692719c787736d9aad2352ea60282b86232f2917fdd0a621a90de4c174007624

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0537d276b211ff186ca42fb9e233ef68.html
Size

8KB
MD5

0537d276b211ff186ca42fb9e233ef68
SHA1

c95403aea4db84df1eae2a3d8e34169f1942c637
SHA256

692719c787736d9aad2352ea60282b86232f2917fdd0a621a90de4c174007624
SHA512

0f11237bce293ba00d2a9776a82f72bcab5d1b5c65027e5397a6ef672b2915634b6007479e189bb856a4bf649a4bc4e8f4c30fa4c33f6f4118f2f75aa26f3933
SSDEEP

192:PzlmRWoaoXTQ3MckTUWE+8KSUUh78OUGntRJqpGsx/TU:bgVXTWMckTUXVKSnh3tR4pGE/TU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001ca5194dc7daa325b6d2287abe7f7c0aa7b81a6a61166d2e4c980d4e2f82035e000000000e8000000002000020000000d071d0fd1396cf8445e25837f81678e8e7c64980c7c426f46e369b0aa652dd7590000000ea96d81cbcf4a3ed2e45cb12049c590b4c99aa66a5bc115844658d6472c8efd3bd613c7bb125d5b9774e917f7727c51982b1e42b68527fdcbe30f18db460dd34172bd8f4f7a3a25230fcd36327566ae58a3d429bdbe8532ac1cbd91def60e4e6f27a43aa75241b1c14c5aa9f3ca3a4932149e29cd470b157aeb75a1965278e2fb2e4cb43e471ea9792116960b0a1d9a040000000dfda0fbe846a8181224bac309ee32a961cfbefebdf9cc96a6ab2144fa8aa02b70c09baded6752d5ce0b237fe571e979f217a9985e972027f502dd8bf055d19a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000056b9fad513c35fe624e2c1e732e1c72beaabcb44dd0fa39fe7864dcd355f9bdc000000000e80000000020000200000009c8f3eaba4a8cd88c8c5ccf351e48cccc7c29d8a35aebc649dae1df2436ebddf20000000ef5f48823e73ef0c800108d0fd072e54e92c0c1f34f12897e4102308a4491ca140000000e573a5379215ab1e692072f3de31e624467347d9144784ad4617203047d8e492689868626f848df2c4561787f8882e7c4f0f971c65121b5519dba9616e884603	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c5983efc3ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6635D2B1-A6EF-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410087645"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2904	2912	iexplore.exe	28
PID 2912 wrote to memory of 2904	2912	iexplore.exe	28
PID 2912 wrote to memory of 2904	2912	iexplore.exe	28
PID 2912 wrote to memory of 2904	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0537d276b211ff186ca42fb9e233ef68.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df517ed7f3d8b3f901046fd31d686cb0

SHA1
c4639447f8802009b6f4daf2ddaab844e6874d39

SHA256
afc9d4d70573e826c47023618f7c13f63774991af54e9dc8917a0f1b66bc1812

SHA512
448a9f5fc1ac7abbc6d0a4db8b5e95bd50d925412a38f7807bdb8fb86dc9585ed9de2127264c3ec4f83816c798a81fabff731fba11bd8382011052b08372b850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1140fd7f84be73b185bfd55c7093b5

SHA1
567fb787b880bfcc77c1c2b2e0afe83e5479b596

SHA256
ced79cecd06f1cd1d5972af69bdfdc07ec3fff194b10398e5493d7bf7fc72565

SHA512
ccec18e7a3a965df93a550420dfcc3ad46dd8b3b7fdc3f6b4395eb9373e0c93bae440dddea326a411289dd228c7e9034c70c9614bad75854fa12fa7f195cc8d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
127d16810d153679c8c2d44a0c1a643a

SHA1
626b1dca72b26b9a051e3acc591c39e0a820c73f

SHA256
60ad2298b40793c36f3c174c182afd51b93c052ab92306fda30e4345438dab6c

SHA512
055cc853e6dc46467a583ed2c782c91da9147629c60dc6ace7254d4a440dedb54c77feefb1984feb39ddffb7caa0847b2103dce6487fea98879f9cd36aa482a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f02046ace2e63d63e870863b4f57a9c9

SHA1
3eb54ebcb0956aae8eb13077133a35131da80d47

SHA256
970ebd2245e70b8ed7a7b9491527e0b4b537f46487c18eb0e16f03eb3dbd88bf

SHA512
8337a136dc4398b4914bfb3fe06c6f0b98cc604ca66e607731445bb41e6055bc9d78e6ca1824561bae8b190cc4e528d57ee8802b107c7b9ee6cb7b7e131fdc03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c54caa484a0594c5664f8906e20746

SHA1
b886772903ecd5b9f3af23bfbd2887110a9f4d68

SHA256
90f2e8ec53ddcdaaafbb8a4b962d6e2f8687a4c9631aca91dd022dab278cc0ef

SHA512
3b4f41b46cc5a29c95c486f9b5c30296f81c5591af0171bc3ee92eabdcb0850127854bc1f68b26fd9bda4aa274e0d11b97f3e7c115a73b0a52df19da833ae175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44bc0267d52c8670581b2fb830fbbb56

SHA1
71ea04aa4017f7b89067bef449ba3449b1c41b4e

SHA256
3c5bf30360f7a2ac57266530dde88c83f02f5fc87b820e0fe85d59aaef64de47

SHA512
7785f42df8507a08932e860eb210c08148a669513b97701d8d0dd7fa52f140a173ec67f1ae0b326f53ee50db8aaedb1ac6a36bbe8527e094d72c99f8e79446e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c82345c4f2f3d035a8d65ea45d6e88

SHA1
e075102a803c69b07e7cd88a6a7586acc950df84

SHA256
e551e34f92d3922a2981900896a2933c9bd9f04635a5d18330cc4948de88fba2

SHA512
2e48510c6e82ad74d7938651fdcf62fe50eaf9f9780278b3ac1ccff24534c96679371ef9051cb27be66fa1418f50513bafe0a2b541a14763aa7ca3ae425c891f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c9b6bb4813bd10c0b7255a986efc477

SHA1
86ddd4ee8fc0a185c472963eb5dbb3f7a44b280a

SHA256
eb33eed57e918d5531252a20d23eb2896feab91533ab16e688745b7fc52c86de

SHA512
18c322b65d53e4ab1adf9f783125b780cf3215fefd90dc7da42513cdf684bfa8ec3c3b5760424c82cea9b437bbf6c75ccdd97763b88d1f62bed89f4379b81e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE496.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED21.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit