7415623e82ca0acf8195cb33ad9103b15612289940a50010f757d70f22776dd9

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fae243328c30d4ef0258c770e011b21c.html
Size

46KB
MD5

fae243328c30d4ef0258c770e011b21c
SHA1

f58e029ffc15a5d88bc6ccf404225d1752b37400
SHA256

7415623e82ca0acf8195cb33ad9103b15612289940a50010f757d70f22776dd9
SHA512

533dcf46b4d5a802912cfe3e14d244f944844d976ee8eb42f769c3510e75e3f1b0af5de110f351c500c7d2f43a31c917fee5573d5fc75daf6e42eae62ce64c90
SSDEEP

384:yd+qti0VuZKuDXRU31nahV8f8k5yPTwOwnyYtK9z079991p4KNFc4ZP13DCk90pd:rr027m1nahVtFdF0Er

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a360ac1cff341b75bf7af97c188db00efa1599a23e6063d1e0314acfba2a1db7000000000e80000000020000200000002dfa35e342f2f4eb66ed8618b245bbbe4bd5cde71e22b2bb7a7c54e45c39218e2000000055343471f09da2e8d36effd575c9dd5f9ce73bef5f7a6c00bdb827e0ba6da018400000009cc68b2ed967c2f1452c5bbe0f2f343527bb4e374a426229b8a70b086cd3f6a1529ab9dea5cdbbeaff278f40b7b0627ca7bdfed264e71f16ef095854a9c58951	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a3e5d04f3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB1F6431-AA42-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c2c997fb4c46bc04e9c70bf8c9fa36271f1193edf438af6f3a56bc35e5eb1eeb000000000e80000000020000200000000ac3747c103610e197c96641496a2c26b50cf0ec1a092d7c61166a57da2818619000000057ab20bd82791e1652e6e0738891e67f58078be66dfaf2180a61b2d0727ee8ae17e0deaded1409b76fce239e13b0427a41f6e50019d61f8327589501c4da0e1d7a41e4fb0e82a958beace08e4a145c8e59570bf244c14747042de6b6a43bdd7eec3e64832fc360b29014138423cb09626b2f754f47ccbf849461b0767d3fd1ab2b0f962ec5e2419439cf7dc7233cb70440000000d860cfe1ed631fffcc8d58769cc0b9aae92de3eb9104d8a7e805af020508808d97fd0fdac44ab0eb5696ac6af04ebbf02968c19038a8e5d1c053f0fbf91b5ec2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410453385"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2680	2156	iexplore.exe	16
PID 2156 wrote to memory of 2680	2156	iexplore.exe	16
PID 2156 wrote to memory of 2680	2156	iexplore.exe	16
PID 2156 wrote to memory of 2680	2156	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fae243328c30d4ef0258c770e011b21c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ae6d0f96e8e6205ffaf57f90738b4be

SHA1
264ad637b85295913aea57a5491587b5fc50ce09

SHA256
e8730dc5866f84f577100f0648b8f164dee0500310bde7e369a7e76c25019718

SHA512
3dafdd88b1cd183d47b606ec54bbd2140084815f350198f907e53362f5bb0854fba72a2f77a393545b4fd5105b34168ca9b1de639c75c8ee5bd687b2de8750a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
963703c28ada45fb1d426a17e91b3aec

SHA1
ffa8a14c164fbbd4dadc9a1266a3617f18f8c8a7

SHA256
3738bd4b593b6b0534e2bb1ca3454a960bf71cffe3d22f071545e02f305aa394

SHA512
90af15b0dacd87019a19dbb1c4564140188b94708eb4d24fca2ca93b94e7f24ed8b3c76d1d89763f35ec84181c55e9be33d9d0d22730ef604b802a802c93e317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505509feb5c6ac2b24e71fe74861fbc9

SHA1
85ad80286019106b39fac390bb08a64c9cd2d1af

SHA256
3f543ec80fbd147b52dcd394c76c99445efc0a541b5c373ac64fd0aae2b9be50

SHA512
916274bab9562c7223a46e84eed55ba3bc0b9a683b2b82afc728d0dea5c17ea2d9e717de84895cd257a896bbef9b19f9165ef430f50790290c6d65034bf62308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2999da8e4ab91af72dc391cf7ffc063b

SHA1
e8fea431e36fd0038637ce48836bd76d812dc47c

SHA256
2c611b41859e69db88758fc24526fb01c4e1089cb9b7ff254c0013a6468ed3db

SHA512
5c4b768b4ef170cacb4d296798e07f93e8056f5f15e83b7c19c2f84406e648801e37fcf4702f3d26a67fc1c87c9e61cb6f13ef623921044766c68c68e5b8af03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
926a5f9a6da0fbc3580b79f8f59c56f0

SHA1
2fff0b5fee68d368cf4e0a8581d6de2044b01615

SHA256
f12f05e18b76e3ee55de70f269e1f94cbce6f43f1667932049dd8d51dc35c373

SHA512
0d300cf384ff28c56b7acbf00fd9d3b60d9e5a0db585f984e940a7d34cedff4fe91538bf62ced08dfc217d5f033e2d6cfcc006120e5e7b0cbb1ece0ad0252eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
950be92c6ec3d8a1b8200fc4927b43f0

SHA1
5156809e696cd587bd19c7bf3c3953b390b16983

SHA256
23374b80f65e8eb519450c3e05d78609e05f5f68172f8e13401ea27f2d63f27e

SHA512
8064aa1d7940252ce32a18c11fdd3babab5b540de72ba7dbbc8d8facea8a3a662105426d946d2111ca733a15e875c4f539916b301228c235218f1d8393913204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
690b73fa4173c660bb3fd5babdee98b9

SHA1
9aa1b18d809e183b0c476f154f169390f144a99b

SHA256
7d067fecb9cf7099eabcbe52b28815df838017f7f0da11809cd3c58b8fa1384b

SHA512
2f92fcd74cb317d990a8c1b4c0dec8889092109bf66a3aa167c5a9273a8359aa333729dd27c2b19b7d8dc36e54c70056da9fd3587771e1fdfd4dc60ea85ec30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00d3e122a4fe03fcf7fc1dd0a397ea66

SHA1
144f01d93c23decc62abe72e6ae226cffbb269ac

SHA256
0e3a40a1a434f5b8a5e40bd8e48a3eb2be1767d1ce24be91f6cd98bc5da620e8

SHA512
a4cbc3e03f58274f0cca405229ffadcdf953d137c685a20f9815e12f101545c254626c958d5269571d553fb22a48aaa2806594621a00d52869eed80f0194186e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4cf64ee046219071ac93b8cc30e367b

SHA1
ee1537da921fd000f29db4f5695e6c3236d2aedc

SHA256
4087a39b33b922c8fb6a9829a7f6d3d7596f40fcd7ed4d6a8e09843b11da9fe3

SHA512
cddcb3340718513575bd21061c10bef40e0a9bb3c378cfc955823b320592aa4e9bb70a789760f28a918c86e4f4b3326f725e731629c42126c17a2f016fbb765f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C39.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E6D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit