43e46bbddc615b3435f5ca89d7555221bd4750f150adc80e75d308190b6ebd94

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01a5386e4cf540abd0e957da5133e832.html
Size

42KB
MD5

01a5386e4cf540abd0e957da5133e832
SHA1

f5592f0dade2c55c5bdda088a9003779cec954e2
SHA256

43e46bbddc615b3435f5ca89d7555221bd4750f150adc80e75d308190b6ebd94
SHA512

d3f648b244cfb916d56555c271deb90cdcf73e247b28f21ed474d22c2ce4ee72dd1a45a38dce18c03b66acf04dfa007e961cc602dadff976fd173c22c298d953
SSDEEP

768:1JDzVz5zXIKEbp1tUOPaBxCv00p+ow/KCY54K21tUOPaB0nzK:1JDzVlrIKPItph6VYqle

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410041023"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD4E17D1-A682-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b333666555d4fbee486460be55793b8b0eadcb994f78f4127f4d3448240dd75c000000000e8000000002000020000000a3f4fa0b3dbbd528320742e0eb91f36d3cb5434027d5a274b8c95c46a92d7bfe90000000786408500eb0622bf9e7ac0d10ebfc88c4bb7807ffe5a36aaba74a07055c4687a955094cb9a438dbfe4edf3199212bdb8adaa8af852b54b3c14ecd162f2620998006e7fc7cec5f3f6b24a771474ae8856830874cd211595c66cb809b95cd272dfc7eedae0e4b41035a692ea1c96ead774a164f9e63f0171c483618960c57443d81a5f90b4ef75cddc5e7e819b655bb32400000000a03afc0795b4552c3f6380a7d6533d93f161f21b568cef5190a9f8569d6c96b6c2c27ddc5ad457d4bbdf8516237929cf3b75779d672947e21fa8347a1f39410	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a651fc3772d48820c96e6dc22d8f8d548c47268860a2f08270b807ee25249cb1000000000e800000000200002000000013e7948599dabb35e07be7107dd8277859be6b88a0095b0a4dcb59ce223703cb20000000c1793e9aabff1825992bb50080c17da47ac1b7e0fb6d2e92125dcff2c9481b9f40000000b1cf5757fb6a96c81e14768a737cc4da38059806d0c42c9494affd0e09aaa73fe3037912c954253c0216c75b1030b043e18ab80bdf0caaad5338fe042c922751	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d7a5b58f3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2904	2004	iexplore.exe	28
PID 2004 wrote to memory of 2904	2004	iexplore.exe	28
PID 2004 wrote to memory of 2904	2004	iexplore.exe	28
PID 2004 wrote to memory of 2904	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01a5386e4cf540abd0e957da5133e832.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
937ab782b5e1f73aff1a328eb98d1f5d

SHA1
123fc33bac2b8a3bc9be9b4b8ff91fa07c0152df

SHA256
0cc2d8e0d64d68cfac09138970fb5e575982f5bba78c3a77725ef0e0a1e64c9d

SHA512
5a40c0896e706da8eace991f932d15cfbc0b52dce27164c63e0cbdc410dfef393c3623c99bbe10e8a68cdd3842b5b2c0d72b733c2d921eb117b359705c0a0714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b985ba29d395d1d1be4a2d6b7bae7c4

SHA1
e5550d0a62f4de929f3307a40bbf18a22f354e5e

SHA256
d22f666add1370ebbd31e85fba63dfac83fdebf0841a5c4e27a09a59541b337e

SHA512
a5c269e9f54fa9f285fc75edef9aa81743fe72049214562f6283a51b29a53969c6d3a045d3f93153fc8058f6f8bc4caebaa204ab75f1d8cdc28aab48042c6968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63df6bd48cd9483241959bf47b12b8f1

SHA1
fd61bc974b326570ce1ef9ced4129e8428900df2

SHA256
923ba7927c94730ccf19bd72d93527a62100fd96cc0955a6c05fe286d8bfd9c9

SHA512
f8fbeb3d24e636a6e0bc5c77b7319127054b705c9a2a29793b58a3a19fa733bb655dcc25b1edc50b59caa4420aeeb7a4a039f1eca8ca8ffe4855d0c4f84fabfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e3b27198171b6a01bc859595aa2a03

SHA1
66ac0c41b6dffc2745dec3a8afd188d98ab67f3f

SHA256
3fad7cac19d95fc6420cfb093540aa9453cc0846d72637a81f9360f8b4d35ac9

SHA512
3cb40335c30c11d55f571e3158e5500f6536384ff896205b8c2fe8af747a4d906821a877c1230e34bb43f3d0cbaca189b091a9bcd495db8a2fe99204a6ed2ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
346d36b684b1ff34007a1f9dea52bccf

SHA1
6ddcd9715a69a8f0f4e7b6fce5285bf3c5f19444

SHA256
6b309424967150e83ae3d1eaafaad34b9367ff849a87440bb8b46ec479a93985

SHA512
5ea2d7e67c7884b488c01d3c78239a9fc40d546c17808f45c1918bc42c909b72a56e2270cddb8dab1c80415e46e725bff9de4c0e6d6a05d4c8485d05c8ee79f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
593a8d7062be9bc47e5d43b99d0cacd6

SHA1
350bdeaab3155b1caa1bb0f64d480a533d95dc3a

SHA256
b249d08485b5dbf1d03c58cf607a0ff0dfd9ee3e868df15b41dddcf73721e35d

SHA512
a514a74d6f29137a1fab1f452ac9488e739ab6a9999247a38d11eedabf230c0406e3c1815f23391bed7d61d727020a323740d540fa106eef43bc775f1926f95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1cd556aa1b7e5eafcc6b09f316c8a79

SHA1
a1d4d558221d6760c7c62bc7c72c39453face7eb

SHA256
a7df222442aec56946607e96fd01fa91634bc0621be1c85d465d534baba26c5f

SHA512
1d78710134d8610a04028f81e5115db3213016ffb60c1b01d97062fdbdda925a133f903307c9630ebc530924c426f9339ebab56fa3dfd1771e028b1783273e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64BF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6906.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit