e988eaa0ecab1434338bb34360f74a4f64ba21b2077f93c2c9e1ae6bba9e5de3

Analysis

max time kernel
147s
max time network
163s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f877d6ae614978ecaa27b703dfb19b0f.html
Size

6KB
MD5

f877d6ae614978ecaa27b703dfb19b0f
SHA1

7b08b3505fc706a407cade0821e14f708c6afb5d
SHA256

e988eaa0ecab1434338bb34360f74a4f64ba21b2077f93c2c9e1ae6bba9e5de3
SHA512

be88e0f9170c452e17c90354113fa3e84334cf69315a6534abeb3ae33b7ee3f15d3327ee9d218be899c8e527354f819f0163de15ed30a9bd5dcff90e5a3f5fc8
SSDEEP

96:uzVs+ux7ryLLY1k9o84d12ef7CSTUrLcEZ7ru7f:csz7ryAYS/Qb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406d4854413eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000005d2633f10975cd59fbb5decd1cb93394709cefb3d81a58c5b39f9d8c1f83391000000000e80000000020000200000006f8b8c56247afcf4dc63fb2f534b32b5f6f95b6a830613503ef884338cb3856e90000000e10de240a32cd67b10c78c7203789a0327b47fcd95ee34cd97b184b6c73c8e3b213da01df30e1ae4b759252830f024e9e12674b281e89719deee53641df6daa21f883de238be128fefaefff51e8db3e6d4c836208ebadc8e7ec78ea042ba4c56912ce4e8741dbd52184b996736a47b501e8bfb01ef0d7e073955cf9e69de1b00afc91c3416b647720ad3893566381eb0400000003bc5a9d2c82b8c01cf636461e26658e5c812fdc8141115dbd8172424bd06ee585526382aa31dc1c7443c333b4b476b3a9ee2cad27a3b2383feae678ace25f323	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000359690cb540d1195b5b9140b92573f672e532cd68ad6b610f33ee203a3ab3863000000000e80000000020000200000007cb2830203bb7b84d3447a616432f6682676a6003d4ee604bd19529ba0759b65200000003173e33ffeeda77ba325dc8106cc577a929a57580ea2df3b7c33787469f17cfe40000000532644930144c12389356a714adaccde199526c7ba601697bce73685a563d2487366921c36ad8ae65c5ea603f646659b6b9f584d1817a6e808caf9fe165acd62	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E69B431-AA34-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410447199"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1104	iexplore.exe
1104	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2080	1104	iexplore.exe	17
PID 1104 wrote to memory of 2080	1104	iexplore.exe	17
PID 1104 wrote to memory of 2080	1104	iexplore.exe	17
PID 1104 wrote to memory of 2080	1104	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f877d6ae614978ecaa27b703dfb19b0f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
886a31868b5b52d9f4570e9a0b868552

SHA1
e4539d8e1fe4fb3553a71c53e76c44ff94ed25a7

SHA256
56880ee8ddfc3b8e2099e939e929707fc862d1c6a47438eb1e924c7e3e29dcfb

SHA512
ce8f87b1360ad15997d29eb796d2dd32ebb0a27cb33828405b0c88cc95572f8dcb212eddd148b19340cdb78bde488a2aba822e92315525d28334989431a65d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02bd40bfc1a165c8bd532c078af0a65d

SHA1
0aa7bdf758cbde20faa15085b79d42b6baf0fb37

SHA256
c7d6f90e866cffd01944936e111bc1d95a77302cbe0cb4bc323914f787fd4eb6

SHA512
72c9452f3b13c67beb9c6dd5529a4f69d8373d0ace82cd49dd036ee511b572931ebaefeea4536ec0755d66fafdca598ec58869508763cc88c740d9436bdf406b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f3858c5d1cdd260f603878b84a0bacd

SHA1
59419e9da83422adc1b0147d03dee14020393614

SHA256
7d968145222b4e7a3c3af9d9c67bdd3ddf17af5bc2dbe8859d4f03dcff61b4e0

SHA512
9b09dcff79a16467df786007368bdc3a3fa7c97be3b1fe31a44bfe14f155eb21871af0711d81fac1bdffae98ad8ff58fb071750b112b7d62d05d9656641d327a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e887e3f6d3b02d6c5a1ea29529dd862

SHA1
109ab4f5db81bde20afaa44c7909c911c8ee4c1b

SHA256
8e8b4c51eac29f0c28c0f14e04aa04f4a310102a9b5de690c8fb6503f3c08e03

SHA512
b97689f836ab9adcc547e3963ed35d3a0759869509e208961da117641069975c8735165dee287c43cb3dad7daf00fccd1e096d5092ccfcdd754a6a3703b1241e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8cb8d5bc76c4a443137e1da0a6d3bf

SHA1
ee7f84c0fdfb7f60641c8e57980f35810eb630d4

SHA256
224a2971b91376f1701b48a5672188bd282317f819785f64aee1b2731e363254

SHA512
5d7c6e10c85e418ef16419ab87a06ad3fbe301c93169f8846b561f2b747b5e216cc2577fd8f64a4308d4f8044203568b63e059ec8a473799738de1e1185409a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
727ff4d7a1ec9b6428cdaa17fbd0af3f

SHA1
a6ae0de9c690d28d45b1d85e9a0d7cff3ed6d85d

SHA256
7a3d2dbe35332f403dd33c6332b3de73b08ecc0a38c538d538b8edc04d3a0315

SHA512
c8e5cc7ecbd3590cdd1665c45f259f79a4edb152e42555c0aa54dac3d980fc0de9a821a94d5bca6a2da2d408b94d399e8c49cb4dcfb2f38272c2f4e8ab500946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7e4acb6b84c2ed7b122afaf8b5aa2a0

SHA1
5bf117994418a2b1136fb2ca7871f01bb65fa48c

SHA256
1f36422dbb0223d23cb835cad4bfa58132450dcdb9942c79f06fa86b1691c608

SHA512
00f80b7e024c8c86f1b7bdf8ef54a862b57005b49db48daadc991e80f41c21255c947cd8d21ffdbadd0363103a9eacbeaa287d625779e441edc0770e492b8b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01d697c46ea99351a3206e1c0159b132

SHA1
3b714f241b24fec916ec9765a25ff6f50482d6d8

SHA256
cc416409d57450aec8a0bd9ace4069edd244508f613ae601ca34c2758e7db408

SHA512
73e649ebb684189658ed7d0b4b020e2f254399aac4448827335367c16e5b21e0a1a71374db4fa748a96dd0c313399ce860b66b96c2c1d9d3e28b762c245a540d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b255be31c35ed15cbabeb9c66c1c1d7

SHA1
f5086dd450f56784bb0de41ccd6e1a24c12ea367

SHA256
d7b5c916523b7bc64066a01ce93112053d0ad3ffcbdfc6a248a82a8082a195ba

SHA512
3c32039a81f95a9544282eb2440220082b7368a076939c4db9434b18466e6c48477e4cad753cfff62e852e0db1926ec68ed4c8371ad966e6b67bb0820d218af5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab84CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar855C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit