dd4d024fe412556504a05579237e082b8ffd65c938b9c0a5bf27c1ff3945f5dc

Analysis

max time kernel
2s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13002ef49d66ef4244824896890a0e1f.html
Size

2KB
MD5

13002ef49d66ef4244824896890a0e1f
SHA1

87a40dee31158e78f66f3e8602eadcd59265d453
SHA256

dd4d024fe412556504a05579237e082b8ffd65c938b9c0a5bf27c1ff3945f5dc
SHA512

5b2db1edf9758b09587865b07cf680ff12af9348594c60969580dc4f4e5c33cebd3ed83b831fcd372738c66f375d4ec4b31024a3710dbd7a1f99dd121adcebe7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D43CD281-A7AE-11EE-BFFC-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2688	2128	iexplore.exe	16
PID 2128 wrote to memory of 2688	2128	iexplore.exe	16
PID 2128 wrote to memory of 2688	2128	iexplore.exe	16
PID 2128 wrote to memory of 2688	2128	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13002ef49d66ef4244824896890a0e1f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c66c4515535eb714b5beb9864594235

SHA1
3ebb65da6f3cf6560dca42c3573e65e788ab92c9

SHA256
15be61b3987e07b21975de2a822974291d014a18ae6bed7f869c936c32630f8e

SHA512
5e2a2230210b057b84bd98f69da7a5028ae79c56d42e663767681bdd02d8a61fed80192decc3524f1e38693727aa52b1a85a48231c8db1b8f1c33db0a55ae0aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd01e15fe3e60fb3937dded9a1fc1aa6

SHA1
711d3e16e7065c9fdd39683a1ec12e571bad71ee

SHA256
214d1addc2e0211669f0c7d8913bede49fe316b0e39ad96ce03648ff6fd332fc

SHA512
bbb69383c90834f95d13739146ae364df8f259da91970fb02416d66e10259d7fc81f03cf4ac8bce8af2eb0e01831a036e22e9fa4d87a015d7d0776dd5bc9d9e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5867bed100bedac87a73471f10a5afe0

SHA1
fb2fe204ba6408ac6aa5cf70abcee1ab5949eb70

SHA256
506c4fd37efdeddd3298618c18a50a5bcc0966d8c6bfb95c591fe5a4a159ca94

SHA512
494148ff62878ce3cb0eb8152f58606b9ffd9ddb26135ad25268e0f58dbd8e8fb001e8386ef3f62f1719a3cc3a8b6ef4738aaf1e7ab62f750efc48daa106973a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6240c329e992dbb411076cf06e080fb6

SHA1
599755be164e58da700a2d1d702fd795f002ccf5

SHA256
01487671cb6835c3f00fa6ab4db2ceea4c33a5201e1e5db405d174c134d00a84

SHA512
a4431a3f5b448148c5a6b8bbff2370b9aa17ab44ac43ab0be70d766faf9bbc252e0728d19cf6d5e937109a84f21ab6013e2845ac02fed76cf95bbc218f41ab86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a7f8b0993e8a7c934243531ef99d7b

SHA1
3bf14b7915964e0b5918f664855b32d66eefd841

SHA256
90498d795d188c002ed06290077556a34e5d841c9554cb22d97ae50a88109001

SHA512
b835f4a36a1364b22d1470b8f51f35d8286ffd5283d3b38483af09cedb490765f9b3d80a9491396eff1a1479c5fb1e3c206624a593f175466686f06e02f441b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1359566f7cbabfcad938d363a67ddc6

SHA1
e5b7ada6e2d8e3613c69abfd88656ff475a60e05

SHA256
976def29bbe197ac5744337c82ddfacffa1124deddd1673e4f38496c131ab13a

SHA512
d6af55e614675d476bbf3f085ce62e2fe7eac766408912de50b6eda5e39fdb60fcec10d0a3d42cfd0583525021ea0c1cd7737ebd30aceccfbae476ed0f31ac03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa75250a1bf3e3389545b9424f3edc84

SHA1
e980107f2aedba510400b4ce83ffb72afa27a2b4

SHA256
7e876526a83987cc5a6c43e44e2337ee73dfcad7250a9cd40cb1a9a75f7a08fd

SHA512
43908cc6deb5e0742a3d0cab8133a3dfb87b86fcf4ec8a56d5dcefa7ae72423e95bbf52a53a929e246ba8501829d7d361c52e1be4b8010437185f9d8d2c09f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa4ffd6f3ee057ee25e67297ddecd84f

SHA1
8d6380f33607a74f7cc6db2fcda277a1d3e15b7e

SHA256
ff642d2d8d8e15883afd620530380f5fd9ff8423d807cc3d170b2ee92f7cbb3c

SHA512
b08b286aec090084050c69ce77eb1eafc2719b650e078805ba47d3087ad824afa9da29d95482027dd7ab55274d42e17293bbaf31aaf9907bc7402ac25f6d79f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e04314a04aa0050c2e10d00efbe92f94

SHA1
9d48a3dd13726416c7ccf84054a98375774f617c

SHA256
eef75201eae769f2e53fc76d103a223ca19ce3cbdecdb612494921c153f5dd8d

SHA512
6618ff7406b4a3565b5f6d995133b31edcb65ffba9ca489f806e52927ca4caf4408aec391857f83a0e45d383afd9a3188dc983b18f2c7297118a9f11e5812758

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DF8.tmp

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FD1.tmp

Filesize
5KB

MD5
c791675c5231dba1cefce4aea13f600e

SHA1
1b0b73c0923afcc0483506b013129b2721bfca16

SHA256
455166eda90a8a6428cd158e5c06d097dfe916266c731b3d1e507bb6b3f0bc43

SHA512
8935ab5b3e4dd1c3c3d9d2ad9548cf37db0187b52c44e18ec5162c0d46e8e11022ecaeee1e21ca537a9292614e57fbbe329070ca32aab2fcdc7a4f2a03bdb86e

Download Submit