8ac04875976ff5f2b443dde670ba53f812e7ffff42e72336482081bacb337f38

Resubmissions

29/12/2023, 08:01 UTC

231229-jw3ndsgah2 7

29/12/2023, 07:56 UTC

231229-jsp8wscgfm 7

Analysis

max time kernel
120s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 07:56 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_88ECC22CD04E30B687F996108FEE9A6A.html
Size

59B
MD5

1005241397146b544ca586cda3f69c4e
SHA1

b63db3c8404c544ca3def7cd94b35e16a62ea5c5
SHA256

87a8d0420653b1b395a233b35560cc57c66f93228c42eb933bb467df1fed8d49
SHA512

404cc4a618245c8d1f98575a88c1cf935f250508728172beb192fb9c90acf507da22500e203603f1a4a7ef0d4576d93ec2b4803a90d1612fb7dfc4e91ab804eb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409998822"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C391901-A620-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f600d8c65316053dbbfbf63159bc7a154720a188c1af4426cd684d70bf160158000000000e8000000002000020000000bad392fd6f51d0c5d30ff8a124612bf1e73c78286c4423394fd8f6fd4344c658200000005bcd3b2b2f5bccd71eb65bdb30e52126da228867afce87effc5a6c207fcdb34f400000003f807f836f8b5a1e708c822707992cf13fcc003f8b93f05b8e6361e1055e463f206372a7d6c40ac04c0755954dc6ba19d7da4c5941954a408a17455212c3519e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003b5aee631ce5386c9a4a9dccff2af410f62bfaa9ed08162ae833cc8d6c4f5eb8000000000e80000000020000200000008bad28baf8dedddd834c86d67b2f37b9e6412547b6458bad426a883abb931c1e90000000cf8424fe78fd50ebf7697def4e9dade0ebba24c949ffdbc90a3a4973f5200a3662654c2b9a651c9bba07ca3d7bc6f1319f05f4ee27e91d3e847c6aa4d4712692bd2a03a77192b0dac6a5bae553507ef8f98bdf8d6baf9da8dd37791f24a487110490ccd0a5525c91e2820962548e4517eadcb442a79e344c5d0cea295fe610708cbef789a6069ba8742f9e9f34a39ed84000000080281a279098c8cdcfed2d00addd88a8a7397abd44458c9b57617a6c4010b13fdc37fd7b5f21e8d8e2a95933cb11c760675a2e963ee5fae4aa95304c7f7b7233	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206589712d3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2596	iexplore.exe
2596	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2656	2596	iexplore.exe	28
PID 2596 wrote to memory of 2656	2596	iexplore.exe	28
PID 2596 wrote to memory of 2656	2596	iexplore.exe	28
PID 2596 wrote to memory of 2656	2596	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\_88ECC22CD04E30B687F996108FEE9A6A.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

No results found

204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

1.2kB
8.0kB
12
14
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

960 B
7.8kB
10
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

827 B
7.9kB
10
13

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a4ed67812809ce7d7f40b6417cfaf4

SHA1
af0a3cb7e56560d7a02ce3b590dd4d59b07d14ed

SHA256
8e0052f41aa3e2e45a4528b5fbbaa20f73f69fc500bbda5719663e357d0ff6db

SHA512
5d32f236f703e648d78aca331f0917896c7ac43c1423cb7a4ca8b9a8cac148f0e4698b019ca76dec07c4de26cddc20137530ec135f4aa81166fee70aa6e65888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb87be15956fe6c75f886f17029624fb

SHA1
3c031035a4f7a4a4078befeb2fc6897ad9d7d041

SHA256
85e8b1e9d779803abb0a4bc10c8309087cdf8cd250e8df747cb38fc1e2696da8

SHA512
0d9bb6978918669c6bf81f831d92c26cb7df7e45a48207e54e503e77d57c68a7264d6a77f64e20bd3fc448978e6111b3907b5f477756d31577ad110996ae41cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9493972b88ef4d467f1cf51d72c79868

SHA1
918498fcfc44d58c5b9ac63ef7d3ec7e1f333b66

SHA256
94b6fcf9ef92c88c8d8f61e4db61b3ea399bb70263299a4cc252f3bb353c3074

SHA512
ce4e5050cdabea3c0e32093a6d38a12586e5293af9798618d662a6e3b1911254ff43ca79fe671b4c15c75eab7e4b80a6b53b5a715eb7f90ee08b579e15b408db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6894e6ea4c605cc68e70fe8326b3ab2

SHA1
3d68f5f8ed2d72d5417cfc48228c67fe9d6b8bb2

SHA256
cad6aac7948d271c24d4a59b59e6538f9fcaba66da05059d5069d90a11548295

SHA512
6628e609e4cfebc92ac42dc61ecc6bdc18ed9704ef6ca7097bae5054f671ec2a8c5eb2de391cb9fbac274ba875b9447f9b6e755a05b6aa65ba1d63ae3084a11d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8525bba9f17bddc7ca9e6a95034f827

SHA1
2a65cfe2d1842f922d62d170bf20d4908a19f78d

SHA256
aaf67bcca06071a2bf19e8cf9b94327b1440b39eb2dd92193a9b6f50660a2df0

SHA512
b4ea8fc766f1a8efe5a3509b147734e24e6a11e123638ff251ad68b33f46a54b77e1d90f5ec288b66ab648743acac67df8fb9071946d3e7284c20637219f787f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f03aba0655964d069c182112742b0dea

SHA1
cebf07949b02140646e8f60c18504de735de5117

SHA256
498c8bb1db1172a4cd67f8d538a00e25da95a0b30af13d89c5cab9fb255fb087

SHA512
2c29b446f5973dca51cbfd1eb5492a16ba0801d07c9f6b3052300162e20ee2853165a31a9c2d1386be419fa549f0dd8b99db65379c8924cee077b2f244d9cece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cda9bb7208e72131330f05e2ff6c9bc

SHA1
d045d2f466fc8122d59464cd33b728c9e1b4024f

SHA256
8efcda20e50688b66a0f694fbfa54ec2dcc0ca957b2e133244eff232607f9d18

SHA512
3d8608d5e60640890f7e1430b72626de1d97debc6879041bdbed832fe186441cb64977b00d779ca98fb0c601a1e1d4c0e812d82bb96c9f987b02b2ca87e3e90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e034a90b6cda34732489824cd9fdce52

SHA1
f3db2cdf2e45fc4b3a617f27ad8d7103ebbb7d06

SHA256
768d9fcf3739c97ac5ce3bf39dd63b9e65f9e80be5fbcf34c5a583270f0fa8f6

SHA512
226fe032075e99567d1d225e1c791121bbd10a42a45077bb5742d5d21c19de766ed686baf5806984201dd82dbdfeabe84ddbce981db78a4d50cbc23dffcbafa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd90bf56cfe3edf728dd83d52e714c9f

SHA1
6d6010d5332033b72f64a3f435d4083184755073

SHA256
909806053ef6f95c77c0756b3cf68a5d2c671330c066f8a2e16c7dac148625f0

SHA512
3733f44fd33d0dea9c437bbd54b2db147c7f76c79ce99c9b3badd15c29ac25f77c5926d7816df0cac953ee6c73a00786f500958e4d3649156510e0f08138fa88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaee1d653fe2166ade5659ff380a37b7

SHA1
6b9b64e8d0294c7ac718945bfd92dc67a5945e9e

SHA256
8588de2814506379b5a58d7e8741b1754ef57e859d062a8cb8f46836830de2ba

SHA512
780978277444b6bc423902a1c9dc7362076432e121b02960d9d2cf3289f21b8ff4b817f409bdd872c910240508aadc61fc2a2c576e902463ec603cb682fd7b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a79387d3dd5655820ddc98091e8cb9a

SHA1
5d1133fa634fb52790577e761207b252d1cc4e50

SHA256
5123d6482a4138c0386e4ecd388c5de0e0beaffe325c1b7b790f3a31557391a4

SHA512
2aa8b79224467480ded18b419227c37a87a01f20288b267c2a47e2bb55bba13a79554f44c7263cb33fd4a21d87f62f1fc7557319229b6f2271ed7953c9f2cba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f7124ea6c4e534cacd801d3b930abb1

SHA1
9472cfcf68d87c90526584985105be8577c92bd4

SHA256
338fd9e12815c83d6f188edef896f0ead369543a30be10e59d78271e431b8a32

SHA512
ded76a3a86673e7537a0c0e26fb29517a330362bedb54e98f178ba0469d723ca2c00a71d37fcc6432a513f9f4a63cd55eeb6714274858af17a431915b32d94ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8C3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF934.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit