7c1e368fc515188bd7037ca021c8bf37f503bcb167096ae8eb017e08f1b7dc60

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20a7a3b2aa2164981a6e6ef3b3d5fadb.html
Size

43KB
MD5

20a7a3b2aa2164981a6e6ef3b3d5fadb
SHA1

2482d3a150cc115490fb408e0ef28df59c2efb0e
SHA256

7c1e368fc515188bd7037ca021c8bf37f503bcb167096ae8eb017e08f1b7dc60
SHA512

7c39ee93ee629a7200ea90c7adcd763aec2ab6b2a59228529746edc41d1937e53c2bf4d2b1c17e2447832fd9b3f784a6789d3927ca1f34401a8de3c29d8b2d5b
SSDEEP

768:pswWJN09yfhC5r9vUjLp0xgD6wo3aXYIWrRgStm8iZPGg:pFWL0wfhCVu0xM6wGaerRgStxtg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d025aabdb63cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ce5e822d9bc12666c11ed3d949342e1bff30b00880ba920d9c18d5dcd42221a7000000000e8000000002000020000000b6e7c04bcd2f60c6d3c66a15d7cc653f95e462467c5c853e8d5e1e6bacf18722900000002e292c3ff9d9430a87ae10a5b4977eedc28c37f0660cbbed49b0d767e8bee8d574dfbee273ef0650374fe0d9c63370e53db4a17e526a23fdfeba2a6e44f0db000c577120e3873f1ed529a7dac8118e204adb322256b703009298bd3cfdcb1f8f8cfd4746f303cbb293ead8a7e1ff1e9f38d8baa32cbac481072403057c0454cf8f53d063f740da5954b0bcaea6c2edbd4000000008d515bedd40e1884b0f4048aa007826a8d2f1a338ed8a010e2f6c07b2114bc3af809c8a18e7f415f831dd2612b2ff024bf1fffe895124b5dd39412195f25bd7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410277677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE0793D1-A8A9-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005e3a9b919e60a0c284f8efcf1fafe9ef6da9679fa2f632176719d4d759239c01000000000e8000000002000020000000da25c9561da0a0d31c78713b0f4eac86e06b5d310f38b47f5281fb8845ffbd2720000000c8a596ef46bcbaf2df125763fb574070c6d94bb8f65a0ad890b0940747f3e9ab40000000ffbbba4379600d7d44bdcb3b3ad27f837ede74bc4ce61e820a48790a31aed226beaa72c89d6da4fe20f4b3ead087e3d580eeea2f39ffbe9ada61415a431d998c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
356	iexplore.exe
356	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 356 wrote to memory of 2344	356	iexplore.exe	17
PID 356 wrote to memory of 2344	356	iexplore.exe	17
PID 356 wrote to memory of 2344	356	iexplore.exe	17
PID 356 wrote to memory of 2344	356	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20a7a3b2aa2164981a6e6ef3b3d5fadb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6f8c87775218876f9a813d53477f3e

SHA1
ad694e21c26a9d1d5f340a21537364c633a008a6

SHA256
397a1a66a1373364a0021855eca64a6f902e73361f52dae26b5075149133a691

SHA512
72e32886219b721522e6320edca8954ed9922373488be906a27fedbac6fe0e63533556e4f1a86744ecedafa22e497812aafd3e31dbf9b460e62633782b73c072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a1ae1e6e6008cd202eed7d2e97e76b6

SHA1
320e5a7b76c59609a423b4602999c3773938e629

SHA256
11a5af1d5d809336339fa86befab95ded42a20347e9fa90d277027cec49e71a6

SHA512
07b70108eec684b3373b7689de62d676994a5aa34f9030980b587e01bce30d79671bb7cf8c044c16e067b519f6f930735be4253d30232ebd68ce6781dd92744c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d09b33a30dd22d081d05dcbefa46f7af

SHA1
e5e62092a9599768bef6bf062cee61332c64c032

SHA256
78e6941ede1a99522ea4c2ffe4374511571e29d37958c88185d20b419b595c2c

SHA512
4064e916eaad96902b449656b8667fa833ef9b4275d935cb890d6c87b080e7ff32f3daeb52b7907bc0190217fb7bccc519079825c15805aa415e1f461186a127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eec8e365af62a8599879d5909a03be13

SHA1
7be308e62879bfc3950accaf1068248e8daf0771

SHA256
56d8cd3e657afb7808c622898db1914ca2d230a8ed7259752872730056636e32

SHA512
f29ba8f9f72aaae6604a5020a9c0c54f037714189a8fa1dd3853715e9c7e59957943b1925fd5fc2c86f1c3a8ad46950eb19b2e7e31d142edea9e2970d862e6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
782b65ba180f3addc9de40436f3afcc8

SHA1
5016a4fedcd6747fb28d10932502a4491f0a7015

SHA256
a6695dd4ec7d5fa0fda92cdb3dda73d7607188182c2f0a90d20736b36e6ac11a

SHA512
2a885b74b1c04e294f5757a009363a786769bbbd73063814357d468e77f35505a3a9d15598ce2de4cda8908205401dd91fdbdb656d3acb164de8ffe0f0cf5bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b8d371b9a54e0df0e4dc5e84b73757

SHA1
7608d2ff7e9cafc39e9fd3d8e392cda46c2b8aa2

SHA256
7ba4f9daae0a2872b1bb9e6665058abea470fcb7a042df544f5497da1b31806e

SHA512
180d79777a994f8cdccc33b76ea9b5baf2a98200a6b211168da71d2ff7b9554c73a9f5361626ba4d2522005a0cc4996eb79a3a030ff4ea1e67dd924a7928c2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
368112a691c90c12ea1c034af848273b

SHA1
03f449c1236eca20a994f22d6e95c9534a354a55

SHA256
94cf5f2a5405167d2e2147bcc1a49fcf44aef424cd9234d0606cd62eebe8314f

SHA512
f344cdb63be2c2f9e6e7e062cf059202a9122cee91b561e15a632975586d5e5635c777841e6ccad68c2eebce652d18627f40fbc11bf23e9860f9d7c0586ade55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
409db0bf6864b322d91bbb68e3f4b1e7

SHA1
750e681bb5ed55f95b8d64b2d76b75ed0a64668f

SHA256
4e6f7e0eb29ad8351f7e19c28544a6c5ba8c52376b99fee2a10ac97a47e25b56

SHA512
5c0462206a1d2209f3d2b5dec2097e7a58834f8f2181235f876bba719154c30c47f4b039be365b8fbbb5a85a45d7db9e08319134e793bb6d617edb2e9d3f5224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bce2b83a67b1a6880e055410ddf38d32

SHA1
ea43c21798dbfaa0c801a872d101658e08e90e17

SHA256
be6ff482013bfe8a5ac4f88c14f53bf429d22aa1b604835ce19eaee5d082ca69

SHA512
80a0530dbd3297314b71797cc4634ed30ff0f04eeedd8fc1b55de098150de6c43b33f2312358ddbe3ee1b841a815c9016b42d0c208658e95028af9d57df8b527

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2010.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit