a0f107229799926ed7d41291223350cd28114a53d0f69445e99cc84fda51effd

Analysis

max time kernel
118s
max time network
161s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ce043b2e3b712a9f9576f8328f719b3.html
Size

13KB
MD5

7ce043b2e3b712a9f9576f8328f719b3
SHA1

b5c62b34903524de8d41b5232ce0a01d6371172c
SHA256

a0f107229799926ed7d41291223350cd28114a53d0f69445e99cc84fda51effd
SHA512

dc6f22b58e39c860b3ffb665120bfeafb93460bb4a46de116a63a17292b410f2b21c7f860e7ddb7ebb84806e7f4d8047ff0dfc6374239e8f8027bef481bbe826
SSDEEP

192:+ch1ZhbmsWEMc8XeDxp4h+2AaobUAbyuUTvIV3sq+W4vzaQbY68I5rQbY68I5+:+cvMdXeNpk6bfsTa8vWmuC8aC8F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006ca2fc8714a1df7aa445a8bc704d45496f02e10cb5a7f70654295db54a2569cd000000000e80000000020000200000008e82198d6de067ae7d84638fd603491745d993c2996c753e5767ca6bd75adec9200000003603dd998d20c33e60c5dd2228740b8f7cdc95c1ee556443220b40fd2c2d19194000000026a8a91a67dc1501a7ff47b87705e98931e760f13ec0a5f5c0a813044fcf143d010d1a9f8a453d5296f072c45043481f339225a3b7e00fd45ffad3ec6e7e79cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D14C3FF1-A53F-11EE-AD67-62DD1C0ECF51} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e0c27936f906d24884efd3bc07e5a3bdda84459f26d33e0ddc206004a0b3d528000000000e8000000002000020000000718b1953b15403324d6ed4d8035596a5147d74a3ff3794ed021d2a6c27e1398090000000615ca366473f6069bfcfdffc363cef8573ffec6d271eacd0da08e2e0dd9089d4d774f90f31d630094308e84215b2f1b2917831bccccf8e25df898ab420911c5edd6085f93e206c627f77b5e161dd328012a13def5dfc721b2368bc5d4faba171eba7d41aee472479da6b45450f5ddaa9fd5aefec07652e3f8d4be94d7c37c70104a5eed40752f7e4e0af77605fa7834240000000ac6a4ca69289a0d720a1c1a43834f1dff8a3d3abed6786a5f413547b60345add5621c69b4c39e373c644b04db39b7996d09bfe311f6d72b00d14772d60aa3531	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0751ea74c39da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409902274"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2252	3068	iexplore.exe	28
PID 3068 wrote to memory of 2252	3068	iexplore.exe	28
PID 3068 wrote to memory of 2252	3068	iexplore.exe	28
PID 3068 wrote to memory of 2252	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ce043b2e3b712a9f9576f8328f719b3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c2f2f4f0b12a3a0568e63c78cca440c

SHA1
3c89d02ad6dafcee2f568259661762ef19bf6b7f

SHA256
26235c631108ee4429ccc4827601112886b496b7795a878bc2735ef25a88733d

SHA512
385ce693969d2ea1e5a41cdcffc2c482d563f4349de8dfe1cd7becddb588569beb13f5cad7e399fedccfdce917f4171bec5086884acab1fb24e3b33ae9ea7db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307351993c8ffa4fe48bc776ae92e9ba

SHA1
8a1f3970760de9c00dcbd9f92f3bc4d9e109d77b

SHA256
cb5d3b28078b64618251eaf2adfc49f4364504f5ba687adbce28b42c3152e4d6

SHA512
39f096bc910ce5fd3a68317debd4240aa69a99288ef16aa1ece84286a7eb21f6b81262f590ed929df0f6cc64f4090c04bde7189a317ac6044b6969b997fdcad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1649ebe9b4b817181c32dd4e49000818

SHA1
db49dd3811fb6a34ce207f6a783bd56b6a308f0e

SHA256
9ff58dbbb834e4339cb80abac3d900536858a4a394eaecfbc2f890bcd53f6556

SHA512
392bfb8619ac00c06ab03694f6a57dd3ebc0f053de9ecd59aa383fe6fa10e5f9c6ce143d9fe567f3e3af63948250bd0d161f58f6ce8064881467d3686820ea50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3c6e126930bd2fb884fd50b58bc0643

SHA1
d9cc16e3d5271662a014f5c83ab33d030ee037b5

SHA256
0d2262f1baa8d79da9b7df7ef46f4bfce19b94df86d5e9b333ff0868f3550aac

SHA512
51ed3c0cb511b22227d023ca36fc05890bad9e7cb77b65c1ee70d230b3dc87093ee6dc95dc0798d29992240780e36355f9bf03f6960e9a2bf16ef0608c7ef554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9539e4f5bd46d8eb5c0166793eb18b78

SHA1
d1d160bcf7bbecb307d226e8387921fb589caf0a

SHA256
76ad231cdd1b687b52f207ebc9d261c0ac943f6d6acfb033cbba84eadc0c6f01

SHA512
5cff1975e8208f2d3ef55a9d4e5d5aceb9cccf8c9bd99e8e6e2b885b4045301c3fc76822bb7bfb27c63afea5105f213040c7949558da564481a359eef17153e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b46ba926596f87477f0ac647384ebfa

SHA1
9f6a682dfb22df3c3e2740a0b0409635d583048f

SHA256
d308ab12f39eb9aeca8ce87c58d05324fa313ee3641b859f0aebf5611756c7a9

SHA512
fe51836a859f351428a4e449697aabceb14b3121e78614c834fba15ac3f015bd5e19690d80360c4da07ae9c377d8a953d3a81716bb3c5381321ca5c21106ec80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f9fc81791a4d0f2aef2d02a85a21b25

SHA1
e953bb146607c2434255a2ff71e69d9847c7e09d

SHA256
5565e1f62cff07cfa01f93487fd74f4ea5f82e387492e37bc0b8eabc5146be90

SHA512
c6fc9e518fed90d2e08d6c62beaf89e9042004c75d1c1d1647defa3a6c3b11903be4152a418ba52e33be065bef8d9da06c5714fc128d771cadd7aeb7a84754b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55278af769e320d7e70de8d6c4f14b3c

SHA1
fa4da0c959f533657ed8a22f635816afe9a3f14e

SHA256
31a52231eca1189bb93ce64e4b1d3c53dc50309e823cd149390d59aabcfdee19

SHA512
01e88ff9b729d44946209b2b6b30f4ec117fcfa5e9d2106734f6731f478937c3f90b926e9c21fb6eb21740dd78ecd51b94c612b147e15cae6c5b5fde04ee6040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9af35281489168931a8532b7c8805f9

SHA1
2b8399604b45c9d3f9683237b5f415d76186427b

SHA256
c09e4ee5c2702ee6c180b6ee53c065c785c1ebb0ee815ee965b55528c619de24

SHA512
c2714357658b2a5e7f1fa970ef3c57538c1f8cbe68ed38fb6c7656b7616fb0f893a05d75d3e67f1f339deabb25efd865282ab7a7949dacf695e8518992ef8147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a5d95280f1e04078e8e3920838103e

SHA1
e4a52311393f8650cbeb133ff32484b38e3d7303

SHA256
d83952c49d702ed7bffa992e11e254093587fae13cd1abfda5c8a0ad13332cd5

SHA512
676a9082cf6efd4a635bbf243fb07777314fb0cd5a4fa62f7727e131c1db9dbf4f99098f998027ca81f5d500996f01614391a7f2cc09aafe410b52f7c7fffa49

Download Submit