aab409c42860a23f81ff0c0930e531bbbfbc966637af75051089df09fb2be364

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eb366cbaf2dae0ffbfd7de82bffe67c.html
Size

41KB
MD5

1eb366cbaf2dae0ffbfd7de82bffe67c
SHA1

6ee19117b972e9cbbb7d0d172d4f84701fcb036f
SHA256

aab409c42860a23f81ff0c0930e531bbbfbc966637af75051089df09fb2be364
SHA512

5af48aa75d1d9789ff853e733c58ba167c01df6fbf598bcc3a798dae36d0bf2d73bddd9a9ad098959fa4aa9aebfb41c789902879b3b0aae6e0412e12992de6ea
SSDEEP

768:FzIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZhL:1IRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b3efce51e10f1e39e054b9950a49b3e8b85d8f38c95c8dd6ef4c3aff2090a345000000000e80000000020000200000009012ddb74234f9c20f1e96e55b8cc18c0bdd240900e10b11185cafe1ff5c6e479000000094cff26cf5e31371313d6a5be1ffa5099e283b2620887b8e54607edf2d9380b9d4c9f8bfc6c71ae6488541fa394597997576628bf42f25a09b792267579b5951456ab6dc37d4eb29802223ddaaac2f212fa7bf41e284af1b46575134d5e4feb18d90e8613c46c363a77b2618f10507e72f737c262d715b2c0b241b7ecd87c744332e33e341549bec09fb930dd78c33a64000000085ecab62f449c951ebe6a0bfb07d91e9a4ee2d1f3523e3f9882aab5b019dcc275385ded594eda75d778182a0893014b7a0dffb5beca840380a930428db08a7a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15540D81-A889-11EE-A623-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410263599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60227ef1953cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e9c91ff876822fb1c7a8d63c953753eca1491ba2709524c0451c5542f862b96f000000000e80000000020000200000004149ae20a7de8b62e384e308dfc50cec8e6d5e240656b8b2f791e084318cba06200000001e990047e319da7aa8512195080ae373228b7801908d3567276745916d89fa6d40000000f5594b5978051759547da5b9ceb751bf037af0f86eb69f89dcb1efe9f335671a0ac8f8f60e1a5696b1377eadc70d0dbcdb826815cbecab972c1897ded3fba998	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2284	2536	iexplore.exe	28
PID 2536 wrote to memory of 2284	2536	iexplore.exe	28
PID 2536 wrote to memory of 2284	2536	iexplore.exe	28
PID 2536 wrote to memory of 2284	2536	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1eb366cbaf2dae0ffbfd7de82bffe67c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82048b602846a6cf202aa683f4915561

SHA1
7009a40626faf74d5e93d9968754ead0accc18d1

SHA256
57b667f2552a55767626673baa797a308276998d9ded472fb8a3773dbadb7916

SHA512
e1e6f133783dc08654e7e5ecdfa92f6ac539a5429e70bd434a4f0cce8770fd632d9cdffb813ecc04c31452dc7a3a48e3d4876b3fb9305fc2e79c13276a2ebd14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3f58e2a2f0d1659d2810638c581900

SHA1
28e21fb6343a3f13176f9713dc19567c6c44d4f5

SHA256
43d1d320c1da801def01022422f9ab2c2135f51cee0036a12cc75d200010c6e8

SHA512
588830a3a72cce5bd890dcefe04df0ba54f98fa71602f16787be5430bfa00201861c8d7113dc9caa4804b43bbfef20c57059eed3fd419ba9957dca7c87414bdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
138a936110e4400e363d836591f8e213

SHA1
be0aba66e07a41dc1ef9be8a198d0f04eb1bdca8

SHA256
214b1fa9196b375163a91df2fcfc9670f5b5a9c70ae171d018ee7b4446f61f1b

SHA512
794297e5f0ce41b96f4ce752a5c7e30e0f5cb9ccedee6120b4fde1ab5b0fce7c1ac59acd93024f210b8249bcf1d10985650496da31aad63852db6910dd14e4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e351d939d3425dc832f2c1cc1da53d

SHA1
3ce17bb49ec721e79d76142e78aeea5514b5aad7

SHA256
cd72196d5e35307f756e70a9eca8d49c5c0b923a15eaf5e0bbf2f8707988319d

SHA512
3f0643c9e3cf42fa31860fb5af8996be219464e48adf8069c547ef4da73fe0ebe7c0f0a1bfe34b08bacf901b656605e13c91a6bbf3660ba4d9034abf7e1d6c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da1f5af6a2104746f22acb84e38c87d1

SHA1
a7f9f4e40c222e175f73a5a6a716fe1ef9cfffd9

SHA256
4a0d07bdec3f2ff268699bd8471845e532cc2c66696e9f2f56f4ec630bb19d48

SHA512
402dca0c262d8e85805a54c9463c84a1c9345e057ef87ee580829e4d2a6f116dd97c15ecb1ddfc9e4d885407c4d152a0288e5dc62639511bb8b2e9b804f8b554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a904d82e11a29892a331470345c6600

SHA1
62cc026c067bd7bc6714cadfd4fba21c3a2cb9a6

SHA256
2e69fb7234b5d830c88f0a18d3eb1af20f905ce4be3e0250424c4ed3a679de08

SHA512
672d84c5bc9de8988035e57e6e2bc3cb63480615f4482975d75c72c070e20c78745a13e86479838ca8d3ea27b4433dab2a9186b65a042b29467fe9d5a5ee5691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d3dd11c8ccb9b211ec63af6805eb942

SHA1
cf25d4c9b158eb96cb223e9f140a17493cc801bd

SHA256
ade384ccb35f0ac3902d04323d1fc6d1cc0c99992ae0fd1aa738595bba0eaf93

SHA512
36a607d60e64204ec16342fccd2221aadb4bd0ebe88bb47db28b0f336c59ccb0fc4fe0b9d38bf130309cf10fa62075e63fb9f991faf7ec351706d2cb040343db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b0617ec86c4838e81d0758eb5fd4f4

SHA1
6a2d649ae2d32808a8868f48b48499c686e314e8

SHA256
ceddd6c83dbd750973c6ad29bb51f4b56c96df2623764b54e6eb602a51cd7cfd

SHA512
06b2823acfbe92c9f169bc11647ae8180c2fb379cb41cc73f358e59bbcedd3345adcacb439454a72a5576b8c7f87d0f3030c6beaa84d2434baa45caa0b66544f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f3ac6208ad0501864a897bf2d8bea7

SHA1
ac7b9d5f1eb57f61d950f7ed4444b257f74b988c

SHA256
3daabcdb1c3480f5b074d198d349c9025bceb7d31dbde3384706fa905724df9b

SHA512
73365bbc58447cb753751db341ff7bc69e2d3f31d3cf69d2a26d3054f8272a5dfcb7b37136b03085a29985b80003e3495ad4398f7625f8a2b00503af64793682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eabce271cef9679f3bb36b2a04b3a56e

SHA1
78b3771c33a7011c02dc7e45d8480fe6acbbd9a0

SHA256
1d4a6d35d9abf17a10a5cd1a765fb86a2d2fced73f5f0decc45cf9e2f9436a1c

SHA512
a8379dae331a9cb038268dcfb22313a1df168ebac10130ffa49c677351e9f710c2cb1b3b0353b89f03ae5b439e7ebb6c5af8390b48c50b824f9a3e2482548cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
236fd86a8269e81bae3ee4d8b2168b57

SHA1
7405fbcde884d680a1c79a10a357f03ba75b3ead

SHA256
d7ba2c22e118e668d4d233abedb2125681e5a7bc31775cee7f855848031daae0

SHA512
c32827a818bbed2c1faac662a9d7e420ae5fedba04ff3867e675a9ca1185cf0b74069c0e39c1161a762403f661c2985e0c6e109ef0b4777f784985cad4f4ec17

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA46C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA46E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit