2b7d85a67317d07cd340237680cfca15da8437c5a9cf054e2f7e06c8d0feca92

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d1e5902be10cbcaa23c3fd5452af5a0.html
Size

24KB
MD5

1d1e5902be10cbcaa23c3fd5452af5a0
SHA1

425f054803472bad3a23434de851cce3a9c65381
SHA256

2b7d85a67317d07cd340237680cfca15da8437c5a9cf054e2f7e06c8d0feca92
SHA512

3edeab7c01cf6581620264f3aadbf9ff445fcf4a9e94fa52e2806b66bed6a133ea52e5f092a00473f998cb0dc8f44c61463090399cc9f9dfadc901d5ac355056
SSDEEP

384:/X6qUVkczFiX4pmOdOiuoNo9oD0Vpt2D58tAYsNNlEeo8BYU1ke2D:/lUpzFiX2XAt26threofL7D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000036ad97f511529ded72dd69af42621a61232ae7d5b86834475394578357896107000000000e80000000020000200000009847d37176fddd9467f68526271dc5e7cc3f5fdbb0832cb7a17a8853f96ba12f20000000b640362f765800537ae2de5245fbac135f44c7d2e44db219dbebb93f24a6abe1400000007622fd38eaee1066d591dfd8b5cdfd4f7ca13722ed871ac97a8d2f12d7dc0618a8bac45d973cb006bd4a7822cb64ccb4f17f0e6fa1ecdaa6cbe66cdcadd42383	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B874431-AAFA-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410532121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a4fc20073fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e3fa797eed2e0304194a8bae91b9c8181cd80a9b29f1a3377d801f2f4ae25cde000000000e8000000002000020000000957fe1e4e77f0b6018640aa91dec42454c61be2bdfee270aa9b69b00bfa6cd3b90000000a705b03af91eb6d557d9476664c49c6ae9d18992d8fb5ec899d91595bb848e3c2354d51549eba89225edcfbaaec45f32d44d089ec576b6229a63433c11f63b2a0eb1df6548ac4754c3d3382b3bcafdbc871455d024af878d40b1383bf583c08ae6e5b159ec2a1a281f8e41a78d16b3eaa6bd1e0d68967584a843c9ed4aeda730525dcdcf7be96070efc8ed432027d0d940000000e980f0efc3386e44341d21ea77c1e5c23e5cdc7adf5698a0e431f07957e5a5142e4e68cd8d82c0d1cc9c5ede01add1144f8057b1af6ffc1a48e50555845fdbb6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2372	1948	iexplore.exe	28
PID 1948 wrote to memory of 2372	1948	iexplore.exe	28
PID 1948 wrote to memory of 2372	1948	iexplore.exe	28
PID 1948 wrote to memory of 2372	1948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d1e5902be10cbcaa23c3fd5452af5a0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe6737fa3afe75d913068da6196d39f

SHA1
44f14b5065efad55b65e24f4c33a72c6ca213233

SHA256
40b21976c4650988e26be736a45db065b33ff89f7f70df59421fd01809155d31

SHA512
954b1522a9a57bd6b6a24ed71b6018f9c5dc8c55ded08bdd676f0eb72677a81e2de9a19a23f96419141a3f9368966d91b37438c237594e1145327eab29b9d937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc07007e8ef8767fb4c4913e0f123489

SHA1
11d3d67ef76d2a36e82be1693d5fd14e5950cdf0

SHA256
94ae2d21820bbc04e03e51267acec12c6d2ac6d9c8335d971f9c0836be358781

SHA512
d27f63d9f2e71f8b5321b087998c3ad6e436364cbee7a2e9b8c6a541b31b7b4eabb01f28a3a1eb95ec727b14b1fb655063adca9c1585a3c62f6a7f4250eac42c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ffeb167a767cb9270a1d96203dc699e

SHA1
ab6a95c50adff38c49dc3c5a93bb5f0ab250e6c3

SHA256
8266be9e722922b395492e044bd736e3f051d9fed7e493b7456c98b9a7b7c2de

SHA512
6b92148c724ed6df67c968045bb52edb52ea1feed20f7185c0bf59afeca53e0a2708e35255afd1997ddc98b50dd592737c5af566a9575234f06d3984feab13c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d989bab1999e9e17296fc6b2ec3683fb

SHA1
dc467a72aca94d698cc0dd5bc64cb2933f0f73f2

SHA256
63dc557defe445bdd4bff91aafcf281e7282966460144ca8b37ce58a2c293f41

SHA512
0a0ecee0dfed55a81371a882674c854f8bae5a6b9949e9f4914daf815dff3af0892f6265aa6bef5a81fc1f7912ba89406ca0219deccb2a0c305a537d3fe5b327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c396dde6eb7b05b80f68c7b66ac9c8f

SHA1
8229944189cbb0a78ac183a581f9a27ae79fef33

SHA256
f72082280e727b507d546f0e1589cd4c7a3698d1199af86de9042f08747ddac0

SHA512
dbc7bd37e1fa2068e8fd54b5d7b5b1f0d408eed77a0d988e7b9e5e44e5a1c6a62a330081c8d86664f37b073cfe336c40aead84619b4ad037f619b26f6686e006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f90f08bdb53ec19c2ed31a23e8e05952

SHA1
a1ed80c3f76c3fb8695dbbd73a119e22da39b3df

SHA256
0faf377e9e22c15e83a26c4801f1da4de6959bb8e2d899edacd30dcd5ab39a79

SHA512
7990b44af6bf1b518050289cddf095064124008b835a8b263ab7a635ba87888bffe987e613f3f2f8e4d5c29eb3936232a5a5a32d3d71c8691b6af9fa5294c07c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
539ed5882d94ff62ca47452ab252bc21

SHA1
801d3c24b69c3c0b74244eae68ebad240f4729d0

SHA256
b0a9bfed967525792fab8e2d8a2e7231cb64f43f4541d3603bda135680614be0

SHA512
d6ac6cabc8a032960db190267edcd05adeb7fb698225868edafeddfc0d1d08b44ed49674958a1eddf0ffb4915733c76ae03f3ce8b06350bd8ec19c307df19409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c3fe3461e811f85087188ac18d53949

SHA1
867aee57f91d4c65c5dd94a796d5ae21b109112e

SHA256
9571b7ea03c78780cfea1f1bdae116b5789eedcdbd7b180aa1fe9e09e65e68a7

SHA512
194879fc89bf6e5c609d98c40762e4d7ee03b9eeededc0f3c6cf845ddb4dbdce74aaa7699d63832842109a68cf66412412763b52d82a50a817ce3e076e24f19e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c563bc6cea5ce9309e92f547178077

SHA1
575e70c3189c2c4d2bfc05b53219fbabd533b0d7

SHA256
03eaa40d315f84ed0f0369bb1d24c0c438394e3c070c68ffa68fc4d89ec05df6

SHA512
2954ba58e8be3fb37f5fa7c0f4519d7f29896149498b4ccff2ae1f794d1ca476a1d3d1812c45ffd7111c5f0173260e908044d2c0b8c258e067bee45827c49c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
add995c5bb74711cdd03b6b5b6bc5cdd

SHA1
c9eaf3977d055947abcd0d7d287e5d6fa6e4754a

SHA256
570bd25646b51986ca0a27e49bd1c3d6edc17ddf78cd5995142f508e3b51cd85

SHA512
8760369849597a721732d9365fd697d79f5ea43895c322d15e307bd5dfaf2e7f752ca25fa0857fb52a3086ca8752fb55f4a2ad1a18de8577afb614c1316a2e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB28E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB467.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit