b4b1acbb8551ffb6225175e90346f953922001447f0993fe1370baf7c836bc7a

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10afcde298b639ea4bd053b3bddb0cd8.html
Size

23KB
MD5

10afcde298b639ea4bd053b3bddb0cd8
SHA1

670f7beb54587d2909fe90619f5cc0bf1daf663c
SHA256

b4b1acbb8551ffb6225175e90346f953922001447f0993fe1370baf7c836bc7a
SHA512

614b4c66b05021698e5c76e4774a9c3effbcf9d14497b5d2e680f89f805eb1e354f9bcede2c8b0c38fb0a2471b2ab45d71763b0b6fe31121cd118e2d3161c649
SSDEEP

192:N60ownFb5nCnQjLntQ/dnQiedn28YnQOkrntLwnQTbnenQeanQtuMnnFnQ7XnRnu:Q0oc5Q/z8Da

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410243203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94C3F511-A859-11EE-AD08-DED0D00124D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3032	2184	iexplore.exe	28
PID 2184 wrote to memory of 3032	2184	iexplore.exe	28
PID 2184 wrote to memory of 3032	2184	iexplore.exe	28
PID 2184 wrote to memory of 3032	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10afcde298b639ea4bd053b3bddb0cd8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f38cdee3598060072f07f2acab63b7cc

SHA1
5820a851c68ef78d879236334014b8b2583180ef

SHA256
1046f5fd714b8d8f300c91e55324cc169d98c03bb232ea55a4af9a867e023200

SHA512
2e6466ed40d2c5a7aecd87c489e7b05ccb49cbc0b67699cab77d30a8c6e2a6c019b145c14e0cf85a78d77788b5bf28aa62a2a41022204deac97323ad4190c1eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e85f5ede07c41dc20d9e8ab16d60953

SHA1
be5fd7e73e1a3ea6b6b3ba5a2406dbd4e7eb7482

SHA256
a1581a3177046e0bb33a381830c48d8a919fc10cbd5090dba200a54231822408

SHA512
249480946ad205db108dde5e46bc460334f655d01c9c25173de4aa17463ec7263a4b6a99adafa34f9bdd395fafb47a288c97be6b229953482524b74fa8828b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad7ff4eb5a150916e4da64c23d72ebb

SHA1
f6d7178c8da08dd8d227f528f605d0f3ca462bab

SHA256
aded27b29aa70572c130ec6dbd121fa35487f63deee50ae37e75713eb2b83fd1

SHA512
afb67ad3929591fc644ada65753c8a8d2dc54f03e884cbc456951ca3596c63b272c9807a87bd4f758c7345b45819a7f6bf0108cd806321117e60d532978d6172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c567e36617e62ee9d42b582b0c8ea48

SHA1
0b2ecc2826b62ee3604ebad8a5cc0b96011acd21

SHA256
00102129abdd0f278089ed315869446f8f0ce696c059d10422a7091820461055

SHA512
58fc4e01ee3a7313cc08027abaf8ff60c028926dccbbc587305eca810dcae111e2c431ca855f7e4253a91c3f33f452f9bfb40b74ce5a5ad4a9efa4a411df2bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7581c681bd74116f0855270d5497545c

SHA1
f58e703437f7a6bb262a1e572b84e0f5dff05b31

SHA256
a443617c7b97bc7305ba1cb64729174c77b156c5d353106f5f74b85ac5d4a614

SHA512
5f17b14d49f6a550021bed45d13cad051a60ebe41219e52f3bc0094a8a87b1400dfe63549c9335a9733c4c1476fad63e4dd4bd89b8a8b17952dd537e72d83413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea67dfaa51c4ec7ceaf647038fe46382

SHA1
b594968dc54838c654186aeafc211e791079cf6c

SHA256
bfaadf2ef8e05edbdb9ea056842e802044a57417cfd97a9538f58355c57e38c2

SHA512
703aa2aab50314289baa5f4cfcb21e2563a2ad80fe1f13f61fedd6efc973521f26b37c55cdaa95960f182a281ffbf12740851e0aaba383687950f4b4e83a41a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac11c1365c3886212d092e05a6d698d

SHA1
971a068f5feea6ed36b7cc40f13e36179c75f9f5

SHA256
3ecf972d8322ff127fa9a1a5a1773d11b6280e6ad8338285de839216dfed2909

SHA512
68df9181a252a6b4b162b59ddd57b5ea32374ea56056d3df47f6c023b1a9154d487b0106d6eaca73cb53be9899e603c41c149d588f247af7b61fc0cee76ca336

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA343.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA411.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit