e1408ed5576e5021364bd0cc4418ac4e57dc2ab089d3b93f6f5d48024f3abdb8

Analysis

max time kernel
124s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe3f1d65ea8d3cf6937977d8d3a51422.html
Size

23KB
MD5

fe3f1d65ea8d3cf6937977d8d3a51422
SHA1

6b66dd78ea2a4e499f5daff85d886a446ecd941a
SHA256

e1408ed5576e5021364bd0cc4418ac4e57dc2ab089d3b93f6f5d48024f3abdb8
SHA512

3238f3cb03becf14bf39c66806f9845b4d0388348bf95b84acf8301277eac75a9a1f191d5125d75922a97c0e24b65c203b161cd4785575bcc2da5f90d6a784d1
SSDEEP

384:eu6mK+o0lNWsdgP1KXfblbYITH0zhDL4CG0ekLFKe8dp+JkI8L:9lSPGJUzzhH43jIFL8dp4eL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E747AC61-AF3D-11EE-89A8-464D43A133DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411000963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1764	iexplore.exe
1764	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2216	1764	iexplore.exe	24
PID 1764 wrote to memory of 2216	1764	iexplore.exe	24
PID 1764 wrote to memory of 2216	1764	iexplore.exe	24
PID 1764 wrote to memory of 2216	1764	iexplore.exe	24

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe3f1d65ea8d3cf6937977d8d3a51422.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc525f823577adb939e311ae49168a3

SHA1
370e8b119ecb7b0c0f7e9be5af68c6e0bd993e7f

SHA256
71a7adbcc13340ed0c0168bfe4dce35e65d1d64b66e4dce75e83121faee4ad58

SHA512
dbd801c8601901042c08ef365d044ae7f700f58f6e8e3916842205f15e651f36b3a1e5e50bfa9631ac1557463df5ac8cb80004772d0721d2925a8fbdfeb50137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5f10d09c28df06317eeb5bd62f9dcd7

SHA1
9702eac593a3211433279ef4893ab04e70e98f43

SHA256
7b8dd4a33b830110e53a76dad9489fd3c57736a73cb6935685d8da7a5f33c3c1

SHA512
177066a2e79e2fcdbabe0a4a7f945b1224f420820ae5a09185c0e31a1c83ede99628b6dc3ac7c6cdbc2ad6222aa013c53da319f526e1295ec4e0ba5be4ff3fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b9bd7126c597fc5ff26955f56c8a54a

SHA1
7befb4d0551a805ad37369fa3c54b217123051bc

SHA256
dc56b800a3377609b6cadaddf37865ef828cee9772aa91beab2948f57eb0dc36

SHA512
9e1dad535af773de66398ba52e9d9efe48643feee39a8c64efcb07682b40cc810dd48a4fe794f8bbfa90f8bf9353182925c22108d0beb61ced4a278665da57b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0caa4d9e8abb155d74b89a79da8f77d

SHA1
1dc2e11b3a0f79f6182fd788a858e5563fb8c8d3

SHA256
c8364b19a80bf827994ae273cbb59a64464bedbba119bb436cb0c21746cc2f96

SHA512
f190c69002bae20287abdb8dcd6196b47a3156a1a252478588365c307dae110312d46fa7671decd19d5aa8969fe9a682b1077d07e5760d2f93e2dea4091acfce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d546764c51cd8e7761aeaba1776c94a

SHA1
fda062fd944e7f145fe071baf7a0536aa8b22256

SHA256
626f69b6aa63f3f72389f889273350262c2ac9ec7bcaae00d7bdcda4249632c2

SHA512
05ed7acf6f2af99d785e87c851ed6908af5ce4e8fb20010a76b3675168fa6c08df4db046333916ff804322223913d930279bb615441cf236381b77d97325062a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077df0eedf3897604a33cbb537237b89

SHA1
c07114b9d719aa16cba414bae50e9122fa5384ba

SHA256
9b2c41440211645e9d13834ee3567b1334f81d59e92425cb7a299043998c3154

SHA512
c4784d08fabf1be8bc7ee6bc6a187bd04e505c8995e618e76d747d306b3fb76001affca651581d9c7984e1f4cae8522cd0321a514e5ec8798f9889da80751203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eba32b880d9a8c80a8bd8bd00254b30

SHA1
d967d81b48dfc467a0ed1c18690d21970365f94d

SHA256
8944246363d2cf08af5bacaf4d0d7d7b323f67282470f03b3ae4dd1bd8f38eca

SHA512
1cdf05e07d37c8ba7da7e58b44123eaa87a9e8c4a6ed4098a10ad18098a2aa5a109542a83842ab2a9fbae376aec38a8b2ed4811d1449b72b970f331d4ef14d2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9602131204c91c8500534ec5a64fbab0

SHA1
640b7712dc97848075f2d68baf24b41d4c3c9683

SHA256
2cfeaa91f16e4b2128aba8d9b13a2accebe6842558791c85b886ed75dd60de99

SHA512
c5de48567c04e3093f1ef706b79d42577219daa624314b2aeead92abfc64221db83cc61041e49f52dc76b32d1502c35947ef01b953bd3bf67cc78bdec1447f91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c083ff5e7168ec48bacbdb74426f8d1

SHA1
5d0e565a3ba0795d555747de82882d730663cb12

SHA256
b4593af0c540e1ee5e862431fe7b22d5e7505d00bc13ef209ac05207413ff78c

SHA512
4a8bbe20df7373d77db6ba44416845680c687531f09aba5bddf4a492bed5bc168c89c86ebd6bb82e0ce7147a35cf5317c70b83ea017c8ca80ae669bc276eb3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B19.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit