e2113fced7efbe07372dcfae35a813a86b89f03061364585d122c1d753c1e6e6

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f5e87c06929dd93617373b684f1d5738.html
Size

6KB
MD5

f5e87c06929dd93617373b684f1d5738
SHA1

9b1fb0f2aa7bf25c09f050f7fb3c5ec2703e1543
SHA256

e2113fced7efbe07372dcfae35a813a86b89f03061364585d122c1d753c1e6e6
SHA512

77a7a13ba0adb635681f482022beb1f652270a44900bfe655355c39bb0580982723ec62e06e802fcac10969f13b7852db7364a6845e6f90edcac38474f48fa8b
SSDEEP

96:uzVs+ux7xTLLY1k9o84d12ef7CSTUol/6/NcEZ7ru7f:csz7xTAYS/b4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0011836363eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000065706ff7486a3c582912569f6c7f80fa184bc4e189e0bd62b0abe5898c06d606000000000e80000000020000200000002e1f918051d19568259352655867abc0aa6db5ecc33174163bf25c6f91a4eaf090000000dd1d03e3a2fd2f725ff311deb4d81fecdda77df0a05de5d02266ea9737682d984983082b0ae7f6b9848e5f4392c5908cc4e50dae624284fd3ae768eb2bb5884ce4cca0b19d98aa63e88a5731443d093adc3c54309389e2eb31fe01e83cc16a3f132a191b6b9931ce27204f8c6fbe7fea4433ff92d028dd786ef814848de8e8f51578c27c9651c2b3c7733ac2c09b01de40000000760e768d16d7e33438d0fc10b012aefe0c36ea46a223468e37e168554e43c44aa34189f6f22257579499af6243746bf95f75d8ac5c57dde0619b4f716cb317b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410442342"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43C7D9C1-AA29-11EE-9CB1-72CCAFC2F3F6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002a091b29e981041ad8165421c1370c88364aaa0c703c95d77211391b050fdcb4000000000e80000000020000200000007564e6511a129f1ed464634f0846bda17236765be2b96b05ced169ff223e05dd200000005c5d1055bcabbecce4a3adf9e38583b910a980e44b86e617883beb317291d1374000000082a4bb02b3bd48411a1c8d62e03d58d4de67d39a1e3f20a6834e6c81f8e4a5ecb348e5bcba5929cf3c9ec6fd6a62f86301cb4761715f97fb39d2b26051934a52	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2248	2980	iexplore.exe	28
PID 2980 wrote to memory of 2248	2980	iexplore.exe	28
PID 2980 wrote to memory of 2248	2980	iexplore.exe	28
PID 2980 wrote to memory of 2248	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5e87c06929dd93617373b684f1d5738.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f148e7c7e4a402948da318d3fc75a495

SHA1
a00105ac53d222186b7734e46fa7600b14eaf87c

SHA256
64ec7c07020f1ad7b2a4cb7762b6b73fb7722523075fb7fcf308ff69ff414fc6

SHA512
1cc15e0a94320fed2e7b360c465fd14cf084585c5b64f80456d9f642bb3f7635a4da8ce46baeb0f6bb2c29eb2129bb37922d4f73a16db9fe20d813233e3dba8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d75583b4453b06ccef99d87881d3963a

SHA1
64afe189431bfddea50085aeebce2869516d7daf

SHA256
31d76235604afb1ff1cc4fa2978e1228ac61b3be290a79756c63ff2f8405f363

SHA512
1502330cdce4414f1a93417c1e98c9661e7f04f524f5f795cb87cb20f26a7b0dde5ce300e85283f4c3677b124c9d8873ecd28521e48da8c9c11a48f8efc481cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf206b307e2177291185f788917326b

SHA1
b416fa39ea131b1c7d3df1e0884ba65aac3e318f

SHA256
d22adf33c4a484ac882f3c7b6a0543c504fd5859e64b520c0c7ab32aac6ca9a6

SHA512
e03694b43fb95d7e520db5e014946917952fa72bdd0d7067655dfe2beaf81417a33832e2b8fd29439e71cd33569c3d1b4d9d5541f7d044d9ed3d25a6a6c116c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04fa9c97f18a58cd809096578852292b

SHA1
3f66a5015df8d2b115f154c4a978599d0d05a244

SHA256
2226e23cd92bb07a753e7fa5b335271b5684f5496bdb3d5b0af2ba8309dedf38

SHA512
b70d35397e16cc3c32fe231bebd34cbbd7b97bc280095cea2c9136e63920f2058e229b396edbdbc208b9e1d29118b8ff8222c10535a418a788405f02e5aff4e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abf205aa920616b335fcaa4c1feecb22

SHA1
319d5a6fd416d37dae8b268f1a889986ff179f5b

SHA256
d6f43b0cb830568a543d332d93f28b819745a5b9bb53d363b271d5e510d93cc2

SHA512
76507967f71991703314f5d5ce6f618bae21b71c092672efc78f078454e461676cdbe295796f3ce6360222af98079faf13cfb22c1740a82e437ebc4b92b7a69b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2845255f193119c4d8b8d1f0c16943c3

SHA1
fe7992cce0f0a27c54144c4a60f14627e1f27c60

SHA256
7a0028f8f85b859b93537c5076ab2377d9ed02d3bcac460fe97fa54d1e2d25e7

SHA512
aaa54ba81d6a2bb0d04848ec1423f42645498c316696a0e3f003fb3c4008da7c594b56ebdd4435cf953d7b74c355d2b42ac9a1b5eaab8de07a83bb04f5647d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1e1d464aac6fc9102f48ffcd6b2980b

SHA1
0c9dba2e604a34ff0157078421ba389868e63478

SHA256
0190d89ae5c5a6b6e52d6789a4e61b3d0bf798bb3e324db44aa0d8eeac5b3e47

SHA512
f5c296fe8b1fc8971123dad12aca5b5662cacd481a623aef208b472c9d5f64563db5571586207bee7662cf1d60d8a52400f24a9e1b690d0c029ebc3d8b9ca702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72e54a0399f711b808959388b66ae280

SHA1
bc8fbbc5598e952a134be948dbe1a81e94b7ac12

SHA256
387a9fe3909548261e72afc24bd02f426737ebd29f9a6551e469f2afc7b0065f

SHA512
51dabb61c911fb8e8898a59292d2507b609622b9334f37daaefe33a22f683ddb23da7f3fabb3c5d5fe45d97986209e7f095e51c34e9e38f50b736d157ac268d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit