9ec4195e53ea0aab99107c50585e4be8dca2a26cb17357f95f35967677212a9c

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c1f2ea26be061149f9db5942bf0cfb4.html
Size

25KB
MD5

7c1f2ea26be061149f9db5942bf0cfb4
SHA1

373a4459f6cbe238f1e9acf4f087c3679fd07b26
SHA256

9ec4195e53ea0aab99107c50585e4be8dca2a26cb17357f95f35967677212a9c
SHA512

5c4de0400c246a01b937f4bd2e07698ef4281fc80f29ab98ab25fe626fb4b681aa5003830d5e73dc1de9eb0d132eafb628c6864fa1935a6bd15245a05462170e
SSDEEP

384:Adg2H8o8wGwbQTaOUtxKTeBfKTpE3vysJ22LgWQQ/U4yhoy7jfIWrYc51IlSAuVS:Kg2Hl8sxltITe0yfPJNG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000037763b50063f964ef8dac3e6b51b316b0fc7eb6a3f173364deac341e690dd49b000000000e8000000002000020000000b32261c04241c60c913f2902f8371b88958c5f8bb0dbbe8f232a3b995f412b9f900000008af2a58ce33412f95f3f17fe889a650c60059767269fee0d9befae406a34b05eaedb6db957979b092f4e430839eaa2e7c42f58c945f295893355bdfccb107e6de7376761394141c3c3a0b07f063f3630bf9903cd82f01ddc6b2348e5c2b6bc5cb978366ad564e9b086efed96c51ef0ddfd7e2cf30e8d6ef60d3375ba677a67f18e5842cce368c65fbea4e8dc9074c60d400000003daa64c892f1d09ac03782561a6f5f860a2093169ff5f2ae01d37510814253810b511f19f85dd43c898537e464a56079608dc7022997db8e7ff42d1260b468f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBAE4281-A53C-11EE-A00E-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409900974"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000dd75690f9f83c28b14313c7dd9bc3267897ce770b8f7f03ade783766b666cf9a000000000e8000000002000020000000437f0c24285c12c0ffb662d61e3c591e61086d0651feb1d9afee73caa542498a20000000fb7279d064ec3a7fe21139a8ef115e96ce8da4c5ea70d7ad7a4c5c49c59e8d6f40000000eb507c43bcb6fc242a7c9cc4a1b10a7e6f76a278247c2563c3859fdb591786842b86cfab119dc8ae4a8fa2ba6f9b48695c6230f4e84515cb57463c0d7efd4c81	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0094bca04939da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3036	3016	iexplore.exe	28
PID 3016 wrote to memory of 3036	3016	iexplore.exe	28
PID 3016 wrote to memory of 3036	3016	iexplore.exe	28
PID 3016 wrote to memory of 3036	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c1f2ea26be061149f9db5942bf0cfb4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8558ef95cfc23a503e29643d0975606b

SHA1
6ce2c51ec051e381825f55fbb8b75dc3d5301854

SHA256
f050c884b0f5fd7a27376880edaff5c4dbf8380f1a93bfa4f587d6c0486ca4cc

SHA512
524ec43ea3fff73ec90638fa4857180bab53733e1e3e24d6b6075b71cd973ca7142c8a5a8c2d913e2fc632b74afad3150110fd024cc69f0f99794d7dd4aecbba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc86cb4f63025ae8f130a09c2dbe2f5d

SHA1
370ec96b1ad83451cf6ac5e32720eac74990e703

SHA256
03ca0fc6f4bfc16af11072e7218dcde7c1405776bc39dfab770671891c6e62a2

SHA512
f40f84e118b307c22ad967440b92e0c94a2044cd91355122d97cd84f15b83e55825d5b25164abc9dbdf086b54834a2bc71255d44b4782365278bdb40d34ab393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24d06cd39ce4032999d2bae0a05d78ce

SHA1
69c529e4b6a2e66a2bf57fc90323dca3adcd5e72

SHA256
aeddf767ef9e843e085fdd085db66c2b486a61785ae737aaf5799169856015bc

SHA512
23d55c074c32981549f16f0f169c6cc340650e4d0cc3f3c6a6884b04ea523027e3721deb1983bef7f3f4e9b4c9920a070c5756111d2282a32d67d1542a2b73ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d14afc7dc5e83a8bb35fbdd669cb23de

SHA1
92b5933cbab901d9e1adc71138ed29da7459762b

SHA256
db92f0c74dcb2de5ab3d9826b6766fd91215317fa25f8b6f86be066eff164d68

SHA512
4bf1cfe4f5f6df5b36b58b2e79bad10a497813a4af36a478bfbcd3f2d7ba11e9b51ee25ddce13c2f1f259d7ae668969a52b85f30a3224e31a5f34d66a90a879d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc6356c4810b3590cf4f8959f60fbd24

SHA1
ea16070311b4abc30af1b9903ef9b56b77bb2ebe

SHA256
d2c1d0bb8f864f4e4a3e53afe066e09dff97ba4349ff90752f14fe2fed17f129

SHA512
e7520927955ed145a386c1d7bf7ce579829c0f71ef5c6092734665939f7ec51804f564dd8032763c32ccdb5b9c72b69d7efc980058f5e096937d1deecfddb7f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3215a486a242f2b33c7fe08867acbef

SHA1
0a6deedb41152c265e3c7d343f0bdb3a8b2b6667

SHA256
03f3d6f312e2257805c5dff9009d8ce06d0c53bbf5eaf4fc5347a795116323dc

SHA512
963c9d00d4b61cebfdfc69c8b0c71f068e87fc21e684395aa1ff22595b50b34c7d09465856a33dcaf87bcbf72b968ce6de56e1dd2db7ff68c2220c2d4ddefdbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e342402de40735eeca091731ed5cae74

SHA1
72243d3bcb086bc47089797e919257a9170ff489

SHA256
13223c310a78458577f13505cb4fca82f3c43e68044bd458b7f482bf7ac834a1

SHA512
1b9958a7eacb81fd05d934d81af37363ce02c9ccf4d3816d4ac9c19e5ba5859767500f17e1dde0dc08fb1d40460276c8079756172f31ae954833122bf6a1f759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e68e0861b1db7de1fdef656bee28c9c5

SHA1
3a783a23def1d216a7c2612a9f629e6ab9e2f626

SHA256
260814ea0032b65e795eb7672ef4d57e9b37152629985072a89a112d80c46497

SHA512
7e5087424a71b494caf9d246a81bf03cf26805fe9fd1d3ab4049b983a5cef6cdb135622df290175f023660ea078e52b19d6166265c8b5ffb8eb1482ed50d3ecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dca014414dc9b1ea45df5a155cb64cf

SHA1
25d3732e778328ee1d2243db9afb81ed96cf1824

SHA256
4ec7abe76dc0aeec9d2e3985ee8d43221ad6e8ab92b51e281e9ba30a173d8566

SHA512
95ae61dfdb83ecd1597f53c8cdb3df158e750af091c3d32c34fcd40560df6c22c79641f5e517fa6ea5b9fc9d11d8f4c17b9f75b38bc0cf9555f454b23b06d6e5

Download Submit