e258d015d9848781667f11acc1162208a21c88f28e7bc95b9e24b0dc4da76bcd

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7554b93565f1d90f668d0b78d2c48244.html
Size

6KB
MD5

7554b93565f1d90f668d0b78d2c48244
SHA1

d57ad1c646a2e1dba40a8170a15c882114bce410
SHA256

e258d015d9848781667f11acc1162208a21c88f28e7bc95b9e24b0dc4da76bcd
SHA512

eaea7f2a34b35331424b96f66c79ee410994432216cb3d2104730d21795358dbb9882fb5382721a5aaeee35b3675cf07e504ac29687fa05e1d6bdf9afc620608
SSDEEP

96:uzVs+ux71lmLLY1k9o84d12ef7CSTUIZcEZ7ru7f:csz7bmAYS/7b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2041658dc140da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004229a0eaba22f7adbb176eb6f518cf45c9c9d8795c351e31eaf5f498b4a0db7b000000000e8000000002000020000000336ee537c3fdf51daf920d9da3e21c1ecbead618b67c7d41222381bba88e79f2200000007865c81f5af32200363015a11780be87f1c248b1cc3b589305bf84344c3085654000000049ea4b975364d9120581f23a8957d79db0d4b5b0dfd5b18957863a58e049d55da8474f4789c10e673afe440b1fa5249eba4bf0898d6d973ed178e1edb661ea54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410722137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6075281-ACB4-11EE-BE60-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006b18b8334a75748c0d8a0762fbe99da77a989132ddb1b3e93fbd2d40695c3c36000000000e80000000020000200000002b3a875383c4204a0971bc8ad528c5393eeafb7c096c6d15feeb83a7b62ee20a90000000c74c2b6b8f3cc5811efabd35478373a1845448043b318d4de19855c8f520cb49750da10745b91bf542b9ef472d67545f01077db3abd864bab29d3fd5946a82865d2eb07647794f70d10d2c7c937e33ec9d614f73049e05319adeadb7b1c4b5cfa2d6a486ce74d054c020c7d49e0cddcd0b3cddc1e636937795e64467cbf8ebb54f5b33b2cf8ed010d253f39f5e8d3c2940000000126a874c4af9f28ec67b2e786fee44dd2c2c8a45e7cad9815789b6b1b7f60e6cdcfec5c3caf2de92ddf9f002fdc9e8cc2cbc51da2d66a6ff17726ecc80a6f3b9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28
PID 1680 wrote to memory of 2280	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7554b93565f1d90f668d0b78d2c48244.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc163e89af99ebe064bd98246086782

SHA1
d3715bc0d776195f85a963e4bcf68408c2c5511c

SHA256
58e3006cedccb7fe8e714f0cb13c877b53c55cfeb12be9df55f7a71e9441b81c

SHA512
84c9b12b496f6fbba8897b4aa73d6cbb20cc307c2ad2c6e8cc45069f61aa5902ddc7d254dddc7d1bd84e8a826a3c682010d3125b06a0f5553728e2e03c00fa48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
347707dcef75f25973eaed971c52d8c5

SHA1
618d0ce7b98ef809ea6e34eed3e53891491ac9d1

SHA256
c0f6f5748efe12646d110180dccd5227b87229697a34f3a0878538555e62290c

SHA512
b084501d4e45aed9dacdc9f463b907a2fe0928f96d8887e4ad2c81a8aef2af18e4b935a2fce1e8d45064376c9e94deb937713cfb4a8c39d7e558fb535e1f2838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d4856efde4467cba5180d379caaf3f

SHA1
6746c7b68c2e41a08d851987ed6c525031213ff6

SHA256
366eb8b4e2b097c0de5f45e3fb8f92ce372459464f50298e0a09f088f4215e60

SHA512
4f7cda2e163e800b41ee2da320cf81c6c406e15d97b5ccc60b5ae21cefefb943010444c8d89ab71fe4e7b704f1aec249dcee6afd026a8ddbaa701d9cae564210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2387d8b0eb1e7fc2b29ab78eab668ef1

SHA1
d2ff45876fb4993fccef32f15d1a4256014d487f

SHA256
1d4c015fd4c25f34717e7cff2bff1f3d713715014631a05a969b7ffcd5b05fef

SHA512
f9aeeb21980c897eb8cd986da9eadb99a18df49037be30cc9f7d1f238f377230a5c38fa0fefd66fefaed8ebfc9ada531df34c55c82b80c9ca079dac1a1199f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f832ced1f15d7aaff6cac6e6e195d144

SHA1
ea6384b829a9171bb0492364568d4cf669c1f639

SHA256
8af0bcccc50468c8e52aff3c1056bde1879f3bfaf4b8ea600ad47620b74c59f6

SHA512
714565eaecff20c94b1639f78d2d50e2dec1d76a2ad8b4d92b561d5ff74ab8a5bd508473979f3c75b701ee4213fc8212053c77b6223a9757b14eb5f103037bdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58610830bcdd97abae68b83f80ebfcfb

SHA1
f70ec872c535f4cfcf8c213030583e3a95c1fb1c

SHA256
860a7883357c4e8f0edebc4320a7ea86aba3116d236e8246905d235f0b931761

SHA512
aa109ff4b14242ea4f13d5e991039f04b39c59c8fd95c07b8cdfde780f0c56d2292ac246b43058a0916eb6af32a379c30f107af122745b004561543eb99a59e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98a0af09e56ce505fa6f84ee24d9ab78

SHA1
5184b7b0faa8161ab59536f45322ad69332a640e

SHA256
04320230312b49fde5abc4e873f7e79f649c72a53eece301db59720918faa1f4

SHA512
8ae4c28d8556a23f0e0369b76a2b40352e1df75210941ba023511a5508de09a6f00718cd7f7b09495f7ede992c9c1e39e8601ae1a793c4375b1ff5d3b0b05c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92d6ba835f738ef3f8ae05fdc8d16ef4

SHA1
f8458f82fb0e3c237bf6d4501449e637b719fdd4

SHA256
6f4c97c7edae8bad5c629bd87546daf23c5a7ebb52d5757bebc5c9dae830ab3f

SHA512
d0d2499b68651c91c80dc732147de59fb32d2ee3cc072a8c35db0a60f985a6564eb75592920226e8bf7fcfb4dfdf34ae454e9ed33c3bab8088a5dc6f495cbcb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37590d878e1e92f42c13b7aa76b6c252

SHA1
722a3b284f7907bde7f2d58999941f697210ba5d

SHA256
265c237b050e0d17d63bfb38873562a32d5c1370033a254383001b472111394a

SHA512
e1772f7f3d354c036500c4226bc2f3f9189b953dfeee348332dead53d715b22a1041424b009b6327bdb16eb35288a9eea2bffa5766b3de638f782554194dcd84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80bb35f349d47701b858f85e6ff8af9b

SHA1
85fcf28a901e3d3b6b1a0a959534a3cb84bf27cb

SHA256
c3a96aaf7824c1a0988039a7fce97fc37880346a23a8e9aa5759426a0fc7c017

SHA512
c73bd5dd43471c04794731dffd35183dec78c5709552abc183c1602415c3a680d2d08e3f27dbf278d2f9ccc5f877be9b1fdd7c7e7e377597309de6be8cc897db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f5fece055ec5d9fec6a7aa12e11d29e

SHA1
97c43c13b9878b61b2fdba36c8846db19975a54a

SHA256
1458d89069c199d52c5bcb1a5fa0dc608d7447bfb748a1208d4ef06db08438ea

SHA512
03691b18554b621673c0c129db5eba9c5ef08fc6df58d1e47906296dfcb57efa6a1cad3b2cffc8016e29cd8e67f5e7f0f33199fa2619713689bd54870baf8213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0017e4df7a7e2888b12ba32bb872e11

SHA1
f316a872dbfc8244fc902a9a7b4842d741f2915f

SHA256
aa544fa1fd7c67241f97c3ad7915dfe3e1f9f9c124a1f5079243bc5f4e887e0c

SHA512
c361e067133c79e0978a1a6de6ebe0c20ddfe3e40820a34e96f093eec76666c5892f5372635ee2bdda3665ce97f2eb0a310c492db8b2498f709ed55ecc2aaf3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab915A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit