e62d7b3730a8208b0848419a5459a3a3b9b739e2f29c03fa5bdc70f624e0f189

Analysis

max time kernel
138s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15ee1689ac3f8fe94c5f467921ed6e0f.html
Size

53KB
MD5

15ee1689ac3f8fe94c5f467921ed6e0f
SHA1

35ab1986689d589d14dea350e96d5f69beecddc5
SHA256

e62d7b3730a8208b0848419a5459a3a3b9b739e2f29c03fa5bdc70f624e0f189
SHA512

e2c1b6f96be1a9da196f0b871970ed10b948126e7cf75eb6fd3789b952e80a6375ed0e780b85784e28c5169524144a990749b92fb6a31fc77a9165d7676a7fd4
SSDEEP

1536:CkgUiIakTqGivi+PyUPrunlYh63Nj+q5VyvR0w2AzTICbb8oO/t9M/dNwIUTDmDa:CkgUiIakTqGivi+PyUPrunlYh63Nj+qp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBE744F1-A7DC-11EE-86D4-76D8C56D161B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705059d5e93bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410189648"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000892967072c60346d626d0704f86f125d000e2b4adc94e55cdafcaafd97dd3ba3000000000e80000000020000200000002e8b7af2fb8365915c4455bf807f8842de230c356395dc83e98151b4a739bb1e20000000995588a429677d71c746615d9b7913de4c8b580f71657c723874a10d6421f019400000009fb6742d136b96186e946a557488c0b4019fc0d18af9637b2f4270153270ae7bcfbd5bf106bc8d7b972f8287f9fded07efcb40f7d3be273ff84d4b53729b17d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000000c79f66904ecbc5410f27896fc27360128ae49ae15381953d658dcb233d8a670000000000e80000000020000200000009d037de421ade64ccf5752ad26ea3d00cc98306759876abb4b5952009be253969000000027f3bf249985f3e5a443f640b2fc101dce0a7facfdf80c4a2a0f5d469cc5399628342d816f02b2bea75d72d6feb50647f854d6cc53eb30a5630388b086e2a41527cbb5c2fdf8fd47ffeaf514f0bba1354e36f4ccea72c90a072abc63b5686a80de06c71ea6eb20f05afecd85285b65c257cf434ff3c4a9ed5ec3ebefedd00e620545422ea82c67684687c761a7a67e49400000003e893d962d1041e4901ebd01408c258a14d423a28919f6a334cce5d596dcd82c04adf86cec1fb0943a66bbe6411488dc3755ac03e3c1af6cafbed73b2283c7b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1532	2376	iexplore.exe	16
PID 2376 wrote to memory of 1532	2376	iexplore.exe	16
PID 2376 wrote to memory of 1532	2376	iexplore.exe	16
PID 2376 wrote to memory of 1532	2376	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15ee1689ac3f8fe94c5f467921ed6e0f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15aa81ac59e9a482f092f0c4ec1c246c

SHA1
025875ed56605087fb14c64992687efa1231fa87

SHA256
b0ebb14c21c73d042f62cffa7d68ae649fd2d235c30f511b8096ed66cd286240

SHA512
86c77f0b055368ba53a03e371bff044e5ae983673d1efe0e1639790b22421930cd0fcac8e4cd58e8a38f5966816f3b7b37e3dedb903d19b18dae5f779b2b4faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
565577f738b482cbbc82087abadf669d

SHA1
3821def8a2503a02f1b77aea7fa5b527ed2878c6

SHA256
422531cdf10c8cc024bea3719a6aa442db46e6f88032cfe5a57f0b29702e4730

SHA512
04ea5e4dab552c429c846a7a6c121dcd460d4fe38f92287a9e972df0a9dedb5d2a8442efe5d8a06c6009edaaa2778bcd88dab1994cd75c78daf6bfb16ae05c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be2b36ea8e996445da85eefac916f26f

SHA1
f29d23886aed6507bc8cd6ce4ff5feb2dd2baf2b

SHA256
ceea34416e73b27d505d88674a0e9ee5b4f509bbf7fb281478d547ee7164882a

SHA512
45dd84bff8b18b5391d7a1dc2825eaea74e47b6511f519a6dde3b3b466283c8f122482d9267d7eaa5b7b3876181ae7d9861bc3be7a6a3597b741e92497b37c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58172bab0620f6009c002857c48bddd

SHA1
131fecae484aeeff24484310b8787594697e4f3c

SHA256
2c9ddffe7d513ad29930f3e0fe179a34b5b3d7cec2a214ffc2a98447e8b6b65b

SHA512
31172993eb1e2c9a65ca735fa272c1ef8d36fe4d0c02190ab5f9585e9c2d4944ced42b6c9982f0b47f1dc2b6a04d00534377b67bf20c49a2f563683ec234d8dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
030c58a89e39bd1476e2114cf35a0327

SHA1
53b6a9e580d45b003e9e4542a550cda6bff41b5a

SHA256
f912d0f5ee9252db43a3823565885ec57208b69bcfbd3bcc9ce958c90a8e036e

SHA512
df3970d6645842829d2f9d39d16fa31adc06fccc593d5b7ac55ac9009f7256aea1f698707cda772c7e7648ee71816526951e842e79781762dcbc5c70abcaab1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67b56c551f0cdd7e0b7425c69bf22b6a

SHA1
3ac504cdd17d1e3659608ca8c87e30ffe3a44815

SHA256
aa52cb8253a1de1dab110c6fb7aa350a936eb0990aaef3b65d6c2ecc17f2177e

SHA512
55e71aea3ef1c6c40777e7c60c47c35ab766e2a76c465025750fc4bcdf8546c6af1c9f10f85c85553cc14d666927c5031439d7174e5c4f36cff76f41c7fcb7c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627137dc0f233bda7c4d9dd125d1fe41

SHA1
82d1fcab368d4ad3d8d0d0139461d7380dee6710

SHA256
63295c2c809b71e8998b3f71dfdb300cdf90cf07c358e4d710df80af530237ff

SHA512
186ce22f3d089e04a6ccccc3858280d7b3fab3922fb3adbc3f069f905dc7b4c94813c0b7023e9fa7796805729fe4f33067a89b2e7dd63ceba75e6c393941f57f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1609788acf19626b447a0db16626eeed

SHA1
822a103850589f65e8aef30bb4b0a74223b0bd71

SHA256
28c63d620c770a847b12e52cad0dd7622a932fb4dc9522d56266f94babd6eac4

SHA512
fe15f8e01aba34985a165e26239fbff207c8eeaff1cde3715276286ba609c8c42b57ecbbeef8bf7f6c06b68bd0157c547b85bd742e1ba8837520116284847106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae147b0c377d283766789c3b6423ea06

SHA1
b937e9c5ed197b052741b361355e56e655d41c7e

SHA256
f9a94893257f37ea9a8fe146cafc5b8b6c59dc3a72f87df709e65b4963d2d93e

SHA512
4bc57ac5b836327922ae3fcbf1aa6bf30911ed9cf1b1d4a6266336fe78eaf1acb1daff4d32efd58762eef7f09b7b75d8db870721c7da9a21def1d96fd64cf7bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab427E.tmp

Filesize
32KB

MD5
8fe278bd8eac660d0161a869da96b8d8

SHA1
eac6f73862d89fc8c49b5331cabe89b6a57019b1

SHA256
e8a6de34603eb9e91ba82f555080758e480ab044ffa9c140028706f916eb2c0a

SHA512
b180b8df22e421493dcc75a2caed123f7c7756295f691579ea5c426c741f80e381b4960b5cbd6b5e87547d75e44ab654d1c4704fe34b4b743a57f334bd05846c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4753.tmp

Filesize
43KB

MD5
60d820932f17e6047325a1649e86e950

SHA1
a8153916fd3188d6d5e5a7bd2454a3d9e0e49843

SHA256
25c3bd23ecf351266db627fa3413c520645cdc7f9e4ef7ab379018da39d9c7cf

SHA512
59ba367ce564401b8d42be87c04378c9abb27133bca0af4bf5de066baa83c30727ba81280f189283bdc3509365190c3daa5475c2b028e65991202d0f7f16d6de

Download Submit