191184a572d1e3ada28b176cb646fe26d13482ec8b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409829133"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1768	2088	iexplore.exe	28
PID 2088 wrote to memory of 1768	2088	iexplore.exe	28
PID 2088 wrote to memory of 1768	2088	iexplore.exe	28
PID 2088 wrote to memory of 1768	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\56381f500628f815d72cbd3c188db7a3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5438b88bcb7b84225cf7b52da588415

SHA1
6a76e13f06dda90cc2f2c1cc760b41244979204a

SHA256
01463c0dfcee6bd3a42267c1ecd6db8a04c66922946eed4e8571948daeb12263

SHA512
47161242b4c076faf46150804c53bc75561a1029abcc9581e48708c4ed5c3934b7b22c0e565ccfc470efa2561e43bae76a8b8d0f477212b94071158969ad63f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d742388f37d995af64fbf8d58504d61f

SHA1
22e6711df4c7c270fbe3a379a63c16682321f4f4

SHA256
9decdff3f93efd4a6a6869f40d73cb2b0a79f89a0542c9b0026c1a4f9f32e118

SHA512
fe0c299a736040071a12b675da1be20b311cc607eb93c33577881528409828675ecf95c6838a8d92e930eec1eab450b0e93961204a43ab5617fbb6c1bd1ab2a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e21d8bd5b26556dcfa30dc9ed792006

SHA1
597ebace471d86044db7b274efbb749c069094b4

SHA256
1ffa455883b5a197d78f15063d387d12fc857508726774c9234789253eff7122

SHA512
6a0445c618090a03c34445c31c7cb608b1d3dcca07009ec5683aa481b4f2575a288afb49b5400dab89afc3588bde826851c79b97ce053cd1575633c319712399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
def728e67673c31a32153358c06706a1

SHA1
b32b799e6c15751ff4c3735300d804f9827a93c7

SHA256
393a61fc8cc986085cd9739c196b35e8965bba5a36fec572260d59f342281c77

SHA512
e6defc55bbeb3090407ba28d31bb4f21279a56e4c0f076939f221790fe931eae05faacc0f60de76c848b660f1fdbfafb277ea501fa9b73c7e79e300609fdf629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e25eb00269b0c57ac18d49eb67912d

SHA1
4dd42c6d2836ca8d261bf8d7ee1c20eed78ecad8

SHA256
e4a0bfa333b1d7505d55ec29a35e09f40c2fb9f5cb676169b9dd3da99d39c93a

SHA512
4f5edcb2d0807ead742f7154a33b2d4e57dc79119b548916b772ef7c5645e83148c406618436025a140be1f17b611220e3a4653cc4c035f0bf68dcf9e4541440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce1b4cbc1a70d499466eb75a50835cd

SHA1
affe3f22047d27bb078f60e19d401c30986008ee

SHA256
688914d8463ce271eab1119f81f9ac653e3e378a7cfaa07d1cda397834791ff4

SHA512
1b553c135062b75e4877c5bc6049e77e46c4622e0b9a950f5e1b76c9935b8a95d10b8e02fcd36994c28da0b687ce6ac4c5d8fb2657e3eef799c4769f7847178b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f12b62bba568cf1b7558b3d097158d

SHA1
d4d00edc4b003d91afa0eebe21883fe633010b7c

SHA256
05162a6aa0d98928e7e89ed74b7de08865233bac0404a1905d7d3a06e8c5928c

SHA512
7021c753e6490b7e19ad731b443667bf5403130da8fe3b6043da9ac016b735b1419ce92af14e95e56f0f4cf6cae529cb760736434244d3afc07e0736e374d0c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f4d299992c1430f2dfed58f5cccd9b2

SHA1
faf041dc1e63d8af6a0efdcf6f99337c1e1fcea9

SHA256
e7af3d76084c72051b1b975515671110be556d7f97fb2f7776a8be204dbcc8b3

SHA512
211f685c7d95cf2f6f88c3429b6dcb2f4dc51bb4c8897f7e32f52dbce5b44564e5101488499dbb0cfe7bc3b82eab918ec35859144b0a22423ecc8443bcdb621c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7afba50700563c41cc76d1dc46dc3ef

SHA1
8ce28fac1656619081f1a648ae25d32a344abac1

SHA256
5a8d5579b16a81782de296a89db8a57a9e5b07e074b91425974566f28a95c2c3

SHA512
bf55c9bd871b368a639353628c820767ae73728ad70dc743e56e0bea6cbb2ccd9d253f51b0c2456d709da29f01afbcb521170c23d9092068d96b5a703fb75ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8dae806501ac74345e82f51436f096d

SHA1
7fbdbf32895f016db55108eed5fec7b6f21aa163

SHA256
0f6155e40feb90cecb8f53614fc406c3a45438d0ba0fe8b19285f20759a692a8

SHA512
8514688fb5fed13aa56b8c4ccd70ccbfdebb9c166102fc71b7e03f67c32607ea16c57db4fc0cc093f4b83ffd557813b69d90b6901a474534aea2fc1b1754a1a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2ee055b00633696523f7955b79710d

SHA1
3799f8765d9108b6dd45c6e2c70caab560973d97

SHA256
c4687533b42d6243295883eb63677969c3dfe1158db9e6e6814d1e6b7755c669

SHA512
f15eef0da4aab6d3e895fcbd5a1615c9153ac828ff45c0188f5d3cb5a38f43186a5da9842b9f91b5d0378ac499aaba8c6eac19c556d9c48a8aac48ba5d5aabe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabABCC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC1D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit