c1d220204074a32e93d66746ac6d674862730e8da7b3119f76a61d3bb2e2cac4

Analysis

max time kernel
196s
max time network
226s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1504f3627a302a24c315d2119f8c96a0.html
Size

42KB
MD5

1504f3627a302a24c315d2119f8c96a0
SHA1

ac8cba37edc0a3e23c013a79d41530f1975d92cd
SHA256

c1d220204074a32e93d66746ac6d674862730e8da7b3119f76a61d3bb2e2cac4
SHA512

a69417f99b7056e6a98c1deb73902c34ecd3be9b61dbaed1c232f2f560ec0d5713d792c5145e24f3fb6434e3d7729b40139d260ff924316a990c89f3b6d0550d
SSDEEP

768:YIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZrvh:YIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410183644"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECA12F40-A7CE-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ec94d3db3bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000044a23a24bc7d5d7d97fb0c367993c8a85d339384ff15ddc57818257cd2a4f853000000000e8000000002000020000000f1bc1abc97dff0981a2390030aad6b7f5778bdac31af9949a8dd13d56c79e831200000006baef7bc2bec401b281e9e4c28b8ede23789eb8b027496309314e00a2a3ece084000000013a47b9217ce71c666d5c8de486e046b852396fb890fe6b2f37e6d8023857c36a59449b726745d519a63a74de3b49c410245dee8b0ea1d818b64cdd6e93d6006	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000026b0609da38030ac84a50c8cff8ffdf76cd9048d1eb84c4eb2febbe0815fbc6b000000000e8000000002000020000000558d81a7538eb22ada1c6948056a398f24b6869f48cad8d5e0a98ca3845558c3900000006d6f9e3dcb88f089e9ed30a32d2ac118f956416a2c11796c91a53db66f4900a6f93825e00d32d28f0138b1a58b16a8986645d273429597c33ca74e05f4bf00548b250f066ed56755aa01e3e41cf16e5b68eb524d1743a6d0324817519f30432d9225ff7ca7b0a882968a1b30d053a71e21ebd9f78d4e71703cafdce6587ed8b28b41e838c64d3cff406323623f4026794000000096f330a976ab3a588e9fe1cca5f6d558786eee23eb99de0333099a4e7489e2729b9fe7c7204b1247f782f30acd7446c262a06583f49db783171386f66078e070	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1316	2276	iexplore.exe	29
PID 2276 wrote to memory of 1316	2276	iexplore.exe	29
PID 2276 wrote to memory of 1316	2276	iexplore.exe	29
PID 2276 wrote to memory of 1316	2276	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1504f3627a302a24c315d2119f8c96a0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62a424219b069efc375d9dc1560031f7

SHA1
3b99933e91b50b301eb73e0bd1c15c1684f0c6fc

SHA256
82d49c79f9b33b4c4c7df26ed988fa91275117d3bc9f313d29bc56ce44622223

SHA512
3d25596735e06ef663a0ecb82cf6d919366b61194eeb21f75f1a8c0eafcce090c8a6b7523f858939bdf9ccb0d38fa21547199a21d8575dbcb886279925a8ea65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289f4e7a64bb0e1129a8aa45fb9c79a6

SHA1
3929bfc0a39a7acc470abcb273f91baf5bfd1b3c

SHA256
9bad729e30dc4ee4ee372a2820fb87c6248f4116b36982cc70f219ca60d2d310

SHA512
bece9a7eaaed90dfeb1c5009ae80ae3472283aa4db7b6562f173620dfee3f708c27753763f33a5153748afe00d5670f089f6f5f8119077f872c804a9bd9df03a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7be21b6d41c828d050b7ed1ef795767

SHA1
308ade5661e0166c8b6c9d0b62581346497cf2af

SHA256
133a84408ce1be7f33b04d067c4894e820b643b177da33429310da508f7ddc7a

SHA512
098a88a318bf9203c70a1049b767889a750c063bfc07b07a052b9aab089777be4ba5dcdb2db8f3e979e7b6119eeb8b8f991a25ae75fc7388715cb1b46465f900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f41588d5a52d5636f9cc6d2651fc9f7

SHA1
8380d3318409213905e403196438360eea4560e8

SHA256
0c1f8af2ed192ca36488af527a1e9ceafde35efd7e3aa12c434a3497187c956a

SHA512
dfa952139b8aa2b92105838a8648362468b13fb10fade921409723eb388b3b3d5233baeef69c13366ef73dfc5cad1457cad52210110f7d2ecf5a2a0c3f2f7c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be5cebb4cd98d77a12c2b7b6327362f7

SHA1
a1b6a7cc0d85a2f2884f009309741841a5e8f2d8

SHA256
cbfda7642352d97fd7db6f9b22d90d98f6ae801c5e6b3d55cd043c411465f270

SHA512
9f0816937139a337857389f2a8acdf66c1c638d704587da3f76f407a749fc666c542e7e56b2afaac275b54c935ac51f59a07799c1d995cddd3cc530257e3bea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57a33c10b138a06c2de6b46fe2158c83

SHA1
02891b4beacb2b262e6dae5ea4c70416958a9b7e

SHA256
9329684f0c412e32d09ae387fee88c6f28dc3dab7ce486895bc1c44b297b3398

SHA512
bccf352947ad7822d51b943649689388439d5f867e1bccaaf9949644cf8a44f90048ffe1591a76a27826e7599adc1ea811a5c3878819a301f6e78dc1bd16fe1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab173B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FB5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit