dca8eb232d2aa61b4ad8475132ae628a1ffc52480cf69122708b9e81fe18f8ea

Analysis

max time kernel
117s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cbd0f5aa69e70b90c2818123edb72b.html
Size

7KB
MD5

65cbd0f5aa69e70b90c2818123edb72b
SHA1

81590c536c000707854eaf95f06a591d96f1b076
SHA256

dca8eb232d2aa61b4ad8475132ae628a1ffc52480cf69122708b9e81fe18f8ea
SHA512

6bbeb8dd5a2864ee883ca2f308e3ae89e3bc7e8f62c5a7cdca67694f309757a688df2e133808b74f2b93363514d7501f813de8258c9946256af4b0edd45b6266
SSDEEP

96:uzVs+ux7B0LLY1k9o84d12ef7CSTUfzfNhFBqIYP+YcCcEZ7ru7f:csz7B0AYS/8wr9zb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409859106"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47BCC251-A4DB-11EE-9305-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000007b72d8d6532aa0f4e9fa708dae8feb636eb66c46e84a2f832bba8c004c4f43a2000000000e80000000020000200000007bc153de105704300e1c28ec5280f6127973910f4806c3fd3229501299328a3b20000000bae75670fb527c0160cb1bbf36368dc6640913f9ca4ae550c69942e65b2a20bf400000006973c8e2f9f5ff0e207024bbbe96db05012dc427d6ee3f5371aefea0e22bc232415eaee7b524f660b0a1cb7a2b3d39d02998b50243d1d0a509c93913013923c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000054615fb5daf9e4979311759b6177c1b7a3146acd908bef1850809b6b8dee5029000000000e8000000002000020000000c27b05dcce1ee9b907d1e961116484d3d86927a3736c5a666aeaa0ac5f6e674c900000001fd639ec0f7f512318b75328482e0f4b026e547837e6f108154c70abc57a8945a905497f897df3fad23429b44f2209e298fe17ba1a4beada3ad41f3c18a30d67e4de0c8b376ecc95f4cf13abcf190a35a3d05509004cdbcffaeb40a5032d813ae73a626e80a7d1a3de8be5d49c177e6032f5ea16a3e1b74d2c966536db83a4c556bc41cb29f217780fcfe91d460995e2400000008a3d3a95a3df0655cecc39efbaf625bead2b1827a4a6f43b95e27c54ac54c476d5d12e4728f9eb3fec0caf19bb1238df859c60bfb5a4e6f069e3934db7f5ee8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0676d20e838da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2940	2180	iexplore.exe	28
PID 2180 wrote to memory of 2940	2180	iexplore.exe	28
PID 2180 wrote to memory of 2940	2180	iexplore.exe	28
PID 2180 wrote to memory of 2940	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65cbd0f5aa69e70b90c2818123edb72b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b4dc95d3cecb6d8dc68132a5511bf1e

SHA1
670533db317ed7849485a8aa2d7a0ff0fee17a7e

SHA256
4c2ad56b6f0a6fea863c81a1dc0dc117d7a319866a51fc536b9c4a1bc0dec940

SHA512
6d8b8d80cd967a479ae23e3fa7d63f1b3f79e78826e5b495e09716c693e9a1f6986ae97c5703c6542788d2328eb832b17ec3d04dbfa9dcc1ef0fa13e8fbeb650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cada82be74d3f1c3af4d48b7a15b61e

SHA1
cc5a95ada7e48f82b7fb18e44f89cd99aca1878f

SHA256
31e07d3361a0d1007a60126c773b17e60d13ed2f006ee0b254dfe06d07f61e21

SHA512
50fad7ea40b564ac0af8efb763a3c2152dd22f986a6f3eeb330ce3ebdd62d53eb341005441fd4b35e1b8865cf00b9574d0fe1eedc1559edabe4b4bf1a00fccea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
806688ed47907b89ec0cee69ba0b40d3

SHA1
b80f0fbcf946790481ad7155963f22ce889bec60

SHA256
7fe7c48443d1450dc81d722f09dee573625e6c0e364f9a325e919505e4709933

SHA512
a8767f160b0186d1f1258f6071260bd748f03c9ca0c486dfc56550db802f9f492dcb8a1cff8035d063ad3760375f26e0fc0d4dc822b30545871e3b62a1f723bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8f5e9845312972d26688b3d96f76cbc

SHA1
76aa43f17f0a4ccac963b17840ccf44513320e46

SHA256
763beefc768d2249da6980eaff535d6e7c75cf1e7fe67401d57966ab1964187d

SHA512
33907eb16670e7bc573535dd1431bcfb7393a0ea45640bc20201108016484ff422dd214e9dd639ae7bdf0602cd1f5fd61e6243244d5862f82b22042c217e293e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
570776b031d08cfdbdb6bff37a27d024

SHA1
5805bfa3df4211fbcc2e58d7e0dbf6af34f29d99

SHA256
7b62dbad448c724c75b1e6b4240e0f832e7dd9bec0b1b24b4e6a647faa355ba7

SHA512
4fd70f10193cd019cadf0dce64ae9c0e4cdfaa8c89ae4cfc5cf3815a797a105cc8233c8888cb49b930d1edba702d31b03251f57d3b2c124569178c63c7b506a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e9ef73328b2e4a98ba7fda61e4750bb

SHA1
e62188ed47034f2edbc798d59fd0e0f124672614

SHA256
9c1736672d6c67802619482ca8e56cf5382d7a26ae8ca4672d5393cfe2c1b83a

SHA512
7c8a1c1d1f66c5021a3e73a37e728935f86a12196f4226b2368a8241801242cda001629ef33401a314bba62f5d0a2dbe05b3fa7bfe1f28c8340d42a7a68d5d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B2E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FD4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit