acf23c2274ded3bb033da5f1831cc9332e02cabd89e222ee3e8fd4e05c7455b3

Analysis

max time kernel
42s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57e54c02a2878e4be414ff1ffd079fff.html
Size

432B
MD5

57e54c02a2878e4be414ff1ffd079fff
SHA1

14d29697aa2049c23768eb68cc9045202a2dd4ea
SHA256

acf23c2274ded3bb033da5f1831cc9332e02cabd89e222ee3e8fd4e05c7455b3
SHA512

c9da121ebfb398c8c1e7f54df9170e5d50b1c723306815da684172b633a691fd70de1a1f6a166ccabf1c938a5f4dfb15016f1a5ff99edb349c1f3133fe72da1a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{086FDEA1-AC26-11EE-B696-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2136	2444	iexplore.exe	16
PID 2444 wrote to memory of 2136	2444	iexplore.exe	16
PID 2444 wrote to memory of 2136	2444	iexplore.exe	16
PID 2444 wrote to memory of 2136	2444	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\57e54c02a2878e4be414ff1ffd079fff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf9831381ec1d29fe12225fdd36f7132

SHA1
2fe55c6b951a4a314a291096ebd53ebf14078c5f

SHA256
e496d834de0842eb689b6312198c222a68f3b8bd60eb30cf350d038e65937037

SHA512
0f1776806453a3f709026cb16419c16855719a573d2ea621c86306390c5cce083efa82606a3182b58f629081768c02cc8adb94eddc5958f63201257edb2cd7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d072a7166e3099a3621121b3ba5e68

SHA1
b195aea99cc8135f3f4470775ec406abc0b316b7

SHA256
c7f83801f3992ddd9b60710c47530b75629517ec408ce7dccb5a897b76d5a1fd

SHA512
bbeb2abb0cd0e70edc85626fcf2a02b1243b4c2d53626dd887c36430485e5724a6f48702afc0b7d3d0d1cd0723f9a9a9b4fc288f5eba0b0bff210a21cbafc93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52142a089ca2c19cf88c69574007c5f9

SHA1
3b38e215559842637d55c17207b8db5100a69b93

SHA256
81bfc430717e87323f3aec87b25bcfee48935a4879b9e9716d918b83d981ea8b

SHA512
86c540640e110ee8540b728a9f43b9f9efadfc7969d569075ee55d431d9b547799b08bd01f97e8120d6c9d42bfe161cbe762b7f44f04ad1c067175dc51a866de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f772d3fa9c0fc81a171be14eb787256c

SHA1
1c8f853ba5d2ff9668abdd7d4ba3064e1ef6303e

SHA256
66c1fcdabe6ca5835a73edaa392155efbcce068c164aa1ed89a97442f66d016f

SHA512
354977a671288bf04dd7bf0c405f8b5eea13105c6a2a4f730cc5bf7c47552d05f0f33ec2df6f0769d3d56f045abc9c316d95c390c5492aa4b0909b642db061dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
427caed7f1aa0b17dc613efb06e83e1d

SHA1
301cd710080a9fbc41b54ae6c57cc064abe4ce34

SHA256
c00cb52979075375a0b676e973ac4459503a4f979e9b615b8ab49fdf0bfac36b

SHA512
8bb2d94c61d6aec86cf9f378b1bedc621e900a94bacb0a12fdee5bae193b4f8be3c6f3b8b063de04447f8f04b26f37c13ed2451eb633ae4adb4804accdfc8317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ec73742ab2939541bde9547f3deb51

SHA1
30f255a8fb364b5da9dcbb6950bc47b8b157b91b

SHA256
49c782b12ffb99cc56077e978b422588be81e575277279f916c2135aebf6ba75

SHA512
e4d2541d7f175456e04abe96c57a01245aece83a3639a0f697e0f4cfac9359e580d7bde9d5cadb8f47d10cd7e7fa40f3cbb6d242eabc308a0613a0351e0e072a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
408b06eb7d32b30831844baf7b29d4f1

SHA1
0521f4a91ade238f165289768f3a01d6c68b9052

SHA256
a8a1709cd4a28f3c813a355ee67c16d194c77c450c2f01a1551cf4815d3239cb

SHA512
0de4fda1b11970659002779d8f919c6b25d59f3f4384fba1181758f5902de7029b87c23a48a1a927457dfb29849b7fbe749fafef444df90fbfff600abca047ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2s0hu3f\imagestore.dat

Filesize
1KB

MD5
f6d0f421decaa48e1074bd868ea1492b

SHA1
0a6ec9e0e38c467631353ea94fcb48cbdbec71d3

SHA256
5ade3b79e56befd80173a960fe91f5628dc24309e6a035016c613a8f9ffe4913

SHA512
e54fa7dba678db2a28ee3d95301573801e527282211d264d3e8a936633c2968016adf7f68cd5b89828b5162367825d6028cd671d38e3b4ff7be632e95325b82a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5820.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5862.tmp

Filesize
122KB

MD5
f54406be917d545cc4b7b1944388dc7d

SHA1
b38f5ff695fdd771375c9987b633a9900821556b

SHA256
59df2b5473f83f87f0236fc530ed7bfcd48d0058ccdd0f94e273723daa276759

SHA512
5e97a8bab57df67815d91a9364bbb64e1cf0d7948033deb28a174a2e6722b8bbfbe052d2879d94896874dd2083b9b0f0fd2deb341c6ae5db9d9dd2396e4fd730

Download Submit