dc82e17400cfaf4401b9071f84e82a20c19bb1eff7836b6298c39ec23d1ecbf2

Analysis

max time kernel
118s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

118ba9ae31a172e8a6863462931bfb54.html
Size

11KB
MD5

118ba9ae31a172e8a6863462931bfb54
SHA1

b1a677a469025badac830d27b600536a0c5b5060
SHA256

dc82e17400cfaf4401b9071f84e82a20c19bb1eff7836b6298c39ec23d1ecbf2
SHA512

1610a1dc565f80bf712bff5fcb3c0e701066558d15a2460b7cf17c0848736a6170bf14a94f1505ea7895251e5fed56c32f02c31e68add709bf75474d57db35d2
SSDEEP

192:G7MlMb8ZRtqMzOIO1h7CmzsQMa1oTOsg8VrgaR40QFjeDsOcUG0iU9b4RJ9V:G74MiRM4/LWo6sFVrpvQu8T0iwS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410254212"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CFEA9A1-A873-11EE-A031-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000005566bb0ad3d2dbbda429910257f2cf1718be73aab6819ad21f3d6b608923123000000000e80000000020000200000004e408d1083f18f61f2589fbae7d6bc2511f4c18696792fb9d7a1ac4c4800ea56900000003e538679d48af7747f8d994a552f0ba1cc3c7d391434336510446f6b20720005fb132827381101754ff1a1fcdb148ea50d26e0988b840f1038b23c16e9907e65320bea9ccb548410770a8a694ce2048f3c916390ade66abb31117a235502601ace2fd5d0aeedebde0f2507d609b56353321e92f2c20a1b27242fcba0383ea7de2eb2f252db776342ee29a70e37c257294000000064a7f64b054bd70e65522da1a133e7ecc02873058b70c7b31640c22d5bac6f81ba7a00c1c2d68ab7a7dd70d56f9858d8ac9ccccd6b919f9f2aa03f369e28dfe1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006e1ad50dc5f78edbf7af35c88fc69786a358b49d17948d20475f6339544f546b000000000e8000000002000020000000515b548d4635fae7cda5d59e502c41188656e96ecab2150a0905bffedf82877120000000f84a7b1c6e568cef73c3abe544bac2846e060d9357bc65555bc38acf54091c5940000000768a246614ca3e66550d3bf5879a1286a091f46515cff95c8b55bf7e3f666522122871fca893b5cd7b8cf4c27bbd0e9b27229f4d13d792230955fa13d1a1ad1a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3042de11803cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2368	2996	iexplore.exe	28
PID 2996 wrote to memory of 2368	2996	iexplore.exe	28
PID 2996 wrote to memory of 2368	2996	iexplore.exe	28
PID 2996 wrote to memory of 2368	2996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\118ba9ae31a172e8a6863462931bfb54.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
511cd70baca119375efa6cd350da5f40

SHA1
fb7e918b0f23f4ad94364870192b9df5c9e141b6

SHA256
08c06b4004f2518eae9d29f7f71d0a3706d7636b49bd0f1d0f789b57359ccce1

SHA512
6e1a651e69622f39981cb25fd5a824493e4a0283c4cbd0b719f01836c293185bf0a5a2327f09fb4804c4effd321bdd1bfa9269ab094a5c2c977ec9ef0f44fe2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6671d8cc91b7de8a1e5083a76bbf20a2

SHA1
d59e20c56b4234af42a211e75be82a541d0cf3a6

SHA256
5c43a419d32a063df2ea8ce96a97f4f364a803e26ca0520abde2b870e7dfb780

SHA512
42f9a1c356fbf94ec6195408060f9a69013bf91daafa4bcc0153b0fd80b0278fad7fbe74b2ce9521521c97a0460c392a55f607d2c4111bd438052161a01eb9ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
424b75111b7238a62ad7f8ee375b0acf

SHA1
a484d04adb721fbde35e2a23054ab1d559ca1baa

SHA256
bb76e61816db658f21a86d3254bced23a57bfb0c6d1d9b9ac645aece0f53065c

SHA512
d10c57021569e84688bb17062ea0affbcfeceac7e264eba7ce6db93d0f40f5956b6e2e80478a4a8a065327613fbbf424b19e5664f4c7d1e777243a8dec2c0556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f9d1de8867c76704e2552659fb5230

SHA1
276917862d2e96ebd9ca1882a8d2be2580266a84

SHA256
17d3b1cf7a2923c8ec5506196b71c62c1ae041e3a13af7477c3d3c00b2e1d73a

SHA512
fa3993591d8be75a1fcb4133fca24fcef9889b258f7d29c9456f5be63a8b176a865e537dedc192a8521121652bb80211624ab9fe550e29d197981a9defd9451d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca38f59d6d1a7c12ceb211eec0723411

SHA1
484960374e67994843ce154ceaaaaf0e273ab994

SHA256
c7872d318cce2acdaa20e7245fadf394c2dc9853471879157335bb95c6a105e0

SHA512
da70edf8b0225a7dcd3299dfe0edf93d1e7bdf0975aa6f9017ba33c3e05b0dc8c0d321d20081e3c235982f378b59778bb0ff21264c71023344d49f908f785989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f267ba8e45f13c1ea8c5492e93e700bf

SHA1
a562743786717c8b84e2e9a2bec6c5a85ce5749b

SHA256
c4ab66295e4bb5419142ee396b26e1475d9c5815e0f26c4a6cd4f6c9b02d9f1d

SHA512
3cb9d36e60f450eee0e14b1df46278eb2d9a4ff9c06d597ebce73d5a1d7b121c221cb6ecf24337c0ecc9125382fba8599eb2ce34433203632c9039420c16a49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
645524ea302482163da8016460306e66

SHA1
bbcf2c9ab0b1e84b084bb3be31655a60ec049389

SHA256
324c52b69eb6c243007d3c795268e8c4578e5dba7895567e22f850d500216a7d

SHA512
9a17df98d82f559074144c80392770f1da132bc55c09c800f5ed6b787630c5740d54f989f84f0227172fc99241f5616c0d7fce603b4b5dada80eb75a107d8564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8a5cb1d92ac0ab5e1741868638ece96

SHA1
65785eab6d928b9d9e37498852e1f33ef16f7678

SHA256
1d1ff6d0e0b726d7ca09b548a478780fd0daa8111ea0801aa41f44c1fbc3a904

SHA512
20d8b7fecb1c9bee827f05d477f4af5d4723b46fb50b5afd5b07eef38bf2f0651673a83223190f116390c905cd4cbe707b86ae163081fc42d6c0d21b9ffddc02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e381d3b0b4e02fddf75ed195fee3790e

SHA1
677a0cbd2dc97f30bd5c224f47184ab13c577aea

SHA256
c507ae16072924679b2b8b48d744f7ae8e17d404486c4067608ee7df10a0e12d

SHA512
767b5c528749d8c3fd79da4a0bcc2223e16ea87607d0b5686af5b49ca0d9d10b44b739d7332e41aa011636fa104b0585996f2f31d5534f00648f0a9001938575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01a7bc445da1825163dbabe4ce3c0d21

SHA1
d90456b12e47919d71f70528547ebeb6a358b164

SHA256
4144c24fcdbdae7b2cee894bee66e176a7ea70add137b6efe20dd2de98bb01fd

SHA512
5f39b0c3e4d1df3127875eb5715b3080a7a8af0032cf445dd2a86da402fd31af5196c4c25e9999c86d2cb35266523f36c4bb8e19573261df3d7bff027b17b25b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab48C5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49A4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit