dd903f483f347baef3c3ac9c12aaf31e33488db7787b043db20f8dd7bb842907

Analysis

max time kernel
121s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

797dbf289487e34ca9b1e570cf2542a6.html
Size

6KB
MD5

797dbf289487e34ca9b1e570cf2542a6
SHA1

517e16ab5622771b56bd63aef10f7ac9b34290ef
SHA256

dd903f483f347baef3c3ac9c12aaf31e33488db7787b043db20f8dd7bb842907
SHA512

ac243b8c586515f450afa50a6c6023094d3f04438fe7f8d5ed2cce0754c4c760fab7c42b31b47ea7a067a223ea0728251f08ac53738237368722510e2e0a8697
SSDEEP

96:uzVs+ux7EHLLY1k9o84d12ef7CSTUjw9cEZ7ru7f:csz7EHAYS/qkb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000aece77996830eaf72b693da3cf9186579d5a79bb38dc661514ee2ce02ed54349000000000e80000000020000200000008de145b1cfa692cf92f0bcbc1ef545562d393e9ed0a02f8b170db26d9d85189090000000c50782da584b165effdaf024fe839c10478382eec9b1ef8c960fa71cd55e3d45731f89fbf33ceb5e1eeb0a77b706a72facc4de227995a0310a90592c323f850f699fe89d1347b6f1fd63299d8e858ce3b5871670fcfa51a0d45eab0870a2d6f37b24129aed7c5b08342efd5ca8c5bb0d431fb7eb6ee5bbc4a22f70fcf9f2d5f4e1ac4ec1cd412346697bef4b090ca8d9400000005f2a25748c58e598ca3d05febc31d8e5bc051fb0b195775a916c1fe19810cd438e90eb16c685ca5ea0e01cb776b76f699480667f55032e64764fb6b9a627f130	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000003a66a67e5557f2f28b4b71a0d7cc5e5345af93f3255554a8b8c13cc07ad2b8d8000000000e8000000002000020000000700f80609ca189eb92e0dc269da7e193f86cd53dd245d15d99bc0b44ca4843042000000071623b6118e1ffaafa3d6e6d5192c8db3d100a83ad6bd3efd239494e8772d0aa4000000016e4833c5ff77638ef88fcc18a344c04aad1eb9ad5369b13facb26e744e127716ed4e08c2ce9398f2ecec77c100826939ed3c630d3c2781a7203e260a845b8b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409896319"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601a6ac23e39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAD9B9B1-A531-11EE-99E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2204	1044	iexplore.exe	28
PID 1044 wrote to memory of 2204	1044	iexplore.exe	28
PID 1044 wrote to memory of 2204	1044	iexplore.exe	28
PID 1044 wrote to memory of 2204	1044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\797dbf289487e34ca9b1e570cf2542a6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
541f6bf2fb67f8c6d2e71d279096f087

SHA1
a7f56f6f415bef8f5ee9b06cdf6bd2e9aaa62e8b

SHA256
8ed6117aa98a1c2cacb4b3ca0d833e30daaf1483483414f9de6b82cda02d4900

SHA512
a688700e5f9a587f5c0928dc9a20399da6b20eac3fc79df9f37f7185ce502c958cd82e4d02d8bb9e0389559a4b76c1b1fb607396a2e1805717bfc3ab7cb3448c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b05cdd11a5e640748b466acc8022f5b

SHA1
f89f2dd873ec032de7fbcc3c1f1edfc337418a69

SHA256
5406cb541c9d937e0a4321b906cc70cdd4f1011a9c86751ec332130b718f2773

SHA512
db4f5bb1705b257619bc596d73cec3e78cdc02c691f4ea921548566333bc7893868404bdf5296cc076fd2f4207032f0dd64063b0b62e4a38e8645a13dd674604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e76046d7ff420f099300c5b9871934e

SHA1
ccb7a874ec59a95c28d25aa7923f172ed58d955a

SHA256
c1b16538e627da5304a0c1b025bfab83c76c147782185f0f5babe9dc05799afe

SHA512
a48b57c898a0d880bbfc3fe79a01cfc4f093888a0163d48c4c79c510737e1ef85a2099ac0a111181acdb0e246f884b9a931d31f0b82950b30ea05c0de2d044bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bcef3d8e8ee09224ea39905f82de105

SHA1
09ae3b9497142c9661fbaa52e0c038118fabf019

SHA256
5993fded50a0419f4b02fbfc4a8455c57bae15a82ef806f1e54368cabfd18217

SHA512
d0acde68734d80a2544aded312f219e9a6abf2f8306f333f3f35dfc37cd58d827afb409ad2867860954a6073e476c37358947d826c595009a113a163846f2546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
859be86577fc298ed5a3b3086aef506e

SHA1
327842ab8634dd9ffc85452f7055de0c6ba31c4c

SHA256
0fc050c9080f3cf6680e302c2943e1a6a98738e3bf3fdffa508f93842a8032a8

SHA512
9d153996261d5c2b26f4c911dd080b4cbb63d59b1f07af9926492d8d6965b2d48d03392ecbeab644d512d827fd80b5ff758ab534e12c2b1e0b97da85660acc01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beefb4a5bae7244fb9485aef3b395d18

SHA1
984f02c7973ac88a41714dd11fecb26210011b9e

SHA256
7dab109d2b5c3cdf471ca2c77a044d8cbe818bc1d9c0d61b799be6e3166c1e22

SHA512
7c625f0b6e52052ad2a04ba004d135925823e1f18b641e9df635c1d9c220092cefb0e4b2c123aa05a8cba523593ba40ec6de2c77c0e1db8a402c68b8b59d49de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de118a247ef6125c889c0b5749e6d587

SHA1
cc91179834d247e40f2e19ce429940e187188e74

SHA256
b7bfc4b101e713ddb85a58a8c70aa433fd8582940b52bfbc78458e2879dabfe3

SHA512
376a26a64f10c113d66b5a6dddbc76a4898884a18f7aba87c0d93ba4d9e9a47d6f6de4ef3b58028f4b26c094982e4fe17e8531149ea8133bd333bb8ea4c53e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9316534904a011ceea50e0b3b3f399ba

SHA1
6b8f3f2d364f5eddc42919b338edf4f203c4b37d

SHA256
d99a001594eb90b7d3ce539490c28b0be81e51abe7823bec1fae77091d529c56

SHA512
5bef3b712e8236bc94628700426f40bcc656f05aeceb53460747267f1fd35763bc567e9ff56e6b69c68b8225a66c162985d3e9f943563c67992b72fc244d74a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6f6ad6904a986376e052d28a3b2d8e0

SHA1
a5f9011d5c70877f64a007fbc5c906381e21fe0f

SHA256
7c70d8b754761049024b677d3355ddaad9407969b0f6e1ee6b1d7d6225fcb0d9

SHA512
872c7da727ae5d4009dfb01ee74d78b4db4f6b517429b353555b8c9752359f7ff6227dc8c29495a5a6a409a69c3406ccd96018452f20a4700864745f5a1cc0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9391d297f54ece9d578728c69010332c

SHA1
cb77b79d645baaf0df7b1c4d10f58dc2b86e37a7

SHA256
0885c75898d93c13799b0c527970a44b6aa6069a7dadfe5971cff635305c6952

SHA512
49d998074663640812c2b893ab0dfe1153d4a741321d09de851cf610dd89bc4e9358064bcb38c6cf77c984881c3755275a207f319f2bd01cab253eb424c82d96

Download Submit