2d74935314f8ed674773ce110d7ec64c563739b2e56d15531a50b03837aa1163

Analysis

max time kernel
36s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

086c84847e5ebcdf8220d66bd905815a.html
Size

217KB
MD5

086c84847e5ebcdf8220d66bd905815a
SHA1

e3f2a54c3eb8e620322bfab141ecf5f777d8326a
SHA256

2d74935314f8ed674773ce110d7ec64c563739b2e56d15531a50b03837aa1163
SHA512

999c56292aed5f4ae7264b101a0b2e9ce4e0a2103fb206159d3140498ab6e397e7311a0ccd850ae414a69b79e30422c8375b615f305e65102ee94b87d10950f8
SSDEEP

6144:MHVhz0URApGAcQijPEqp/qGup3+Kt/lrBTAcAAc3AcjAc62Cy+hhxnhDW4v:Ohz0URApGAcQijPEqtqGup3+crBTAcAq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF4C2981-A6FC-11EE-8FC2-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2536	2508	iexplore.exe	15
PID 2508 wrote to memory of 2536	2508	iexplore.exe	15
PID 2508 wrote to memory of 2536	2508	iexplore.exe	15
PID 2508 wrote to memory of 2536	2508	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\086c84847e5ebcdf8220d66bd905815a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f19efe5ed268b3de7b35c0674700911

SHA1
d4a1c2b7fd7b3bf3f27ed95487bfd82fc5529931

SHA256
444fd17c3824c56683f033f8bf909b057aff46773da0fe70e590ccab99090e73

SHA512
77d5993ee2b8a08b352e154f475afbf4a6d10f36765a6dad189183092b0ddb2ed81dcf377782f600854403f83c1295a936e9837f74c08a85c4e1b3bd260aa78a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b11d261452ddefa01d851b90d90b8ddb

SHA1
70a158a5bbb40a53e2edcf218d02928909445acc

SHA256
79c79b1fe69be6c4c1a8da4275fdaabaaf121082981f1630e662119ae862eb84

SHA512
13b271b822bf99556b556783995f8c92e4190bfc1fa1ad2d2ae3ef114745c08521dbfa325bfd774d6d5acabe2916871e4926b51f706d76ed58584b1f4124a865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed2fff0cd9c2e4a6a6e14185fd0566ef

SHA1
9270ea10564781d8dd127f7ecbb2a4297af0fc7f

SHA256
f5c0f08368467a03a71660924a0f3335b1fa17c6b13ba67c18f4ec6689c2f7b1

SHA512
4e58aecbf1276f865a09c89f84c28854926da834069194e8feb33f4bdbe4242ab430da8d3854cd9f2cde357bae2e8e325c4dca223ecc772ea5d272b29b04866d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab64f823bb1c42cb0b897e4182f113f9

SHA1
d15ccb9965e7331bb1016d3186c9357b1917b88b

SHA256
0e62085efbbfa98148c488428a9621d5f5fa9247ae711a5d1f93c407cbe10360

SHA512
60e001654f851c08479c4e20f7845b53c78a2841b6848ecbd5c928a7729b8d35e2f2893dd19701fff79cd81dfba76de83aa3df466933f74147ea56607576e9ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da154e4736d2ef3d764172f8cf1d4251

SHA1
5f079c1cb2ca36e66e549431ce5d66ac97cc5a11

SHA256
f385cff9e3ae015a3d8fc56b57795e9be9381940c3e825a71fc2f0684de41cb6

SHA512
e1a9e9cd991d83cd2b4a6bb1774aa1f6fcf08b29e533199735757d826bec9ef4c4e70029e358542bdab3518b61baf690b67da7effbc7fb14eba98c07b92dd104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e9688e97841a137cdb7ac26d7ae6c5e

SHA1
ac6f9484d74c21c49c9822adfc7a7669b9b33036

SHA256
a4dd2e1b7b521ca970295fb8bdf243fb8725535e917a8187211aa336e513a64a

SHA512
fd08b3b4e330c26bd257a0e8fcd6247332b7c2a29270325a95c908e33726027f1be4e46c9e3fadd3df230f95ed3e0d75ea582a25ba0fdcc8c24ae3960bb29408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73183e57b5ee577caaaaf4bba6454574

SHA1
f44a9d37785e88906a3d3bae37a2c0bcb4e03e61

SHA256
49507fc793a27cd58b2e1a89f5280fbbb891a060f7218bf1894fed9b3be4e585

SHA512
e4efa7c770c8ac47d0513c1b2cd52698c176cf90bef7e78c619d25b06617c320e5aee48cecdaf7f94f9dd906abedef952badccb60c4e0e401c4e49127e4610c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9cf038af448fbac24787f10ebdecca9

SHA1
e37512fe783d09991876138ccd0ca43de47dc5cf

SHA256
b5eea019e0c1b08791135cb487501d71bca5520d725c5869309492f31158280d

SHA512
cfa18e847c610d037f098c9dc405ee5aa7d6ac9748fd4b622639b14772cd63869b2d5e8f795af03cf9aeb0da4ac238344c0c926aa3444914e0f853793c423ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93894fa4c16051db3f8f6f73b505ef2d

SHA1
4f0e6a2aee7cc31b52cb8cb1e844d80501de7c29

SHA256
28500a8c237827c59b2c9989f54e2ecc04d3cf563677246a157ee518219277f9

SHA512
33aad334eb9c8f8bfc25aeed0d281020dc752ab1e3704c41aa9cd4065ea3460685325bdf106ae921ba6d3fe128783a1b260ba218c7f0dcf601caedf27817211b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ce42d1439a5d8eddc28fb6eadf66db8

SHA1
6d94261daf109f03d6c9f1c8fcb97e906c9b936a

SHA256
8ed13d638dc2d1c47d9e3e72f6e3284d500c1b8b3bb95f0d9ba8d13a89b68bda

SHA512
5e7a95d3b61b0a7601f3f82e9a874dcb247902d2a46433133c80fc36af605055b76949dca914ad89c7af4741edfdf639f4d98323b660b96709ef925b7e393972

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25BE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit