d7502cc526b2445ad5f376b2fadb0015e1cd88d7052156727edabc7628b4a295

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fda882c42b8b51628643ffe984aa1751.html
Size

10KB
MD5

fda882c42b8b51628643ffe984aa1751
SHA1

c094127ddb479a2a8db06432e4e40e6c2a7c56ad
SHA256

d7502cc526b2445ad5f376b2fadb0015e1cd88d7052156727edabc7628b4a295
SHA512

28cf054c0c81c4e8b447f631745b41350c5e6c0db1d365b0df3a66241ae65a8724ac30114552f89d4d84ec199d6cdf717f71e03b4703362b271995b2d884d78d
SSDEEP

192:ln8uqnGDSSW0nqKsY/WMGONouOF19x2GhGE7CyXyGUy2RttKX2J1b5OPLGM325lI:ln8uqnGDnW0qKsY/WMGONouOFLx2GYWP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f3b2c6603eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000de25a7ea0ce42a0e5a42d7db2618809d88fab233924e299958346a93187702a0000000000e800000000200002000000022ac70134e17a70a42cedbac65090d00b6ee52a694d66704a56b87154554233f2000000086ba8f1de879d38e27cb6e3aa9640bcdcb61fe562a0c9a9376997b36df6e73fd40000000301783463728d01743093640dd2fa8a9889710079f9721785a70fb57a4802dcce169a32427403e3ac3805502f9a1ac296ab71c33c5b34eea60b9be46d60d1a86	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE433511-AA53-11EE-8FC2-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410460643"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000075c271ee7e8ca24615145b01674ef85970bed125cf107bfc2b218a927c78f7de000000000e8000000002000020000000143947233496c5d9b75e12c3a348fb2b5a1027c02b8496024a9d258867ab03869000000068f209df7bf063edab6ebeb928a626d3a34240f7b77aabaab24423917d6e66e999fcc3dcb0117d28638da865904ff64ebdc388991aa5d619b566cc047677a7d43e74e1d2fecb05294dc238228943c2b7a4f15d8544d93d2cba80b365617ac3bc102e0b0d70f3fe089384c92529e511fca457013f7d7a957c12197ffb6e6d3e119834fd6dc148050ef0fc6666a49bda6c400000000b44448742a6c1e3841bf4cbc3c0026953774f67751e841affa0378218635df5c2d1591fc00c7efe4a912517d390c584b57074fec8ad6228816a6e5e8c69232d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2800	iexplore.exe
2800	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 3044	2800	iexplore.exe	16
PID 2800 wrote to memory of 3044	2800	iexplore.exe	16
PID 2800 wrote to memory of 3044	2800	iexplore.exe	16
PID 2800 wrote to memory of 3044	2800	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fda882c42b8b51628643ffe984aa1751.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aec4be6ff0563f9d7416f073628b7cf1

SHA1
61f63d279a03cc00ac37c5a98bd70a5b2e0a3dc8

SHA256
9ace2f3c040d3efd55b7d630bf32c6493f2f76c4cec900f03e64379ecc240053

SHA512
5540f25410feb3765245ecbefca7137c1b87e5d019bfbbf48cd7f10f1bd4a9b03641bac4d105bfa602a02889b6eca24a4e2dac49164fddd0c564a2770b14d370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dc00e24ebc2b01b2e7b64d364e81d40

SHA1
345258f61762f40d64d77d6200e0b989bea45709

SHA256
f76e467671005498e8c4d777ade23c2a3624173dd05f09d6aaed26fdff3778b8

SHA512
82e69092436ab242c5ea26787e2722582d73da9b54710ad6759a4664d83605229d9f2844d429f90bee73501260698bd24065d531e52fde535e385a41f97f59c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a65bcb64446c0f4081f0e0427a6660d4

SHA1
cab61ce699b929fc6e497b37b9997c04ff5eafba

SHA256
8b40bfaee5e719ebbe3eea3f7d10ff367dd2c930d21e097602d80e8435b285a9

SHA512
775b6e7f6f0e0b1cffb6865d1ce3f4afdc2c39fddfb20c18fe730396e427f8754342b78ccd77717d695a9feef3dbb4255c1a07bdf599fd96865be07814567f4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77459607f7d503e11cfc2b70101ca622

SHA1
b7faa0dcd14625e8c912156c853553c8bbbcaef2

SHA256
aea57f1596a15e0e9044e58a0f76f8df712b62199ad0c55ed4b7f0180c4dbaac

SHA512
95b45dc524dffb0e3226b7f5e94fc31a3697d93faf8ae1dd8c62601704f4b8905378adaf1f55322690438daef818cfd330bf89f721bba36fad01f471636b1676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a856324716abada3dee95f272971498

SHA1
7bb3d46db797a23adcb060ac858c2278e7c10513

SHA256
19d44312380b71ff3677a59679d00c8dcb58e1ec641dfd42b8199606b7ba150b

SHA512
1ef7bfb8f9b7b45a574f68d3ba32aba2f914c6ba9ae7f5d0f6d505492aeeec887a9f4e4a78086e503e22d2fd343006d3b0fb6097cbb370a0e8046a0ccdeb8be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ff928a47bd1e140e43f85321314d4b

SHA1
bf7ee5faef50372a634bea3d2ee603e19cd28fe7

SHA256
e4837fcbe1b35519b54118640968510e6833d0beef8ddd0baa485c153d93fffd

SHA512
4218dc32438069d23c8fb150a0416422b5e7b4551d54d4d7e6528d1f98da49d1c67cc7121b0840bd1a7f84d6cc7d1868ae7db0d1dbb4a705ac8f98095f70be1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57e1b499333deda49071060a9d79ae7

SHA1
2e3ad3cb696aa96ff95b96510921cc30d692941b

SHA256
55e72c567f23eb2b5ce2141902cc569d5457d158d85755918e79b7a8c67c5fdd

SHA512
3c24165b73a2034eb4372585620f8cffe3fe961003d84dfb693b7371b794c0e7597d53f68625b1bf6ccd80c442e2292e0659355f89ba5379bce7e34961962cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc5b67dce0fe75545bde235a6020262b

SHA1
45e206d90ebb35f7ed94fad0150dfe998e770b78

SHA256
0fadff2feafebc2240d04042cc2c2afc49d3e53be6b72816b2c00798731d2566

SHA512
770cad654d4943d370f7b1eb02871e35cfaeb8ec903e1d500df0217fcbcab5fd2bb6f2b3ca3f29050df6f9b62a61576bdad0e0b0ba7ad8de2b122a92f0c0e6e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92ed4437ae77ef63aca19e96a2bac8f7

SHA1
ce372b62bb7a174fb78c9c29f86ee92aab195078

SHA256
4cb2fe6700ac510465db1d0c9e2cebf844e47986b4ce853f710131d7d013b594

SHA512
c1d613954bd7d55d090fe2b9a1b34f1a76e999a51470d800b22d719f0a40d640e408756f01cf29f6d075e88d97f4a6a5ee758cc5bd5ad62f98a29220ed338cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar87DA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit