8d9889616f598e1ed3e449475730951d0924962ef01b1286a55595f036e7d056

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f296ce523105536a9a9d9c4715ec712.html
Size

6KB
MD5

1f296ce523105536a9a9d9c4715ec712
SHA1

6606c3b958cd6541e3db86350c0b9f8c0d238af5
SHA256

8d9889616f598e1ed3e449475730951d0924962ef01b1286a55595f036e7d056
SHA512

c4cebbfe7f527b82dd589a719211104c4e382203bda146ce0c2e0d98775e1a03cca88fb2a57a033cf33f766f52555cbc28dbae3718d37fe61dee779dd5f7b185
SSDEEP

192:Zy/O8yw4RlDEvHLgszgAY2ydXDChxiqEuf:8/O8yXRiLgszgAY29iqEuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED94B2F1-AB2F-11EE-AD90-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410555154"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000007b56e15ec79539f5c789d76dd6275e500abae8ea71558162f626619b71be81c4000000000e80000000020000200000009d2e259591101109dbfdbade636e6819607707c6b44e889e6f43a3ee0e4b4d5c9000000054e51f54808ae531002ea3e5fddaf89762092ba124636db402f914c8027192266ee375178e8c6775d64e312d56b17cfc1a2e02a6da57c923795b83004f52a8c28a2b5d62717c192b6e06387c35f1e96788809afe99f101622475f46ea5a4abccc9175f26c56eff2660a2f695957af1adf6687458c7d1292db7848b1c259f80f8227c8eefd219daa87541a003ab0d9b3e400000001a8847ca6c75db4866b7ba09e397e8945c67cf30078fc335e24eeca8b11888d57a709cc8199287fa48796c764cc21246bb37113a5bab790a4b99c386c6cf6a52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a3dfac4f3b9c99772ac924f13795422ef5df97919251039eb45698e68d8f059b000000000e80000000020000200000001af9bcce2ea74134d93c42a2bc3a70e14aa083b4cb6b799aa21cd81347d717a720000000fca5a9afa6246fa059f6ec508116416072febbbdb3fbd1b5fcd4a6d02f2d98a640000000c89ad27e21844f20af5df6afa998ec01703109e5a70da4d063c25a04472bbef4e6c2ba6305421d22de5deb0263ed68d9794ccd959c80142e1d0b1cebeec2c571	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908e1cc23c3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2520	2672	iexplore.exe	14
PID 2672 wrote to memory of 2520	2672	iexplore.exe	14
PID 2672 wrote to memory of 2520	2672	iexplore.exe	14
PID 2672 wrote to memory of 2520	2672	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f296ce523105536a9a9d9c4715ec712.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c70c7b5fd30cedee1cf28596d7a948dc

SHA1
44b40e5b90c0594263d4583a5a5719131024da01

SHA256
abdd4bfa92e805377a9da31bf8f8a3cdd284f443049803c23e21469e923ef2af

SHA512
ea34bb76acfba882ae1533f618da0a25b4255dc3e01680fc605a7efd30d398125581ca56a5d722ca080dd9a6f3b3b975180f3f092f505cc1c25c0572dcc8affc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0458a5638126adae606199c64d37d359

SHA1
317c8080d188aa98641dceeb7156c54ec781f076

SHA256
03e639ea8cace6d73584adc1f667d08e07e257f320617956641ebc70ef35387b

SHA512
3fb8ee90792ef05de7156efb21f159e73b6d3a770613a845703fb8637bfed71b648c5b769b824a988d5021c368290309dff3d828077778b94f276bf376987be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
914f1987a90b7a7579b75b49e8d6875d

SHA1
1949b86e9c2d88b35bae9de6ba49d4cb85b494dd

SHA256
faebd6c62becbaff494cfa6079a2416db741403a05460db6ef627013bc315c10

SHA512
ac7b2c6dac05d271042f7beca7dbc6d9e947c729189953fa7eae9a8aaae4f742f4efdb5acff6e47f7392045e831f15bbf805938819cb829d1aa36a03fbe901cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae08bb4f4645ba434113ce8740290a98

SHA1
76d80b873af6bef8370101436f27ae02264fda83

SHA256
19e9285afc7ac6062f70a81ce17b8b884c7c2b9c88e9f817a27576df27b284e5

SHA512
65cd5f5b3b400f4da9755e61d3828549aad05f49dc9f0fbb0d108f2276116115e9ee8a447bc974bf0342033683718f4b7b5eb96e81ecd3d45b39a10defee258b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9276f0c80a482f5d02050a4c1a24b6f

SHA1
ad43facc3a7ca509b8256e65070683e58776085e

SHA256
6ad4af379795717e08b31dc7fe46b43412bca10cf376b7b347a2bfab4dac7aa6

SHA512
a40cbbcb966a0a8434133ca6fcdb52fd0b5ce01305f0cec2095e479a44648ff69dcde4ee1ca1f9f0eff3ec660b741dfd35d3ff14c7f78617b864e0fb4dc6d3e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa1c6201da5c65490af5fadcaf48b4a

SHA1
15b1d6c9b48a2adbd0cf50999fb1f0e29c4b04c6

SHA256
020b9d47e9c9b2a49c8879ef4446e45ea2ea342da4096514c0d3b4355ab77849

SHA512
d381c7b589cf9d4b165ab92a4049920bd45e001281be68eab9f4b147ee4ab52ea1b03b726ee97221407c84fbeb80a0e7213ab0e2b3b702b9839cf5817f145d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb46aa2df865425ebdf932c3c766230

SHA1
8ae1352920fc5d4fb01e7bdcc6aa2b3f37b64a75

SHA256
8acc49bb790dc689a7833408b08ef4949cb88155141c0b8b1fe283de543eae64

SHA512
b30cc59a17c013e78a61cc79276fecaefefa3f9d691a39272c6944e808653c109ed30bc274020ae04e14634b01c71a04546ccf081a0f4998eb5ed6af93023b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98b8ab9d37135589444ef817e6381c44

SHA1
d3a54bb61c0f85f428ee19550b7c6d5f4de28722

SHA256
c8699e5deb8e676a98814c7ab69f81c89774267c1845e6ebcd77c32d15a44fb3

SHA512
07a9ec58d6da60fc4cf5a28e6f1a0688de471647a35d4f69bb33b7f973ea19da8aaea1beed2b2cb508f40f41c90830bff96637d562910780e7801cc9611b620f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d711488db07560b2375034e914d60ad9

SHA1
cfb649bd67efd2d32e6d3e39f82db16dfe95681c

SHA256
5abf5f4716092fb6cf4a0a28e616eb424c331060638cf8bc7434aa835d87cefc

SHA512
7a8b858b1e5ee83004067221819a201513c6d9fe28b40cffe1cb9d44cf7d5661d0152899f141fb09f5f5e19f1c6cd1e391ca93d903f8f2302ddb82b5e910d6dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3b2675a67b5cf303b96b1c424db30eb

SHA1
a3b9df78fcdb00c779eb3a680ac1142814ca182e

SHA256
98097efae8749d9bed1757b0b736f87cd465f8c0c4d9f0ac811d565607e3c4f9

SHA512
cececd5428beb8c97dadd1b806d3b2e19d1397b615c2ac128a0a6a7c29c3af6a6c1935e4e27c0cd1a8b14a98cf79ca42c86a720ba54bf790423da5f92f78b6fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27B2.tmp

Filesize
58KB

MD5
3a9206d49f4ffc8d91e3b1a935c7cf2f

SHA1
e73e5f38169d5750578665ad1a8a8edf219f954d

SHA256
202e795dbcc674e1c2e3d22a6f9bcdadb040edb8826312571ab8196c795fce23

SHA512
e33915e51fa708e1f0f9a523b3f7260c39901f9519d7fc7bec230c831934fc82d6e02cccf04ffbcf36b4ce59642a1c7039276e311dc10da7aa479a97dff722b3

Download Submit