e640ba95010d5b13c3197158fe17911b2973acaf7dc26d3a243846b83eed6223

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f8e4b81c357c4f12eac0c6d72a1689e7.html
Size

53KB
MD5

f8e4b81c357c4f12eac0c6d72a1689e7
SHA1

0993163eb3b35c7d1ff7cd80e17654d1d12b34b2
SHA256

e640ba95010d5b13c3197158fe17911b2973acaf7dc26d3a243846b83eed6223
SHA512

1448e0b721c133a1bf0b3bf744fdd049e08bae955bd2d36636cddd63a5ae7c8b1df93dcb391bbf4a43ed735aefaae03420275a13029d302bb1125567f41245eb
SSDEEP

1536:CkgUiIakTqGivi+PyUdrunlYy63Nj+q5VyvR0w2AzTICbbRoP/t9M/dNwIUTDmDg:CkgUiIakTqGivi+PyUdrunlYy63Nj+qF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CB7E331-AA36-11EE-BC40-6E3D54FB2439} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000193d394443cd723a10febeee9d902989a534dac41eb4e7b6ac8f9d9f0f5794f9000000000e80000000020000200000001773aa77450971f84a3ced54672553a370dcd0965032cdba089a1e8105f3d70a20000000104f1acda78b00c322ab6599aa5a5b7508b8de4f8b9ef47179b1b6bdb63bf742400000002adc85ed186496a2f589470a383c6ed9df404e9042109f1849cf5d68a1e84a9fde36838c25a0f34febe01568ba80970fe8c4e96a1374de668169603f0e7d3bca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8066b867433eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410448023"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000528de5faa9e129f533e135e56d16153f1f4d6d21628093e1594741708a6dd989000000000e8000000002000020000000893fe77da8cffec4685c2289286ed9b8441bb1a4eea1f204782a6db26435c41f90000000dc153cb15daf34ac10a80c52345c8bf6798462d539ade0c88a8c9ad34e35f0964c12ffa545d3b0127784864936e9a6cbd50e05c171c106122461adfba1e60e493517937dcaf5354e3e9b0c178f3426ac9e531f8bcea87589f376affbe55d6e85bc177396467df23f5dc7e9c6d0c71e688353cbd9250333db11409237d1a620751578793aaf078fb6866aaac6823fcac54000000078393bb7190b6d411f9f6a5b184fa3b3dc2a471695cea16e07845fcdd72048e38673c06440e222f1ff86c4545c52758a93eb741802eae730323442556e07cb56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2060	2432	iexplore.exe	28
PID 2432 wrote to memory of 2060	2432	iexplore.exe	28
PID 2432 wrote to memory of 2060	2432	iexplore.exe	28
PID 2432 wrote to memory of 2060	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f8e4b81c357c4f12eac0c6d72a1689e7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15a87d3477080de8ab9259818f5b5b3f

SHA1
55182c48e958b7203de80bf5500e273e97cca884

SHA256
63d642cb9344b75b3caa213ad3cf3c7328c645eaa3b520fd5a1cb7e53d92424a

SHA512
d8d7d9da8b68203bc376142067524101a23ae093678eeced97da706eded9c64b867044c2f76db67aba1a70de453636f7d9431f4740d89e6327579c7f278211a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b482c88f4b14588e84bfe710c0b6c9

SHA1
ec8e39f7a7d7cacbe2a409d92caf1b94332608ee

SHA256
bdc89d52d4f353a087b457310116e09a39ace246687ec549f5272353cc719daa

SHA512
f23802d274c51a7293fa05912a609955eb22e2530be693d782e4b85a9ce028cf1f1d1e1d901ca4b91aad343610a0681b9619f5c7a033afc39600e2e49b2b802a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94c9d177c81b1dac35a4fce9568c70e5

SHA1
c166596fa4f7368ae264d537b2139a00edeb5703

SHA256
967ec08aee24b8b5b3c3a5b8c647b0fd8890bd05385c1e007b4f3e8b217cd45a

SHA512
3bb74cf2257144d2abf8b7fba2578d62ce9c9d2586f8545cfdec976d8d2214299495a4d3efc3b9e2b4184592d465789f0bffc51a8489ac469005c165d8574928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba707e3902e76920da6589a610210f4

SHA1
4eb6942bb6f1253d11c43d2f2cd6d672de431fa7

SHA256
2c021a239ef4f2de47f63f1262c0eceed732c59cf533df7a727377e456956571

SHA512
0ae4b0532ebb4f081b28d2cc9acb5209d0f884ed20649d263d0a5b5267e3e58bc367aaa46b4da73405d3805ce4319e6793f21cf38b19c4ff20f963aa5991813b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1afe70aae852c13600ff642d26e9332a

SHA1
e683c1eef6a1dfdd09f80c25f2bd8f413024c36d

SHA256
8a492ffffcd446081f52be7bcb611fff86a8b82f3dfee4d89820eeee0604e4d2

SHA512
077336d36c228e59e2c5716f18ff8d89a765dbda8c61b8afb3c2d4b9ab1f2e7d4c210b71b1793f0790d553910de069acc9eddc6fa7ac73ff9a7e46dbcfbe997c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afadb0095e419111c1b2d08951a8be7b

SHA1
081ce074fc9db76f15c4d193d8a46644ab41ce4a

SHA256
312f4c43b512de27c69543954df1024d3a226acc512366e7156b68c66d91984e

SHA512
a191aaa26c89b8cff0cef2c89832ac7fba65d65fba1fa590bb04e89bdde0e517d6e20cd317df7a02e4833d75318cc2fd9ca74a727d75410171fba414fc594d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\topic_starter[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58DC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59D9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit