7933cd2098594446dbec19d636c76c38e8361f6d9734c8f1667aca5611526f3f

Analysis

max time kernel
145s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

045f0d3101d791bb4fa49733491ee384.html
Size

4KB
MD5

045f0d3101d791bb4fa49733491ee384
SHA1

b042728b294247a6ec352d36d3c73cf2e69b16cf
SHA256

7933cd2098594446dbec19d636c76c38e8361f6d9734c8f1667aca5611526f3f
SHA512

5b985732a337369fd7a232beee506c830ad4a748024c3f3c14e9592517dc4921902b9858692e46a1bbc42996489b41c03f3079f58a71d83f87ea3112dedfbc0b
SSDEEP

96:rf9seakGiwLsvfpFFOxUEbJavBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIa8JavBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009b15ece3e5904ac74118eb16aa9859c28d4c023c51965d4a0614b6484d49baf4000000000e8000000002000020000000d92febc810d12823aaeb527f2ea831a586bcf577333ea368298184058fb6e0da9000000005af4a43efa035f5ad9d6c344ff9f08ae280bf2d5e4a0dbb6730985e6795387655b32e9089171a05a527158e8af41742f80de6bd6b35e30511e05318972b638e9aa230add66a952531670f9d91c98e402dcc70d40728e8327af11075747d393b41c97b365c541ffcdd3c6285bdffe90cae4edb52fc2354cbfc4c4981302a95699f913df4138dc94b7532b0e33358fd9340000000ae1d8ae72a5c6fac4fb8c7e12ef47725d158886273e582d21f8d6578c43dfbbd9f642662ca0234141808f59da76d74877fed0168f6c7afbbd411f679f0bd2b41	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2CC8721-A6B4-11EE-ACBB-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000060f323227ade1fdf357a33b7c2390f4124fa5976b951c0d4c47a84339991203c000000000e8000000002000020000000ca059d26024fff58681c26f26932a533bffaedd61d9113fa929256a7bbfeea8a20000000d84619f312589e01d19ac40781af635da411a07100666d6fc676f2e97a995eec40000000761f9cd8ca8c757a91aaa8ca69ef62675ab8cdbc2a0038e382712200db5770ea6d6ba3c1209842b8f1e386c8bc27f9dfaf8af92d759613b5d448bb0687caf1b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410062457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60853698c13ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2240	2056	iexplore.exe	28
PID 2056 wrote to memory of 2240	2056	iexplore.exe	28
PID 2056 wrote to memory of 2240	2056	iexplore.exe	28
PID 2056 wrote to memory of 2240	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\045f0d3101d791bb4fa49733491ee384.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1badc9b84083bf153824cf7b13389ae3

SHA1
2971f1b99c78684395c85863c5cb743f81c044ca

SHA256
66280bb589bbd777399564cc4ecc95c6c37fe1d2bd4a8f8e574a5266ac65394b

SHA512
1f69c4cfbead7c2a62c856e2b4c60589861704caa5b6953e2464215b7da212738062c31161a7c8d1d8c6ff7764b9a29441114560501baa099e53715b4cd52310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ca0df7d3035f6dc4529350660f0f8a

SHA1
1e00ecea7d96784996c92e251b4d89321688b923

SHA256
09bb7bf5950d1bb019934ef87fb109d0a8da8dc88d01c69cc09ab50894edbc6f

SHA512
85ffe6e1fdc9ae7e66188eef7f27f8a35a0b12c24a0e5120e8ad57c4c0495ec07b4812b3757057cd9b103eef8e5704a04734b0967c531d2226ec21bc3fa7cb67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e4beb293d612068c40c10a2dd2645b4

SHA1
116998359c3fae418d917806ce50353bd45f8c82

SHA256
baee07958024847f8a00a8a5ad6850bed303fea0553b0be048525e260ed0d2de

SHA512
8a4ac8bdf713229f9cd2ea072e094bd070cf3b1269d51f19ceee08b08045bcc6fd253bab5eba89ba276e8fe7165af98993ec1b4f97c8d730cb7c4a871552bd74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
277040bc7ca352ad6d673a05ef96128d

SHA1
bee65be16fdcd306f849a65f458da95597dd8df1

SHA256
02e3f294744870fc3d8596ee5ebe2173d6591ff09e0e5ae378c5399e98ef9944

SHA512
ba1100a8e8f036e1150e7989fb479f8fe186974d51a0e9d5ee6703a56bac08e56741520e256b418fc380b239f3d1d0ea3f0677a60bafe1d6e374fc03d3c2e14b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1749fcc9819d2ed34037339cf221204

SHA1
f0a8df13795f4e85776d9d090c8b459c626ba5d4

SHA256
6769b5dd01ff29ab244bb89f77e26d929d7880fcfaf845892609d57806f64004

SHA512
bc26e687d913e85467e6ed3759531f1f24b3502e42749a7b360638b8367dea83eafad6f7e2b9f5e61e635a810c27466e9a056b19bafec5ee10d8a0eba3a523c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a9165a1f7c8644a2b1416ac3e42f260

SHA1
72e820530a22e4a1a78d4bc6d877709b7718b534

SHA256
288129ea6565251383ce30ed3cd0902583f91c9820b3e1d049dcda3c07a69d37

SHA512
e160e769cbd5b88b6367d6caa880d8ec6c4347d4bf9f37988cf6b484a2839dd6b657b9df49f22454d43362e8fc9e60ddb8bb315fa175b658bd55290dd048472a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb791b1ec30b393f73c884200dbed810

SHA1
c55eb3dc4b66e3ccccdfc1099aed2a6913f92896

SHA256
59c50d74585796aacff908eb17802507f34b0c736c10412e4d5ee235a9ed4f0e

SHA512
c7a3aea9cea0aa54fc66c65baccc9c9843b3fcfd2b725ca5761472100a08f6b3d67a628ec94e59e814a37e7753fb45999af93c78f2c04c2ebb9792110e296938

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA90E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9CD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit