dfca8ccf2da604d32835df7eb5712471ee65f2a13e98da8d46229aaee18240f4

Analysis

max time kernel
117s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d68b7b34075f353ccad25b6bbe8c6b4.html
Size

62KB
MD5

1d68b7b34075f353ccad25b6bbe8c6b4
SHA1

95941ea18ea35584786aea32d49b8aa597b87049
SHA256

dfca8ccf2da604d32835df7eb5712471ee65f2a13e98da8d46229aaee18240f4
SHA512

dd246b2f563b89b01d6780a7ff95e12e048e295574c0726861264572426d04b9199a1ca1cc98435141320e1c393092f49c90596af04977d2ebd27a91cb0c04a4
SSDEEP

1536:qHPu3i9BbO35h4o0bgELCr93YXjGQPyUp9h8wOwOcS0K2yV6/TKp38Un78+qgXkc:qHPu3i9BbO35h4o0bgELCr93YXjGQPyd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C86EBCF1-A873-11EE-8CB7-DECE4B73D784} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0654a9d803cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410254444"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000bca4c63430713ae77e6bf99abfa7acd840a45ec65d4216c1602937c85e170fb9000000000e8000000002000020000000c2c005b00818ade935ce612169e464c19ddd16b1d0dd094094168a065e030f9590000000339a7f9d0b10716cc69614439f646314024ab6c865b770d5cd734ffb6e66f3253ef5d64b5258d87856dbf3dd6ebe17aa8fee89cd2b2b6f31f9c21c096c077145f30707313d0cbc82c6482092d0661f8aac39862ea5d5e8aeed91506f8a6543ac917d5187b42116dee8e38fb829d0254cbc8f33f9031a39e47fa8c3f8285ac1d987146d47e210b251b71ed960fdad0d6940000000a089459a0ac7af7f408b7aa81816455ba1b8e578f1053982f9b1224daecedb06f5f6a36e79440f8bf4350cf12bdbe5d7869fe90a14514fffae6b25e6cdbcb5f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000afb8b30fda132065f81487125bb6892d603f92075190b66f30c062bdad955482000000000e80000000020000200000005969eb8a5fde04d7b73a8f1dee4456ac60ab057710a493692981c110a01c9b4620000000b6e100492eac524b9944887023a6a1c665f68dd3484bdb09d291e9cf5fd8621d400000003cd969dc9af273c2c21cc28d445cbaa8ca5dce97ca49368414142720ad6ff128498ed5450bd4b3aa709b97eee958a0617d8c4eeb97be9054db2fdd6823637740	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2412	3024	iexplore.exe	28
PID 3024 wrote to memory of 2412	3024	iexplore.exe	28
PID 3024 wrote to memory of 2412	3024	iexplore.exe	28
PID 3024 wrote to memory of 2412	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d68b7b34075f353ccad25b6bbe8c6b4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75fac5a5a2fbc07c9dbe75b25bb32864

SHA1
5619d3b38bd7cc7f8efe9acbfae5608e539355a8

SHA256
f13066e92628090439c7cd2994c9205d7a2b1c60d0f74d3f8fe4b2f067e2625b

SHA512
687cef13d80767cc054360e3fbd5932d1f8db9a76aad57f11be55569c2cef74e4284a2a697a5ce10e31de38e9881524a8aba5eaa5b4f69e902437fbf4b4e3a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0ea8cc0ea9a2c6aeddc4364950914c5

SHA1
84933e88874b4d3dde585684e72594197ccf6670

SHA256
3a561cbcf2dff4eaf4a2e7202e468d0b6efd9336268cdaf2eac3db9ce87e6bcc

SHA512
4fc1f2dee02fe047cb44f311a3bc2897e9356b4cd379c066c09778e072849733d88e568b19230555b07b0e9c7093e1cd8da78f2b66fa51be427e44564c1e204d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a0c804fe8d1d1e609a0e6201060362f

SHA1
66e4f12939b9d8a1461bff0bd3edbb74c1225483

SHA256
9056efe2f09daa29dfd9bdad6a8ee1bb3dcd72d670e37a59983e29789add0201

SHA512
d2341a57a1cc585c3ba53d7bd7d29dfcf37daa2294ebcc50239bca9612d1ae401645f7e5b72530200a151281f1f9dc08df9c61a21e0c658843daa2e1983657b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90e51007f2be1b6dbfd400581083dd8c

SHA1
232b1815442aae418aa945fb7774356078024a01

SHA256
e1885e9793a4fe1eff9114c8f03d8f4be1e381be556630bf9007091b8a2e2eb9

SHA512
00725f28ab5fdfb641c9b30b8e56975839305f4f5e4490303a693ca695efaeac92937a9b90e6b54e1c1d847420ce57c4113dfb5aae327d052e070547187f794b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2356f3f754411661374ef6a4719abf59

SHA1
f7d984c182b639614388abbae6f8a5d8787dda2d

SHA256
b12b55c3f7a6c360570fa43a40aa86125ec16e30e0eee7276ad4320b22df81bd

SHA512
0c22da8acdf8dbd54877ade9222ce4466b961f541a302f9d196a353afd96134db6eb09397a21ac0319305479cb6e285e66ace469bb1a1bd53a2d24d8842a3d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
923f2ce49e9c4b3b7ed3bf6b64318095

SHA1
c161497f1dcdaef7001b8845cb7e65e1c077281d

SHA256
e76ce1b818c162030bcae7d10c6dac40080d3562ece7aa16e87406d97bab1a06

SHA512
6a4215306c67639a42f73f8a7248f6f0e692f07e7c646477746fa7ae599f591236a9eefa2d02d3db3bc082f011540509bedc4b1bf25866f986ea78d0012ba3de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb3ddd590a60416b289483026351f01

SHA1
3a2009ec0e0c5930f486b048c6280b817cf231da

SHA256
41f9aaa353b42a4bdff52a21db1b642431a43532d7d09e8beeac63c0b7b4fb71

SHA512
db59cf469cadef66b056ecd24230ea6468f29ed2f04ae644920706f7a10db5975a4c5f29b817d1efb7205b6fcb10e86601383fb5c2b5f17237ad3941ddf35e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf2cc547ffc8eaa59a48c8080bc46f4c

SHA1
2fe1eed56feeaeb5f5e2b548dddb07c8a8732393

SHA256
66d965afd0b2eb6869cfdf0310efad8c199b1878f2531d735510f257fd81196a

SHA512
0f85be0b6d3886f0c64f0716bb3546bdfc49c78c87b12e1f54bace4a255746d4da7a1f8973e826f0eb8d4413dd902026c182700cd11513799d91916de08288ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a183b357da9eed05a35869d7d87c1c43

SHA1
bd764caa5582297b26289df05be136578de64d35

SHA256
20fb80fffc2daa3fab74f07a27c64fdd59a29bf4f01b2020dc8510875daa46d9

SHA512
2497676d5e93aa87e5e7d21d53fede556608e90ace98e2be8604497473e228a29f9d146a3cb1b7b867bbf9ea48e01242eccbaf4ecc6f5cebca40230f4e60360f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA46B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA529.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit