7f65886f1ac124f482021b82e066aaac7d82e3dff144eba456b94e53a4f49831

Analysis

max time kernel
178s
max time network
253s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

738fad1df3c976d1c73cd6cefa5603fb.html
Size

17KB
MD5

738fad1df3c976d1c73cd6cefa5603fb
SHA1

782070def329b2da8d3074aeda1eed3b524ccfac
SHA256

7f65886f1ac124f482021b82e066aaac7d82e3dff144eba456b94e53a4f49831
SHA512

c19bf5d97a11f7afd56f0cc570dac50cd8c197d78b9a8c6733de2232c34c09074345e463b8d8812a2a8658ce57f1aecefa0f34dec1a6dd2995e8aa3e5b68dd30
SSDEEP

96:MpvaJWKn44ZxvlCPAhhFkrk29NxXMXPGnaGa53ajs:qvaUidhTkrn9NxXMaaGa53ajs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006500c0831f142d9f9cb486644ebdedf27de73954e5b8436ad8f2d6328ad91403000000000e8000000002000020000000f111b1304af82883e52d09addcba80bc68206e00ed6452aa693c395b7e75647b20000000e27fe4db2a415f65e55c6756047dc5170a1f7fe78f40cb9a82dce1893e119e7140000000881e393e5912bcb6fd46067a8e73c4d5f55cae53fb83a6f4e059a6cbb0d0e46b7468535f9f26818c51fdd4386791186c1465d8a0ad0a4f0058f5758acef901a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FE88730-A51A-11EE-9B2E-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b9ff5e18a7876c9a8d49b11e50719da5628ded9f265cce56c62e3d49a328bb3d000000000e8000000002000020000000caf3c7052e7732dc90d6a23ab2ef17b530e057b91eab1b2d7a2bc3bbc7f1ecec900000006daaa0a1596ec5494cb9a88fc2816544ba807c7cdb334a207c6e08b5636a5c36ee17095d6c0fc80c3b2d30070afbfb60bdb012c002cadbf1783cf3a87ff963660565e02291e2ea5946c444a7b10fda9b48982fc4b527a46115c525d4a647c8543d35b62f52d142fda1e1b5bfcc5d1fdf0d6be09fceebefc74e9bcc1c9b82fe89cc34532387da1834147b88d67512374040000000f6c80b34257e8ea73628ce53937e3daa03b60c8fa622735031b6b67a8977e9ff86f01eb8bf8fd37aa06fe91eda56a417f9b30b6fa00499086721b1b290924357	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886068"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f4d3f52639da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1960	2556	iexplore.exe	30
PID 2556 wrote to memory of 1960	2556	iexplore.exe	30
PID 2556 wrote to memory of 1960	2556	iexplore.exe	30
PID 2556 wrote to memory of 1960	2556	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\738fad1df3c976d1c73cd6cefa5603fb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595aa9781ce333f52dd63ac23875530d

SHA1
3accd17745a3e808a2004bfdc7f1780824a79997

SHA256
26266767cd1da43e5fdf0b1bca37888fdfe5aae9fa8023e952252c6943af7236

SHA512
f97451b93e20b1d3576443c8d9341b2f156f6b118863973d4229a8f7596715fd77bce0ba3c99c083140d5b67a106ebf06b2b4c4b8c81c59025f20bbeb03774d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0d28300f50b67552b9cce82fa825e0e

SHA1
70b72d232998e4076cc90ffe821d208a8830981d

SHA256
c0cc1008acda0f3feb9c9278cc45dae6a5b2fa257291bdbf1ac236832a938399

SHA512
bbbb636fe60ccb2b29cd230467ccb89a1662c0814c556639532d7da8f7b86461fc7d8040ab9cb9579e382fe8e00f2a2ccfc5b9eb6f723ca9a17dce85acd4b0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86e1df3bdd6548e6c7c3ecaa2c57d864

SHA1
bdc38082ca7721690967db32465b8f1b695c3200

SHA256
79b8d50dfce29fe9ad2820dc7afae56a0fe604fbc13d81f5c118cff423e3ae51

SHA512
191cce787ec90c47e59d6249874fb0dce89f2584a2cf749a17b9cf653414e1df2bb188e0d288c42288c361ae99b9d7261ccdf54c2fcf88d16b6daa8fa3fbd666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd127d1ba9a7957bf752f34b6ef8c6b3

SHA1
c95e11e3295e22132320eca7e543527d7459c5b1

SHA256
367ae29e084ff7fb106e21634ff7cb9e05d4297b68733b0ee9be359ceb63ad7a

SHA512
09f6fc8b16d12098bdd0a74ca380d13d7bda73bd6416c431b61b7f05c17dbaeb16b2121dc308110804deafa1033d2a726d6251bf8aac107fc9a5e000c302e2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f2ef2ada637de7bff605bda965ba71b

SHA1
e79a4676252c6b061d8a61945d9ac47fb87aaa5a

SHA256
d33a53601e9ac32ee40a045dcf2f90bf966f0141aff06274a5a177b205671940

SHA512
4bc5b5194961634b59f7407ce53365f03b27a7f911441afb3213ca9094f082e91420d9e17048dcd268aa93626ab7bd4f0af35c3d3d3e49df64baf0b08b7b338a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB952.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1CD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit