f066b4cae5fb7b6150c51076655fccf792c0753f9409b23ce708ec7f671c3e64

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ec7bf9841a10d4f1a7135cbfbbf2a2c.html
Size

625KB
MD5

1ec7bf9841a10d4f1a7135cbfbbf2a2c
SHA1

0ea41c6d7d357a25cbc4bf163ec3d7194d67b004
SHA256

f066b4cae5fb7b6150c51076655fccf792c0753f9409b23ce708ec7f671c3e64
SHA512

d63a22bff792e24eaa1de65f397958badee78928ed890eba9136c67f15e5bb107d6de655a2b89a2d032217adb65b63a9569be5c35606d8cce997579673fc9c47
SSDEEP

12288:IqYPsfdObbKdKIAnospUGr49rug48zX1rT3S+h1aha1AgV5XQa7ym:IA6bKdKFnoPGk9KgPXRLahQ5Tum

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D81F39F1-AB29-11EE-B0F5-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000034192674db61db4a74074dffca761e1041b83c13778498ab58aeadc871138fdf000000000e8000000002000020000000451dc8667b91d01cbc068853361f3d4798f1fe601955e5962f68531d7bc6f6c290000000107c69941ed24deff699394117fe1a5ec293ccf9624b82627cd01cd1f9617c6ce53899d47df694c8f8086917c728c1e1d10f28fc466c65a4588f21f34f236306f311e58415e8644068e3f2af176908275e0bba5f2781dc61656f6a866948dbe259f5ab3db334101df3d8b36f422d58058ec0b67f75888c4e9cbbc4a13eef7f8785cee8f4e801967a3f617d2c5f58b75640000000512b03d0f55f920c482fe95dadc1235c7474c88d2e481bad444cbf426ea2351ef44b2d5e197350390b23b1d2da8bbb86e95507ab7a052e200e5cbdc9eaa1e806	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000042d920c6fb41530f4d9b4db0ff493d75b2d97ef0e5105dd1befef69467ed9a3a000000000e80000000020000200000005faf05166bfaa4ba6b710ec9ce26b58d83f613de2396b1e3cfbb889c33620e9e20000000609963bfa3f6e475932d857f1146353fbce17d87697825c363273a880128458f40000000a1bf6ce162bf09d9f45b0851c283f1264374e200af3eaf973008df75a1e7aa411910f230b515a3d83903ae42ae0e86a93a31804bbd0251ae61d0b161b418493d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05b8dac363fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410552542"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2216	2288	iexplore.exe	24
PID 2288 wrote to memory of 2216	2288	iexplore.exe	24
PID 2288 wrote to memory of 2216	2288	iexplore.exe	24
PID 2288 wrote to memory of 2216	2288	iexplore.exe	24

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ec7bf9841a10d4f1a7135cbfbbf2a2c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4e2bbb10647bbe13072a1cc954382b

SHA1
384cb1c327fae1c03fcd6291dd3d923fea9ae997

SHA256
382259832dc9fd92d37353770e57ad24786ef53884407209fb42cc85e07110af

SHA512
f8819eb8e84cde79ee406d75e305f1d68fc5f8123ed029cf88f73ae5bbab8da4ce080e33cc2eb2fffdd546523ce793edad581eccd00e448c45d3ad0c4168b4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94e1477672d138a3ba87693288fc2b43

SHA1
62e0585ef2f5b58032bc5ae13221bd678845bd93

SHA256
bdad897ba995465f376041800dfd53e64e5a1f0fea2f2b182646d98d69d86cba

SHA512
0adf93a3020eb566130584483a60b0331ba63b83435ed29b2ea1058e1f1cf328b796379c93990ca34637c693f2915c0d7af88c26a348eaa13dedd7034fef96ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97b516318a91d471dd690d12618455d2

SHA1
553e8a4423723d91b032788c114db5d5cdd717df

SHA256
dcbdb74574067bb1aee5d4162b3bb0d6f8abc6ec9125136d5a95fb61442fa078

SHA512
60e7e4220cf2d5d3df97664a79e624cb1724a8a11c3a689397f10f4fb1c3343e7ed6668f690389fcfd3be474d61b3de0fcf34cc92e8e104073ccdcfaa5d187c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b98a01c313aeac5c8262f8d59a901a18

SHA1
a25b357e0a06ceee6dd6569c9d5e440b58bb75b5

SHA256
84f06d6eee579be96cc9cb3fa6e68d43a8329900bb7a3624908c674856854d64

SHA512
857c5761f9a2dfccd3ce8c86899f263a1f92e2b9b1d7ab915cf71698e529ad0bd1dbf96684ca56dcaa8c2784f1c2f858a169f72e6f183e440ad8d3bec47ad3c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb5cd6823c98c292ee165ef4ce230ca

SHA1
f0325d189ecf870105ffbec350295fe763ff2838

SHA256
1698a03879d27d18ddc6d282e6bd6312a131d588e4f6bab86acffe9eb4bf5b7b

SHA512
ba7eba144e15bd307c06ba035a482fc0e8f849689c0cb0e9c2def96a2eb83ff1d185bc1d25284540a83b98c85aa1a93fe2dbc6f7426b224a4b62ded510939245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1d64f17c830a986161a101ff787238b

SHA1
a50568b1577808a863e2307f4763d538db23b7ac

SHA256
8cdc4415230861be54821a48dd571dab39d5e2c79fbc79509c9e61249971b2dd

SHA512
5380656e64c9d00be7ee9aed8f4cb361471a87ac220c512fc1d08d9de0e1b21102d9e5048b46f9100e0ec5441ed0c3736bc454412cb9f3a6758fbb98956e6dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e822779df5fb764f95273d08b2edacb

SHA1
b8c545df34e139afbce59370f54197ce1da91fc1

SHA256
6182fb66ec626d71ddfef1323e8906007f5d2096e2742a06b1c83a0afceb35f5

SHA512
adffa7ef3a3d879d1e18a07beb74fbb790a80bcfdfe2265b942ff50d8a6474282e9178e162c19d1af315b31f0cd394789d22cbdaed8ff1f9d77f9a8a96160504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f80ae921910cd02d758f3aee733b609

SHA1
91c49b46db4eb23c2467cc73970012d43609123a

SHA256
45923f9d9291155954b5486cf3d418e19ea5362f462a54de1e043302d9febc9a

SHA512
795328e09c6f6d03c602ccbfcec2e66f9c870e84d587d8fad4e005631422ecabf78b66f38cab459b8f91537e1abd94f4affb436ba3264e4f38cbb10b62ec2b2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92128990028ed552ef7fe249d937b836

SHA1
6c12087e944eb8d04526bdaa4349fe0807fc42fa

SHA256
a3c8f549c5fc8316c3b6d373834ef36b485a4413a9847bc23797588e3a083b9e

SHA512
97cb6dadacdb6605a06168c8c4b840ee6833653b87dd8b8b8d6def6245b62707f0a8423fb86c579009927007f49ffd7c61310d1d4bab95ce22cbe07f68c99d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d542c2a771aa8b952032a7e352c53f55

SHA1
8c772271be7c86132531d49ef540dcf15f9f73fb

SHA256
e4b366da5b592a88132a17d6570f3591bffeddeeb93bd58a4f386951b1c5b182

SHA512
a8dff0b5905e038f82461dd1d2a6240374082aeaf37f91982b8bcf0bd9801acf7e3d190a5408a5511e69274ec0fb774c7a0546b318bb98d0c92c5823d79168ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fededc30ccfb06c259fbec4cd0c1baa

SHA1
9016a30fc28d73aed3b2bd61e5a64008ef2cdca4

SHA256
e1fb9b2c3d29a01e1c63c26e98286255035980da049c9523eef9e35439860476

SHA512
9ad92100b43521114fc225e0810a38d3ac93922c973e70d56a020bd510e941dfa986b2764c0c60413089e66e4ff23b65c56aaa0ffe334d320a22526feaced5ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4241.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4254.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit