92ee4d2ec8a99a7ebfa1b128679e3ae46e235652199dcc3e4a71e79da799d240

Analysis

max time kernel
34s
max time network
178s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1e3a03ec54c946366abc97d8abf2da59.html
Size

160KB
MD5

1e3a03ec54c946366abc97d8abf2da59
SHA1

22a3e7e0c28966e44a69680bb85b1a5968c39978
SHA256

92ee4d2ec8a99a7ebfa1b128679e3ae46e235652199dcc3e4a71e79da799d240
SHA512

af47b76ebe6469c3df95cfb26889e2059480d7be78cd7434385cc5e09415082eeef5205805acacfbc225548de64169d1914868b4d51cbf1d9a1d81f2d3f645c8
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcV5CHAeHBLIkSmcZHuqMKp:sBvhLFS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53D3FF51-A881-11EE-A297-464D43A133DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2364	2708	iexplore.exe	20
PID 2708 wrote to memory of 2364	2708	iexplore.exe	20
PID 2708 wrote to memory of 2364	2708	iexplore.exe	20
PID 2708 wrote to memory of 2364	2708	iexplore.exe	20

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e3a03ec54c946366abc97d8abf2da59.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c243ec2483bdac751f9fa6ab1791887

SHA1
2022573e09d44b4967dc184386339fede4d2503f

SHA256
f1f64efe054d71cc0986fd9f7066442711bb81c9a18df39e6b896dd5befc722f

SHA512
84aa64da54f5a5cfe2e1c32fa21850a354c64cefe46a7dfeaf830f84fd4b21df64f7800675e4fb03424d58bda6fadfd2b97c4b54f4187c3873cfde92df1d6e31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b519e5dbf8a05750bf6bbcab033fd2ed

SHA1
687cf1469292ca5ed9fe3e8f6aa7ab1c1ab3cc6e

SHA256
924616e8e9589b7ee9bf62c7cd96a3289ae3ed6694ee293967487220efccdb4a

SHA512
cd819b30bd14ecd74fd5c85481db160541ee8e9302b330af93c71eceaacd746519417092e0afac3384a2b03ea5abdde2f8992ec31a97ef95d8c2f311c9803699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81178aecb179931013a8a4d8b7e63934

SHA1
177fe51c99b44bf4256b0387395d664f0046dbf8

SHA256
ed4e0814902b2d656c187fa09d0fb608c64e193f151c7f6e09a2e54e4c7b1783

SHA512
acb02108726c6cde0fb31fdf3d32fd22c78212a1a85d11360bf6134f45c8bbdf7fe4a12a74cbb9a4fc5bb9a825653b692a7b977b40e99d4d20c7549ed3b3edd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08a847cd500797201cdbdce6171ffbf8

SHA1
c258733b25b55f846ebe2a35b01327f5eece2286

SHA256
d6ce76d7fc33dbf2d0dff0c9878d05d4dca4f9bfa4fc58748041d76bfecd8f59

SHA512
86e0ed8aca0b1e774beb0f77dd008091af7b6cbabc4587b5841c5e4d7a260abb63a441b95db9b4f931abf075f967bb02eaf7d5233faa263835fc3a169c4ec77c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27cecccd8f458637c3c00b991b7a3352

SHA1
7939323b59fa5bf26b612c437bad329d8f61fbcd

SHA256
f75dcbd66ec538b1ae6a30f5412ace929635f3ab412e5c0bcf46e865516cb600

SHA512
ac405e3b62162c2e970af359dc07c78f25dbf0b13d12da7180635a0d223bc968324da1e854720171810ba0972f40e0816491ce18f2ac5845d922939c5ce4e347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8650ddad86498c208cca8d696d9addd

SHA1
dc59a21405817603dd5110c5cd2ec48513d2b6e5

SHA256
ed2fd9983e5046fd03d710aed217309cdc22a5ad5b2573a3810fa6e66c707355

SHA512
0e1a9f1d073fd86370c2825964ec5f114c2c5bf638ae1d435b950973565f270f4aa9b52420ff0ce3ff12af3addc30ff132902f76b81d192f7f97f6b98bfca879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8f37efc004ef26ff0e6ac7940e3d689

SHA1
d92d4e961db3452a7e5380cccd30554958908141

SHA256
2ad811121a4d5642fac34a3529e05ab38640e97c4fe5706c25de4a4ee44e86ec

SHA512
4f47c61b544b3f57fc6307cb6fb948ab67b524027374f07436c081e46fb0b11872a53d4ffc17db5f01a30b2aebfec13ea563fb1612e1747d1aa02951c708ab88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc4b84d7a9e514b580108453b0cc6e74

SHA1
ad2f036d45409a19744eac984ea946ffbc877d18

SHA256
1e2b78367c1f48b6a7b31c2b3d75e1f31f45324de9b66a62c8cd6edd1d47be45

SHA512
78decdea13ba872de79326a9faeea99139b5fc359212033c2c21e6e7d47c8150a9bf07f76fea50abc981058a1c30bb11be68e72bee9b25f345b13027e732717d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f1097617268d098866f71bcf74223c8

SHA1
813c3ce53aa77381af1c56945bc3c1b6d4b2f684

SHA256
21c99cddbae79276cddfc3467addb309f548008153bfb3d1a71cddf1e259522f

SHA512
f443a683b7f46694b5fa39ba2a479f5183990292b2340f622ffbdfbddc7e2ac9cc497195b1d52ec803114b061094318008b13135fbcfbdb4717ad5a5d1a79a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCF62.tmp

Filesize
44KB

MD5
580ded07183a0a755ba9b6826af2deec

SHA1
fd1e0cdac3ad4b182ec60e357df4439e811510e9

SHA256
bc83640397919b66f62698903c43d5b69e81fd81767bb37d676d642e5f6f02d3

SHA512
71eb2a7dd44e6fffebbc266ff9c5d99b1119168aea60470c40155a4e34aab691d3ec3cc5dcff08b78fd1c71d9d113ccb2d295eaeb5718e58762bd60662688b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCF84.tmp

Filesize
41KB

MD5
24f0fcb07e8fe99b25353abc14662d8b

SHA1
3c5259b296cea8ddd4d7225f6091958fba16a605

SHA256
331e702943fdbab2260213c6074d5e150bb3e9df389f762a67796ecfd878ce52

SHA512
3a26119204f175a3a950b68ed5bbca7682899a7d541e79524b0ba7774e431f737f316c12206a916347e84e519e3910f961321bbe42b8451bd05fee8d2cdbe08d

Download Submit