e9c90e46dfebfa17c9c17cc94711b3da3af830b4e38f1d81c9efbb07fe654c6a

Analysis

max time kernel
118s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

62715c4546fb6a7f80a3d1cbf54ac035.html
Size

61KB
MD5

62715c4546fb6a7f80a3d1cbf54ac035
SHA1

18a84d96e8c0e7312c9b7ecbf1ce4d481b4d567f
SHA256

e9c90e46dfebfa17c9c17cc94711b3da3af830b4e38f1d81c9efbb07fe654c6a
SHA512

0be8eba1a7351247481f075564caf46f6f6ebd109f427f663e1d40efd9592287daccf7590c595856d75a8d38d715476722cfdbdeb01787f78d059dc4c0a5d504
SSDEEP

384:/FlIcetv4lsGTH4tD0e0tj9wTtTGJ3MgYxktxuoCkx9g/QEo0Tt/rNzxk6DkqobJ:DqTaEmB5GCGpyoo1sgu6xLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7D67941-AC66-11EE-A7E3-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410688646"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2868	2772	iexplore.exe	28
PID 2772 wrote to memory of 2868	2772	iexplore.exe	28
PID 2772 wrote to memory of 2868	2772	iexplore.exe	28
PID 2772 wrote to memory of 2868	2772	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62715c4546fb6a7f80a3d1cbf54ac035.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f2ce35e76e831d892dc24cbe02b996

SHA1
53698a0eeb2ed99e04e03fb1d5d8402ad6dba0c9

SHA256
d0eba660cb631128b73cd10c41380daf9571e45a79d7bf21ed194071da936a48

SHA512
19c4de4ba69ca282f7aec6e961c2e5c5ea2f0365f81608ef013eb4c3bc41d4c826421e14a7b6ecbb151e836e7e47bf38cdfb168a980729e952de5f0f14817857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a49fb7287ee46ee85e925c89c71937f7

SHA1
af7b8fd4879e5c717e8e84a0aaebd275f5f0bb1b

SHA256
c303c99e834f1210e1841716683f67095d4eea437253a70a8d1715bbdd873ff0

SHA512
3a6ba70af64116b129a7fbbaee438f1a21a6bd156ebdf329f743172db3a61acbe5ee394aec02eb331d2f796b86c6689451530c2acc7dc73daa80bfaf495d928d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b23f72b122a5154eb1c4339fb4e832

SHA1
7434575a267a2d24daa0a0f8f59722c30e1738dd

SHA256
e0dc194e73c2c10836fa9a8a5aa36882cc279fc26b9287cb60d196e125aa38b8

SHA512
a7cb235f4762392b85ac9dca4635ed4e8c19fe16a8987fee2a894547d18ece84fad6797f38c35e5ff121ace017a772333ea3637700b82f2413b708c2f7dd9301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d83cc25ee7a7f3529e3f105aa559e120

SHA1
1b125a412dcfddccbcc80111861135f97d1180cf

SHA256
1ccc732d2b3778b83088fa6bcbdbba4d46c7f6fc3637b85b82a3a9e9d4e3b62e

SHA512
6002998f1fe75bc5d2bcdcbdb52dd912fbbbcab5fca204c84695827e8e480e5da77a0eee9a0aea4bb04c331ae94f6380128ddc09fb7ad133be2b5dc45e9f8c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc5918e0e9663a1438d9105117dbad4

SHA1
cb18a3ff7c61906d1d17b2e2db80dc77c11bcb4c

SHA256
16f55baec09a20649ceabc3a345d9b9a364d141346c161a2a4112ebaf8c5bc18

SHA512
4161d6cd4b79a7c2108e7339f6d79e25fd1ade3fddaeb47eaea188f40c4004d2347fdb368fc061cfdd761f6d79382922564518a9f9cf1d199793524a5ce61e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd4e03af1d1f3b3e6802f53f1894e697

SHA1
4624f10c08755ed683d1d4acb6d266c25e66189a

SHA256
2dd730c9ac138f460420fe16fa949d82f987f34049436537fd42640769baf08a

SHA512
836e4c03f972273714f3bc84066df654a949f68764e0183bd79c7623062cc29f7d4140ab13200ed43876f54783b66592815328975491dde2b74cef701b11dbc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd91a7a40b7850017b32ae9aa86de567

SHA1
0d5157e928777fabd4f8c9207988316da3ee1320

SHA256
b6a4fe4f1d252d4a7ef431bed6d4223d125da883f99ee407515d0110ff2f0eea

SHA512
1865044b02a7c74c9229c7a0c16cd74cdea1ed488be60a2c4345e969d7ecda2d34781b3114ff90dccfe13393529faaaf4a56591be3f15c471675a9cb22ea1e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf5ebeb1437e690e75253196d90cfe3

SHA1
30bccb3dc2107f294a1551d83e4ae8cf15d3f7ee

SHA256
082c3974af8f9459ba40992e1750e65b07fa69483806a03d8d797733154c4bb8

SHA512
d90fbc09e70beeaa1519d39af5d93d54c3d65abe167b0ff3b172155dcfaf200d02c197551ff594315f1388150c15ae2b84d5396d137c4116c8b6ffc5e85fa57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a12142de5876271e3e4cf2d78b1c216f

SHA1
ab00f56daf5c720227f2d321be9ec99f02727135

SHA256
e2c8ed8c19e7817dc5acf3976a8b1609e16a3455a6c153ee58a2ff3a1425b841

SHA512
878c69d285c7925b7b2766bbfef42e2d4a3638d60148e307f1c47f53fccad8cc529565488555b76d193d4d37f02a2784e9d4b2df7331a83e44656214a29bfe5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C6B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6CBC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit