e03cf1273ad385f633a6a9ecfcd009ab331f9a703b7b360be2f3c5c819262433

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7729e0b40ad916e6160c41a372122bd8.html
Size

6KB
MD5

7729e0b40ad916e6160c41a372122bd8
SHA1

bcb216934284b06d5a14db994783c465f81ba7c4
SHA256

e03cf1273ad385f633a6a9ecfcd009ab331f9a703b7b360be2f3c5c819262433
SHA512

a0106922f3396085e7f3f01c2a721da98caa1e6896443d57da5b0f3664edee9d9696d196d17f176e82c8a57270a0210ff67f26afca02349ca214fb8f06576094
SSDEEP

96:uzVs+ux7ciLLY1k9o84d12ef7CSTUaLcEZ7ru7f:csz7ciAYS/bb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bb88916821ddb1ca734d8a5274c037bbf5bba8bba36d0aad3498ce8abda0f1d5000000000e8000000002000020000000a4432e5a991a1bfc7ad1130f07fab39b2a4a028f58ae81a54b53869d850272762000000081f751e33ec7a39bdcfce5a52a8dbdf74d43bfaa2b74c3a49cb094c753f08c334000000045e3e47ab3b21ac87a51b289beb2bf26f4e9eefa3ff8f50fd725eed5f281dd601bb6c666660c9784e0aa48badc053efbc5ea3cfcbd6bc152173e68f9e5f7765b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7C8C671-A527-11EE-868E-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409892027"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0fd1cce3439da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000362c8bdc708bea886eb362bb5cdab4be5ccfd2f4ab82845cd2f9456841629b98000000000e80000000020000200000004f7ca452ab0c2139a59fe1a91fdba8dffb9acce67a0856a480a3af751c1783a59000000074de7a3b4237f382fdee58940c1eaf86c06174b8fd3d15ab3412af02b2aa363e5fb3d8ce971d5bc430f4c39e010cd32fa73f1e3e8a0acbd651d7bb222146be93d5bbd1a63fff1c4249c6650f6ed56872718926759029b7e69f02edb3ca5f8e598d5c19eb2e077a1562e7b994f6a9b7429684669e6fd91a0a1c3c7e25eccdcc9e15acf686c4e0fe45e556b5c2f5389274400000009c8d0f4a39b9040aec0ae56f366fd0e569a06425a04a16800e00b3463039a44344a2acf0bd7d8af8e5e3b813f3544dd2ec39d6d8d67609d0b277c640c8405fea	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2648	1220	iexplore.exe	20
PID 1220 wrote to memory of 2648	1220	iexplore.exe	20
PID 1220 wrote to memory of 2648	1220	iexplore.exe	20
PID 1220 wrote to memory of 2648	1220	iexplore.exe	20

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7729e0b40ad916e6160c41a372122bd8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e56063fc0c8991c0884dac0a4141456e

SHA1
1d44477bfbf1fefb244a5fbf7fc41c471088b43d

SHA256
d9733e2380629d63d7278b1f85352708771925cee9b688c34ccbc94ac8f255f8

SHA512
99d243b6b5f061d433f4757ab2da1bf7cbe3ddf456851debb461b4c7ec0b5db15ee8674246f34195245fb41f391f54f6a288b0317e5419719ff929cdab178ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5d878c541546b98c38e734c8db59144

SHA1
0a99598c1a99d2c814add7fc63bd64080ffee0e6

SHA256
3bd9795ec99d4c1f081327f7a65da58dc313b81c195abf9a064746ef4bec4025

SHA512
5eca17978d0018256ecca3acd7275764bd04ddc64c6fa7d632eb2bf2a4185f94bc768bb20d0601a720319731bdad418edabb2b6a6eb03f7c27944f676d48085b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f535f21ac6da9c8ba9ae2fc4946dbbe

SHA1
713ec9afe7273afe5d4f2b7fd5f62190bc7bd2b7

SHA256
5c0372c46f2f8fd4bf37e4827ac5864cba2113b37c39639239f912726b3b0c01

SHA512
4bf26ae2582046e01ec2775aacc42645ef3c85f55454b55072f739dba20ee90d02cb040ecb717e303bfe3341019216f8de1602f907ef540611edd559d424d768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14faea5e9e217d462870bf4ea0323f41

SHA1
315018c7f669e0f376c87103ac32da46a0ace987

SHA256
b2c00711dedd9d3eefb2f2a6d0e8aa36dd65155703d67c24c7dc1303d4904928

SHA512
888b92009a2e30c761deffb6e2fecd76328e2b21ad0607781d98098f3d44e751583ba1d57fd73bcb4cd9809d4bf5211a205ad9c51da5a333a096e4563ae5d75b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4553b33c4b44b128c383615d533107b

SHA1
13adc70535233364e750b1e53615fe1152594255

SHA256
13798acb66eabc58bf97d5a833f26c004eff2f4c72e3c6b0c87884eafa6099b6

SHA512
cc0e50ca02b193503a3bc4c14ae44edf8a92585c3b0024ea0a1590d7005b7aedf89baf26e032978d716f92ed210b23e3eaf8fed64a71685b01a7495ccff6cee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa0da388c0798cd76458312bd97abba

SHA1
8e269cb419062b7ecdaaa1e28fad607aceed97b0

SHA256
92ee58edda59b5b26fc32b1aab538f242e787879372ef8bcad0722d4e3febd20

SHA512
31108340c0796d4580d5a4717cf519dfbef7087dfd6546cb7ba64b1d1c72b83badc1a8b9c10f1c98857ee10a531afddedbe3c4b40ff7fdf9fa69279d9e18da4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637e263cbb2354a72a83f74fdc9f1d6c

SHA1
3db8da5aea2e297aece0c2ff6795ef66b148371a

SHA256
13fa54170240610c0e61f8c0a450687c6ca05f16108712479c93a9fd1ade15ba

SHA512
3a4b071ccc830f77788150f94982586b355566a117a093c326161555b8dc0917a7bdfeca546d7bd5f50cb08a4d9f96d5eedd0d20cbb080599d2eb76f0d727d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68b8b2e2b22b4ea4cfb31e9cead40457

SHA1
648ff543514128c3a8016bcd92309a9050e93e38

SHA256
9aa4556d21e46e1efb5b95a8252c6fde61c26ab4b891cc2b88a0ee4ff29ea594

SHA512
dc4a400b4dd30d4415dabebd60c77881ac61faa8f520cc4902e4698e9b4253c124a99057f4b8a0985e74f607d10c0c3d547c57bfa86925f7285d4a3fd2dd460e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71ce9eea9ce78a2c1228ba6a5bf70077

SHA1
8b01d79cadd00f7ded308a6e667e2feea2b0b273

SHA256
0bd311052acd7d716ef16ede4716840c07e343a49226fcb732cc743d5ff39cfe

SHA512
ab614230c797252e525216799327337bb26b90c0a1952783ca91f1eb4ff011fe0ea3266060146a979ff43895455615590bf2db28fbbbe2ab10e0fcaa0e654914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b38590c5012ed501de61a10028c3c93

SHA1
ab9846a78494fc1f37148a2edc2befdf37e3ed2d

SHA256
21d4ee24538685eca4e246a229b49ca50a36d8d0a738974f72dc4ec6d19fac9f

SHA512
e614e353006937a46f6ce01ebe781f55c6c87a1ff69eb4fb99b1e7b49eaf30475240e96836c71ad35bd0d89e280e946a40425c56486ca4141e5656ad0ab2f585

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FC2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA74D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit