d8231027e933c579c9190da2bad4b41d4df8a8f8ebda07e8b4fc7464fcbaf0ff

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

727fe60909ee121a1720a337794c20a4.html
Size

158KB
MD5

727fe60909ee121a1720a337794c20a4
SHA1

088423ffa3fa303f9e72bac746f678633aefb6c4
SHA256

d8231027e933c579c9190da2bad4b41d4df8a8f8ebda07e8b4fc7464fcbaf0ff
SHA512

e8747ade3cff8c49f58236d80154125de248d0320a8db1e546901c36fb23cb2505a411ca3694e7a94718d12310123d339cd544b8fbf572b8c26a8fbcf01cb1f7
SSDEEP

3072:c7CCd1ULfsmi58wnK7CCd1ULfsmi58wnN:UCJUmi5gCJUmi5j

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901c9a452239da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000014dcf9150578797904f68ccf344c44e58854b5774534535942b5769da125bb9a000000000e8000000002000020000000f90ca5ce6aae8d23702f7ba778b86b0e29518f45e7f8a89d6986a83dc6b0a0ab90000000605a50afc03cc50cb27a8c22971e8562c8cd880abfef12cd849fffca5b125af41ef5c38fd3d508e9c35c408db774aafe81f2b57b3e28f8220b5f9e09608c086f20de99f243ba3e571a7ee904ee32fe32db1a0751288073e4033a28bbe5db63186c5af409328691152761383408a2dbdd0f0a5942f6aa64807b1230e0705a8a84448576d479b7315c32c71f8b5ced85a74000000083b6d84ec15ec8047ca308334aa0b7115a298f6d6ad2ff4eea2b4a81b9baec06b862c43588952fdd57598f9120147147897aa3672fe113dcfdb805591db7b3ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b82361a2a6babcec28ec46c7a5d485df52972a227bec9ff756c87fdda59c296c000000000e8000000002000020000000f1dfcde656023c248c03e95663a9029d53dccca62716fc023d4dd21f28e7d027200000008959b39fec352a7b390f5f783a7c02d075a4ec9d8331c65c798fc4b5aa0abe3740000000ee28de443cbfebbe4a045bb33a3cde5b7db40c4411fcaf2d1fb1fe1b0aa524a69187af333c304988f9b576cd55d9e9dbbe798c4acd93648e3d4be5e4cdf5f879	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409884072"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70587E41-A515-11EE-A0F6-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1148	iexplore.exe
1148	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2004	1148	iexplore.exe	28
PID 1148 wrote to memory of 2004	1148	iexplore.exe	28
PID 1148 wrote to memory of 2004	1148	iexplore.exe	28
PID 1148 wrote to memory of 2004	1148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\727fe60909ee121a1720a337794c20a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0de8fd74b730cc2b00fa300499ce707d

SHA1
9600b529db641f58f1f8817be716b6fac6577e08

SHA256
b97d5bba196e93dacf4a25a87e1596638095d00b8d575d60cf710351d2ff1685

SHA512
07c2473e9a653a2d38240154f0c1008b341ff1722c7a42ad35e100ee060ee78d046eadcec0f9f7b6d715d6bb12d4c2a7aef509aca113950808d1f2c5b620fa8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb50165bf46011ecab3f0a54783a110e

SHA1
63cfc9214183db0e10d106ab6c37eb814de585c9

SHA256
5e24c5352c7652d85562950956d2507646eee4c30b307dbf30b6d7375c932cde

SHA512
95d924f6c109765b6d78f9e3a2955e3bd744c92977aa556860e40a1df09ffcc146018907a75880da44f62cbc5c3293880744cc36c53e8880d56758c097f1a8d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1cada67e6ef4c51b307247c4410831

SHA1
1cba24a495b5588a7da88df5e96cf4ec46bab02e

SHA256
150f4ce23345addb22b7c40d133eec628f6b2a27e96fa22179f8d81d1c29ffe6

SHA512
22ffdd0f4e310935a3ed361818d9cf7ca4f911bd208ac1423cd9605ee6898c6d9a037d0d233b77417a4fcdeb7810f5b2961d925e68ed01bd3a4757e270337fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dcb49ce1c671b865a7bcbcf6062fb67

SHA1
e83d26308cdb80848b17f4495b3c051482150fbe

SHA256
4ff0d0c753d4067e2e1a232e19bd19e44a2e0e5c479117b7b4b3452b715f3485

SHA512
20490cdab56b72fa27fb8fe334d73d6cc106a570e7686f306b2e9266b62db302284b075b2a052a1314af44a84a01a7fa3e2a744fd8b1f423403fe8082573a12b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c889908e3e421cd24bf36da13fc2395

SHA1
a13d351afa3d5cc28474c79502205701d2724d2c

SHA256
1b7fa74f5e0915d6a64b74dd9d535791647102ab24045138d0bf807b49866794

SHA512
4d47d6109b6d552cd5b03929e7a780d487ddad08351b9408500f039e71ef387ffd2e6c482cd5c0095e98072d2b2e6edc1a2bacafec3a7d15cef17bf2107104f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f5475ec1b45b0b84bdbe8521e8511bd

SHA1
623045fa92212a03f421cbdb919ea8f3cb69782a

SHA256
36b12f2ca668daf485246e071e110c6b2259eca541a41e8176ab6cf39aa7aaf8

SHA512
3e9b140a4a16533d7b1b4495de31001a219f6984cb70f23efd535df0b315ead6f1677b7e5ce876a5c5d3e1d5667220a774389a60f7340fb29766b55704e14a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d3cff8db955dd8629cb3229fcb642d3

SHA1
59ea432c8ff299323d1e40245bfbf19374190cf3

SHA256
647f72462af5ba57b6a01d9a398e1ab3355235fb18bc9e046483a366862beeeb

SHA512
c362589a5a20f28ead116068a144f685764811a8bddcff3e8d56372b97f8b298b77f3f5d3c1c4013842e14d67e668c79074f16a17fefab33ff9b427c6194c7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c10ed0e91111803e8eff60f669da949

SHA1
f0f1e921cf1bd9d4e803167e08b57d98670686bc

SHA256
e2e337e0cb9142a30ffa41f7f77ec674682b7a60e074737b02459d00271ab709

SHA512
4f0ad777b069a120741f49116810a6aef4929303f7bedf65ab6f4424eb06ccada02acd8ae6c8f309edd5caa595ea85119b891b9c23102a6509a62655a7b5e4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79a3862523354cbd23d7811f060ce55f

SHA1
758c66cdc42925d2f08e75cf6a1dfe3d1a06a3ff

SHA256
cdd0944869fb77110ff15a124a7e7e7320f895e30b124c215796c45df00b835c

SHA512
ee1dc18bfd1bd969023a1e3e62dc59bfe72c4a429a39668ce28a2849c5280ba5a45ee2b6ffbcdf2159f7668295fceda4505c501e31931dce0bc83910993381cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ebf6b62182993c97399c057d3e9f8d1

SHA1
2707f550815454814de6ad839c15811b583d0620

SHA256
3013b8c93691dc908b2fc1c764357ecda74a9ee45b9ff221ec230083076dcd9f

SHA512
f4f9e46582abecce4f8930815c83fe24984678d0d43094fbc5dd1a100de31323dba0509dcf39dfb66ef61749e81166ef68f8a3a178fbc3306da15cc8f295d2e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96fb4f683357b7e6e2e4910e6808b130

SHA1
53614f7f6f112c485639cc711888dca7ba95f712

SHA256
7636cb20566e21604a8b78e85297067193e3d4c96d8e1699ae47e5429d9eee3b

SHA512
9d4a10e97214bc03af30e140b1ef03bdca6b301fab474efaa75a3c522e25b0701f5ee4f6fb6fd9ad42a23bce4152aad66292fdf11c129619c100d7417b94aa73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D01.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D33.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit