1bb83f495530b1e0399c3a25d997437a290a8b6946042930af0af5b1b6041cef

Analysis

max time kernel
12s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

093f4ba29715ab385db05f531d8437a7.html
Size

15KB
MD5

093f4ba29715ab385db05f531d8437a7
SHA1

38175b84c06b80b03cf969bc28a83617653c6aeb
SHA256

1bb83f495530b1e0399c3a25d997437a290a8b6946042930af0af5b1b6041cef
SHA512

09c5e77fc9cfdbf7273e6241035dea719dc3f16521cd49cbbba6e4af04be1a6a3660363f981e6b95fea47f44df482b45c0ce7d87b0791ccb47ca07ad4b4ed2a9
SSDEEP

384:QgUrYvkLNqmMX2NrGjyOxhR/kUG8RfV6TbZdFHF6qCC+kcPF:rU8MNGmNajy0hR/9G8RfV6TbXc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95E38D81-A76D-11EE-B908-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3068	2540	iexplore.exe	15
PID 2540 wrote to memory of 3068	2540	iexplore.exe	15
PID 2540 wrote to memory of 3068	2540	iexplore.exe	15
PID 2540 wrote to memory of 3068	2540	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\093f4ba29715ab385db05f531d8437a7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c90ef9276211802ee1e0629bffe30c

SHA1
d1ba31ce5d50a7efa8ac07091699dbe3e501d6b4

SHA256
ea466cd161dac0919340130ec5e38be03d26ac8e286e7c72d87c0832751994bb

SHA512
6a8c1e005782c662fd8584fb231d07b2e7fcc9ee52926db0fa5f0784e52ba3de613056909460db73fb2fcd72a6a65788321f9077a889656b477ca3470725e075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9c979e7c950c68c91d24cb5b245265

SHA1
526539fbf0ff260ab825944e3f62fa68fd7334b5

SHA256
9fd6e4bb9fde9c7c31eae46f358e84f88c0c7adb5c19dbfc00277c7be023b45e

SHA512
1d312b0a9a6d9ec4c366141fd30fa332d937c02a21da7ccc9b6e58d767d04492e379738ec350c65229c20ee7942ae1ee1adea4c9dcb7b05b6ee53d6376d21e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c75990a4f591e816b51a3e9398d410b

SHA1
57bc53f658573e314c89cec23662d074492e24b5

SHA256
3aca07eaf05a4c1559f12f419dcebd9602567196c284b44609b97cd010b77cab

SHA512
6d0e42259d1192ddf373a6cf3e912ed41755b5ca160cab0f7fce192b5806906fb40395230bee3c977ec89003d447a034adcb4433ca55bb32c3ba170eb8ef8a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ec986852465a326435940918339e96

SHA1
8d0cf5be0329de0232dfc829fae3b242d80655cc

SHA256
008c2db75f7258f1ef8179b7cb0bff48f0b74539471850be1c86ba185de0e8e5

SHA512
1a8a22babf80e23f3cafefc69c2e0e09b375388f4f936c71fb542ef63fe93716f1e061906ce31a8631061a0d80f82810b45afbfbc7ceee79a134717d9434c042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba8ecd688736c5da3e376f168ba0fd15

SHA1
8051097478431a112d883caa36b9b1807c261502

SHA256
7183710f0057dce5b3130e33018189ad6d8525d50204be54afa67f45d263f14a

SHA512
6c8a7decc29daf0f3e11e8e3b6f69266994ac1c62005787f29146243142ae5778c6b36cce8c20855a90b8f4178af3323c9eb5e5c7cdeb65ea0c1268adad08670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d95993bb44a7567610bd078881106b64

SHA1
0d06d8d404216112874c89e6eb3bc9c514b3b16a

SHA256
27321d0fa4a8d5f1254aff22ef6cbdc828bb23027e10ed57594aff0272c057de

SHA512
f1d9a0778a2121424394a44d27786c03c3d9b7c176a8fe7c0087dbf6f75349731c9abf6a9f45c1b3f6eae2221cba12d955590e592bf575f4752110f8294ef617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16bd4b48e7999f90389ddcc85edca0f

SHA1
e5ecd8226192c62d3fe7ac2ece8edcae100b3853

SHA256
a0e72efd179594abab1560da860c19ac56c5128edfb1bc7ff2a225f61eb81205

SHA512
1a98a2e61495cf13abf721162e5e7a21f23059e893d77ec8e0b90544cc7e89752a921e47f5f60397075bdd5dbdc1d0dda6816237b22ad6bbb940274f0325ee11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
882f46bbcb8d1238345323b868eb872e

SHA1
8bec3690cb853723dc45384932d1a14b790b7ca7

SHA256
35d613120095823838ae87cc3ca9f680ff4c0d3910390bf4a3ab4469c9e9c693

SHA512
660bdf2b3d4fa56be72d494f7f1e49e5733dc58914edbfc141faaa3379fd508bff26e3c21c380da590af2c85966a75dd2fe2bd37f5acec899ae52a3d5ca53af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cd253cffd398ba5122bf6d0beb53a0

SHA1
e567d7960ee146695e08d86f98b673bd1a055011

SHA256
8840dde94e47a00e36964b02c9d86c67181c7b4c1dd539b780d99813257f31b2

SHA512
7843184b413e2ca9f4ef418657c812aaa367531c24c74c5b3a2f027bc8792b2efde1da4371ff71fe292e065526301a283870cdaf3beae89fc0df01d9fce03413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d587e1a6e31515f5e55140723085bf49

SHA1
4dc6a020598821d564c9a5562c89f33e5688022d

SHA256
1a71c5ea2893f3da6cc546b05bab6535f3fccb187ddc653a97683f23fbefa37d

SHA512
3c5b97b86ef59e794b8ac0d69b0233339ebb1566d7d92bc1a1a1991aaac54070a5cb9f2117e9d661642189254fad154c6f378ddb3dc932d2029aa39a2e17bff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23EA.tmp

Filesize
79KB

MD5
e392e80dd42e148c2a9ccb471e25b267

SHA1
19a03803fe928477025ee1a30f6b57d57c8e4159

SHA256
4ccfc80f019ab9d49ac3777ddf6df28227c24b1c63a2a2c5a5ad478fbf5bd9c3

SHA512
6af0d8556e25d049f7ef0954fbb699fbf987aaf66b1f85b2518e3e14c3d714c8be8af0f015dd70fbe886ad35e6d95fa0c99a47a2d93e796b4dcd3a3fadf6feba

Download Submit