4b046d8b8877e6bc9cf03e760743a0b0253ae5117b89c378021d912153be901f

Analysis

max time kernel
8s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

57a585eb35e7ae146711c735fb7dd316.html
Size

4KB
MD5

57a585eb35e7ae146711c735fb7dd316
SHA1

34faeb43b70a7c9043aa36d2a14dc7d0217c265c
SHA256

4b046d8b8877e6bc9cf03e760743a0b0253ae5117b89c378021d912153be901f
SHA512

3b0ffaf78b333e6550bbc25fbda85275ba4525707d74c10b67c2549909894893d12a4931297b56bb7b5c6b14dd74e877c48034a00a9f115fcf96b9c4823692d9
SSDEEP

96:7Za7qzuS8fi6HydH8ylkcyd7RSCsJj4wH/8RS:tdaS86XdRlMdNSCK9HkRS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DE086A1-A49B-11EE-A5B7-EE2F313809B4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508e6be0a738da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002ca1719b6f4f869026e93c5d63efbaf9aa547345a51be422adb159e3c1e5346e000000000e8000000002000020000000a057e9cc89e33e8f6e0391a78d464eb355d1593a21306769289879c00762564090000000c8ab5969ead7244425828b2ee330d4bad6a7a26fd0527a0fbc979b9403de7ac1dcce3cae7757546b87f9991c5afc729f29f2bf6d339f774716629bcb2504d66cde98e78f50c4832914be523e09b31d97c63ff8685556e392d77819c143cb4d058b7c145f0499848f4764969975a9941f27d7f3a0a769d0162391cb17cab47d9914ce048dd07b546d2ff9f2f92cd18a55400000005fabd91f6ca521dbd83f5f69fb59c18db2edc77db6a091fd98660662bef3d2225956df3790b8d6a0bc905be2e2bd7bb24ef27d29c3f29c4fd21a3216daf8f203	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000000dfee485ccaa427c7464ef25b7294e989d43c184acabb7c60af0284afcd27d54000000000e8000000002000020000000115bf932b713bd934da35b2935c17313b2416da79a1a7b80504c06f7456f204120000000f532be79168ee07add4b0b8a10386c58de4dc7a513f8d2302aae03fdfbe8b02340000000cc897328149cd348487c3f5885cdd0a840aa72d49c7738f26cbf8af647d18bfb01c467cacb5a7de85b479ddc6ebb4c76c5357115dfdb5725f3b52a772195fd0f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1824	2424	iexplore.exe	15
PID 2424 wrote to memory of 1824	2424	iexplore.exe	15
PID 2424 wrote to memory of 1824	2424	iexplore.exe	15
PID 2424 wrote to memory of 1824	2424	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\57a585eb35e7ae146711c735fb7dd316.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c77914e5d893a9666e67c628736a8780

SHA1
e687e63086278fe0c2c45501d6e5063c6dfac91f

SHA256
7b841b0d9ace1e86079248ca6573eef3dd0616ab7f9bd54e92870e29d3310a93

SHA512
7226b8a38f2c4bc452d3ba4fead80b1de6c03c0cfd699ee73e125d0d91d9da3dde5c2112f5336e55bd7cf4aefc3f3684a1b36fe602892c601c7b2b77fd84ab0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4fbd7ead495191921e67526ea3b870d

SHA1
86e902df3cc3e4d0c5c21ad85b4d0071460e8689

SHA256
8441c74b68701e1b771ab8dcf8b183094648d3a7052446c4263c24fcb4941e55

SHA512
29e4204e35e861f136006089f26fb34cd79045d4bf638194adf85a41040b352192ec19fd6cd926b0740d318c1aa7bf9d028eabc4868f8f43143b314e4153694f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2a5b2a1b6e2b0386b86ad3ff430828b

SHA1
108d5f7fc4e56d99dd9e4a9f505f5d4e44f300e4

SHA256
cd13645dd960bdf49df1de090e67f21eac51ba04efaf3042ad5425a694b8a388

SHA512
7b5be6813ab179f753fde78688a8f4fc024aabd48c9d6b8ea69b40feb0123305f8eb696e3f3ba6fd9c221fb3bf84f1ff87ebbcbdd44e25b6ccf6e20bbbe44084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cd4ad3dbc0584eadcb8d151036dfc4b

SHA1
44e3eb05b57ef6972b21c8965367cf5d58a13afb

SHA256
6fbe600adb74c6d7ecf939534cfcb75c6113e59b2ce6f2042dec6a74902bdcd4

SHA512
6c0a45f9bc2bd60aec5dc08d62042444ab373ab4fc112311fc8f90b30f37d883973e15c96c0ee6659342c3f473d4d862b18600c8b6411feea13636fabe9e8cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cac012388a61f0f1249f28fd84d80bd0

SHA1
91e2afeea6c6aa7ee9cfc3388667f932905d7f75

SHA256
83de6d12f5eb0ce26d8b1560faa97361d2b1b9f3e8e249812eed192dd7a532dc

SHA512
dd22b31e1f58fb5dbb5bd3264232a5e43a27df2e99bf37394c691625aedbafe8a9e53086f289aa7289d744413a272bfb4948fc6fa3a92ad0a00a33feadfa5a3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fa73e4da49d7d9fe3bd22d36cb98b49

SHA1
af194378a623bf4d1270aeb588d2398ee98a125e

SHA256
f10d90bed1a1958450acbff2a3af349d68b6e2797d49607e2e0460a24bde5126

SHA512
a97a46f18cbb3a2f1a2825fb85c62fa981f1ab7c60d933d6123762f7d0eae8f9f38f44c8b3e29ba2e99215d34acb6838c2a52e4201e4aa33585d51727f4c485e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
132dda8ca51de5104a2b8429e9c5b9cb

SHA1
c0204f06e0aeebbce277f10dafb33d774056093f

SHA256
a0848392e201c7c47d6a03b4c3a9e3130c68ec3ed55f42a79fcb6e41b1d1ba12

SHA512
5a62c1028028263d74eb7ce88fda477782f76119163a6896aafe663675883b7cf8cfbb6d72c7cc6ec7922b5f37f01dd70bb10df8627b1aff850a869b28d281b3

Download Submit