68b6ac1a2359ee9bda27c33f8c53405fa9fb6c0332f3b17dcfb2fe4040e8a105

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1496748cd100dc01c60ba0384e32a8ca.html
Size

23KB
MD5

1496748cd100dc01c60ba0384e32a8ca
SHA1

bce6bf057ad1807e3ec30f337c1f49a90d5dfe6b
SHA256

68b6ac1a2359ee9bda27c33f8c53405fa9fb6c0332f3b17dcfb2fe4040e8a105
SHA512

422f5231682f3820a073bf9ce25379cdd87ea140e1085eeca185121faf2811b4500f509e14c2ef9fd9891d2b62f28525dd7c752ed18f00234b8a5204e1c7df6a
SSDEEP

384:JRnA4ywnA6pi8phztvukeKXXTuSwTMozltHv7KL24UTpNyOcn8tvG5nTDuU5esT7:n19AQtWkek1XgR7Kc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ACB8521-A8DD-11EE-8427-464D43A133DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b15872ea3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410299898"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000036c9a5773eb236ca995bdeb79cdc7a7bba42ac3afc08ba1d695cb772edc917fc000000000e800000000200002000000033f3a940e9496226a79a2bfd309884440cd6b9bc3f1f84d94cdf6c13797ed69620000000905de2a61d986ebee18d4b734317d4d32a05b05fa8daf4a082e5eeaf48ca2183400000003a6f9317bfa2a2076a4fb6c2568136de9f561a6226a85185edbbc42e7ac87d0ed8bbebe91a4920547bdf3719cf4a2d507581aaed87e52910fa62c27ce6359125	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f3eb55967b9798c117aef09d099e56b524f15f8ab7af23ed2bd0e0432689e06c000000000e80000000020000200000000bd9dae8bcbba1de601cfc2426fff2fe48841ae8f3b7d8c0f2bc3340a713e587900000002801a65c75329ce3882ac1766aa4cf770c1167d370aa695c901068329a60249f933ab00686c256843d6aef7796ee9cb7de23707faa5cfd504be5067206bcb5efcd09644f943973480579d0ebfab095a63efa378a407490ed5447cbfc4d0d6a445b28b8899881ec1e2a9df17f3003c326ecc73c7b5e3e4890619427e54e059352e73d5e4c8b23ea4e25373021ecfc2ad140000000e72bafdcf4d14443524d6b60dc47273963643e50680d1154f8afaa3520b395da4bd149311354318e217fffe8d41e531b172b28e0e46c8dcd2fab9b33760199d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2880	iexplore.exe
2880	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3068	2880	iexplore.exe	28
PID 2880 wrote to memory of 3068	2880	iexplore.exe	28
PID 2880 wrote to memory of 3068	2880	iexplore.exe	28
PID 2880 wrote to memory of 3068	2880	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1496748cd100dc01c60ba0384e32a8ca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e9e185a0b61aba4dc2a422d671a6189

SHA1
22610666a08744668a9e4be391e9ce6b2eb61fff

SHA256
b647b72703d41773e1e9049fac91d58de35f92a9236b1b086dd563a7dea159be

SHA512
3da709e878e510e0a10f219f216cd2940d2b58b37c5c717c34c0be2ea36cf13ccf5d0ec0f2add2d3bcaabb09cccc62c171bfa245668c0ec6631dc732ec063955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ec0cb3e6bdc07284b4497aad475bbf8

SHA1
da9ea3e84750ae3059d76fc9643172134086218e

SHA256
7c23981ab67a4074d363241f3aac5952f4fafe8b00a4fd27827e5dff4643e7b3

SHA512
3829d8c76e1148c6b3878d2be2016ea2d61b3ea602808524bc7991ffd3493361a3efe405bdf5bd104f9a2749a7c613a99017a8a52877c83462e9f8e7940116d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9901de19006549ad7a6864b8c87d1c0

SHA1
835375697a96f0ff825d955e9bebe1e0637f7495

SHA256
907e38a3b52241f42b08290e6c6380db677a74c7edda227fcd538df296ed16f2

SHA512
edf84f2229ea7090d20ba320427e0df3b4fdef55b330f2de1f3e3c7839d6af38d642255ee110a89c1d1af27af2b135c11e7c327167f8dc815ddcac833a87a028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57549fdead4948ffe86de80eb8531f7c

SHA1
4c8ffec97aa3b222481c8b56b42f74f1807d56b1

SHA256
eb91accae24213ac78967464dd575aefe260f041697b880c15fb4138253075c9

SHA512
40309a02ffd17f601d88c97efd0fc9927ca10a42b7e953025fb14ffe62757e5e3110b4f950d337a200dad6d4e2cf7537242a3eb1b820193d8d07afb34c83a2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57df6836b9635bcf1f1bbc3f30404e2

SHA1
3c8e70552ee60835ef907d4b193c68fcac16b85e

SHA256
216080798d4a8b53736a97367edb246e67567b7802af435afe1155a8e2d48e33

SHA512
7e4c7cc0ea2141370ac72115ea69bb4df2c0e5dfa58a36ce1e15a1859d33d8b7d6e98540aa10987ee29cbfa22eb32903d9cf7b154452526575f21531e527159a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8d223d951889197752a8a1fc6e61d0

SHA1
113e1e7eedede592451b37317e9976e4f1a07f8a

SHA256
c6d47694bed29e309411eefb2324f2812a19463926bd51b030a814754d475dbb

SHA512
4181e8fb33587b0878a19596077e148eecb5ca7a7afc327c5e7d1d967248461d10b0f934437662590b94f1130eeab3c251ad0dd862b844c69d9db214eb308edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa07e50a6699b6fa2d035508b9a57ceb

SHA1
c4f295bae5c63a3c6e61bc6aaa9c83ef24c1ed29

SHA256
3ade5a24599a86355adc148cd349a11395197d87851a414d905e1abe82574447

SHA512
a3b1714ec48389267584a98fd84637b7d74782368b27c4d61053832aaca0b297a33341a77c6511239212a957e1f934ccbca1b90627f6ec5a98d7131470176b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c0ecbf0e41a8802189576aaae0ac8f9

SHA1
7a163d7f5d811c9b41a305dd4552f2903c042749

SHA256
0753e270a53164319ae2db64c126f02d460c9707e44a6865fc4e4eab424c079a

SHA512
bcd280690187f6c18ed5df0e901042c602bf05fb73dd5469e402b589198d090d723235e555e94ddddd012936258a946da2c62fff9d28cbf5303d6a414154fbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86146ee73b2e6adf02d1a0dfb7c58ab2

SHA1
d882a9cd6761f98685ee2119e337e3131e237795

SHA256
2310138490b28f6c04c405556bc6f84cc91abcaa5112daf85e1bdf24aeac0935

SHA512
b3e752e09ddb09ab475cf568b0b5bc00101898374f8077e9d0d43e77c18381f5ed5421df0b182b4df357c9017be1fc74263654286b938ead155ee0151f391224

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBBD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC855.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit