5885117fd4d807dc17173cecafbdcb57f227a143a94d5d189e04f5543de134d4

Analysis

max time kernel
139s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04b26a6c1dbcef534ca181d69e539b48.html
Size

25KB
MD5

04b26a6c1dbcef534ca181d69e539b48
SHA1

0fc14e975aa2bf970c947f9e799fd9efe9a3ab9f
SHA256

5885117fd4d807dc17173cecafbdcb57f227a143a94d5d189e04f5543de134d4
SHA512

366e992848f42babec6bda9119885e3d35033029ee1968e53c758bfe3a95f6eb376c5bc8a6f048e856769bf82daab7e09bd73a6b805aafba44138e12c4240f48
SSDEEP

384:8mRnA4ywgMp89LGtztvukeKXXTuQ/wF3e8NzRLIWQQ/U4cR1LeeIYECdG55LkuxR:bZ1GgltWkekn/c3b71k90t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F068ABA1-A6E1-11EE-9F1C-6E556AB52A45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00b99c5ee3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b3547fc9b546b31aaa71b8c9d01d1a5a39d2003dd69e9129aeb2730e68a90ab8000000000e8000000002000020000000ef3841a1cd266dda163919b931173666dfcccba4c33d7e78b1c34f90e021227f200000004d7cbc307d9b92c36369179961c11211f826c644222e5958b26d0aa35cf32ea240000000d95a128d11e70aac45ead317d9437696f34416bf9c809188a8544c660bb79fc53cafecf795a2a75efb599473a26ad3bcf871f724a608b98c8c95f3358aeba93c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004437128fbad79865ada9469ba8529fdfa5bfa60f0ddcc46c5fc9343b1a8e8965000000000e800000000200002000000009f86b34bea5b019ab562552578d59b79fc11928e45bc3b6259e56081d2cdab89000000019f3ef68ab5b5e0e4795167684808b5f6d2102b5d5f5be5e0a6bc073ddcafff571353fb74be1d7dfbf14e0ad5c7e218c553385da155d500d33968c22150a5d81c5bc0dcf8d3808d59d723c42d27c643b8817fdcddf493ca760de3baf79c18afad57b4cb316084a8c4d849151bfb2b0f652287bcefcae7fe969e27e965be30678be189d7b722dbbd0d00d740bf436a3d3400000005a54357577f2811c446a4de387aa9d61247e95be1a78d5fcbc7bd27b1d9cc24692712621ed7fe433a922b727c43c48b2d13072e366357b674556a735a7e05e65	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410081854"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2448	2072	iexplore.exe	28
PID 2072 wrote to memory of 2448	2072	iexplore.exe	28
PID 2072 wrote to memory of 2448	2072	iexplore.exe	28
PID 2072 wrote to memory of 2448	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04b26a6c1dbcef534ca181d69e539b48.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1c81feb21437eaa5ab36dba81a2a91

SHA1
c95eab4c9bcaba359b8cff184f6f7525f0baebfa

SHA256
08eca1803eb362fa1db6b1bb7ade54acbf14b1fe3cb51061507b2fe6ec8c63b0

SHA512
59d8bc72a2ffcfba255c1883ccd39acbe073351ba5aea235dd538236ef689da2d556a6a876c277f58541ed8594cf0d12d85f877ce254af9780111b2a8112c075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc6f0854cee7e16e6c2e13f19650b02e

SHA1
1a5cfa6001ecd1110322dde831c38ac86f7cfcb5

SHA256
7ab6fd5cd90524bc6d2270717c731e7658a32be65abe20d7388b7a8dfc8edf2f

SHA512
8838f69af57611f0959501b23cbf6b3d0345be5c401508705bd047a276aad5927d088251e81b2e73d8cbc51b29b263b2b005f453e90b7d3357bf390a406d62a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00ecc4c9db09e9232bd049b3e494330d

SHA1
57fd717ba4641bfac0205268f3ccabe44c55f82d

SHA256
245c10e72a28af3ec9c53cd03e6ed1e9df1adc8c16061c528a5b57465363e2e5

SHA512
04a8de3726035d82439893b9dbb2fec2b583c7f4f86762de15db3c9a8bf5572136d5034ff68623baecbfd6c61f0621e0e154b5176709f212a4952c1b2be727ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaa004e653d24c024ddba7b05cf935cc

SHA1
ab3b7ee041f90df579acb470941c5305e434284e

SHA256
8f421bce8346a81d6ea0a366c7f9b153bacba74bcc80df2d3450220b106bc625

SHA512
d707ab7e5bbf7a3a3f2b8c3e5f2a149833f4745eb0f3453bd59594dffcfb1f4625ec77df747a7b879cdf086042b0bfcfd62bc2e5c4d35daa18965c7626ab5399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7bce551240f833f97f95d94ab0899f8

SHA1
f85584b89c4c4f0d035a4636415a0e3457b2b334

SHA256
41227263cf89180fea077078c2a12ecea20ea954f63c9dfc5723df11e9d0ce66

SHA512
20aef4615d9c23d6408800208075fde32ab84501213d1416e410c98530fada00a35f47853b9c823187184a6beb6407faf44309b3638e4cfe238819e2b4c06a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff78180cb577fb2a773d65cb4ba0a450

SHA1
d3ccd0dfc5a53c0775646964ecd6ae8546def872

SHA256
598cf792df7b1a4aacb34bdbfdf820ce9040fd87273072be8079074504a1bb2e

SHA512
68ffddde797a32249f4ba7f9593a53fc18c59641430427c6e00573e05380cc9583550da2e7ec2207fc0c8d953169b68a63391574b4f97528cb8472c1ecfa8100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1407d9f1a2e0eda28996d9db6e8313b

SHA1
48a21d886b2c1f8eed43c7bcf05dbe7635b8f35a

SHA256
08ccb942631cc3ddc3392fcb1a9a53732f5f543bf1ea54aa260f557d94ac85bc

SHA512
7e9b366e3486a8d6b33b0123b7596326769dff49934569655f8d10bfe12fb0c5629aeccbe5343d92bd57ecb261a5e75b5cd3095e381e120bf2698d4a00a070b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed0ab880805e460dd011c56807f5af4d

SHA1
d4f81df3b074c43e3a825e144426212ec2b0c189

SHA256
730411355934ca535729b432162996192b71ef27cfb61b92a32f2cb8d8fdc1cc

SHA512
959e2cd18b184b57dfb57a36ba35df74b4fe583b29ae3c7d71651706f9002d3cf3a4dd67188d98ea921fca02362e72df34343e186b4c505e4c3e62d65c962941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73acd4b41bcaeb4bb20d4d4061317645

SHA1
e68260e2821ab9f427200d920a47792574d8cdf1

SHA256
167a1d20e585449c8323aaa8ae7b77817ca9547f0207fba29b3c5b954a6bb400

SHA512
e347497ea344757cfce4394f3cc515f18859700908f48a7cf4a1f7d3361290f35abf4843ee589cf0197541d8dad362076a64f7c31286e4ee6f1235b5b3effb62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab875C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar87BC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit