8ce5cdde081d3151eb1f6a3c13a27574ec832fc3f46e7715253a68df7eab01cc

Analysis

max time kernel
68s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1e37c6cdee2715e6d1c9c0fb9cd9a42d.html
Size

49KB
MD5

1e37c6cdee2715e6d1c9c0fb9cd9a42d
SHA1

945dd148969debea4e84b15ce30611fd677a2080
SHA256

8ce5cdde081d3151eb1f6a3c13a27574ec832fc3f46e7715253a68df7eab01cc
SHA512

1048157bff871809765a5d3b62fa235db36708266f84bcce416c8b0938fee6befa6559c854d5eb25151f65c2a2325a58d8adbed219bfa55c9e398a9f1b23f9a5
SSDEEP

768:PAB8h8T+FBYn2QuiuGf5WKjWkJwE42KqIaGHAWRRzj:PAB8h8T+FBYn2QuihzJ/xKdaGHAM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70cded532e3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008253dd1c25c3f93ebbbf4f6c2f33ccccb81915878dc26ad4b688ac2c17b804da000000000e80000000020000200000002a1ff8eeda9114e4f968dbe9aed0260b337605eebbabf99e0c8a28c888f9c39a90000000a8c967968eabc88089ac08018f3e4dae123c428720f189753225bac153d04fe6ed419ee971b26538515e4372bf87489a247b378bac98ba3b65f2c5d6edb36fb083109717042417ee9eec5255d6d255c847f67bd42835f2881add774c9bb42307bf559ad84aae7bf2eb6f09a66f2f1ddc91cb21469442145f0e4f50f1a060ed731270a7183c8fde31e63bacb68f36da144000000034d885ac5f24a828b958bd78a4d667b8b4f54b9f82b6437a5bb5f87a7181ee83504c240c980602eda14ae7f2efa3cf3261e3293c354610b61566e74498da3f8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78BDA121-AB21-11EE-832E-DECE4B73D784} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000dfc0ff3c2f04bab6ce6e08bd934581cc61517320262a42b955d8884301178274000000000e80000000020000200000009547d2acaab4986113a85e75fec55e270de137209389e8287aefcc284d63760a20000000edd13ee72dafa55b91a2255589c4844940d4a8f71327c0d22dbc6d0c91e0ae1840000000b687c8ac7ca011ad9229ea4d54580cdfea921a12f2092f952f9b85987c5e0a4a8525aa676c56efef2e52a8f93a1a6c365becba154fc964bcb8f7e8ec29227ed6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1236	iexplore.exe
1236	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2668	1236	iexplore.exe	28
PID 1236 wrote to memory of 2668	1236	iexplore.exe	28
PID 1236 wrote to memory of 2668	1236	iexplore.exe	28
PID 1236 wrote to memory of 2668	1236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e37c6cdee2715e6d1c9c0fb9cd9a42d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95892e474b588b214efa62c8b9b50f22

SHA1
9b464e5556b6964fb8ca285793fe49ffcd755a0b

SHA256
e221d5359055d0daf035144b541df859c7850609be27c431e5d02a212bcd58bc

SHA512
d6a4575374b73040ca79c96196affcfb79f23a2f819f92897275d55448e9d4af76d43a449bbae6b550263381192953527f4cc4a06ea47d420b9a580bd9af4c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9bad57203d47981a311b72c1be662d5

SHA1
8e564a96129a6387bd7d2eb95ce1128ff7df19fc

SHA256
effee1c59735cce42c5d316a55885b8da7e51dec5f57ff8031b406352010981f

SHA512
b7212ea5a50fd721a220062ff2de662fc2703953e67ce891054daa3e7e25386ae675b1e43f5da2cceec2f962c83763c6a4b482148d8e67ca51f56db883d0ed1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acad245c16c913732d26b1bcdc7cc277

SHA1
08cb8d0f60ecf12d9fccf7a70c16f5173b83991e

SHA256
83011a7a6aed2cc9f9f24d3db4e2e51029b26c4b8f12ea5800a0194fcd3be593

SHA512
99ac397b8f202510aa32c28bed520694c361134f913388d6b06d67a3f2f3fb48a8591aef614b8d1669a2fbdc8700e3e1ea79a5391493b311aad3f604d1a9bc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
376f24d7f420d7ac989346342080eb68

SHA1
1bd55ba057909f161b56b0cebac74c58dd56ce32

SHA256
ec48bcad32d689f47551c82f8344eae07fe266ee8fd8d42a5201ef117f27eab7

SHA512
9f1713d5efb7e74377614ef7a4cf735d44f026b1dad7813555026cd3e2f76361f13842891b766706555a6a62563995e40c890a107d9bf46ee1de5442ef8e7f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e8cfb01376fd893b00e2c855427e27

SHA1
e7e55c36fbdb99e64913d852036fed2d0d139c21

SHA256
5d46f408ba35eb8343d160808d0637ce4819f405af9ff539c554edb7669b87a1

SHA512
84a027f7d243488126dbfbbe39435d423a8b1c8e312e0f91836a6cb23757828dab7e413394f7ba555d7391e950cd90d2cd55d613c653cf61ae1065b783bef253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6eda3fe1d10b68d7a41f66f960358f0

SHA1
fe9ebb8b88a4b1fc03a5194dee29332ca8e45de4

SHA256
0bef2d7af4736340c2f8a52147427c319acbd2ca5a40b99053e7adbf5f2119e7

SHA512
6a83566b77606364662b0227a0c84898bb45b8bbe85dfd9f9897f2abeb078e181d76bb3ed2191c0f1dceac0624abbd491d9e41823179d8acf7cc361647bb75a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
836f110d13ffa8c9bab014cab40a648d

SHA1
c3f818617ed1b2f34b9b31c2817d3b2dd6a8f06c

SHA256
35c23ce87e3a2f623a69d356e94ce904d5ac2254bd4db8841357f7ab4cdfcae7

SHA512
5210e568e96f87860ad358ff78ec52bb3c85aba4a3924df2fa6b0fe00dfc4dc1c4103ad456a3f8890f5f4e5047ef85402c847c90cbbb60e92a53d2bc74af5408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ef663c232e42ad66707ff54ebd5e7e3

SHA1
3f12359c23bcacfe2f92fece98e5f587aad8de2e

SHA256
e5afbf851b8da807323e6c9e42d8aefbd47d38deecaa5e665578410638847a4a

SHA512
fb31a63537a0d29c888bb9202660ae0879e0bf97ffe8c679df7b28f7396b502e3174697ed0aa234f77aeeac8271bbedd9426f60a1d1c060a8f886a85a933e064

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E1B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E20.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit