eb40d978fadaa6122307e8f366a691cd8a3e3fdfd43c5e9f0be4199165835beb

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a107d8825f9a3a28c449a9627880e7.html
Size

21KB
MD5

17a107d8825f9a3a28c449a9627880e7
SHA1

a7333922f73ce9b84aca9ba33ada9aaa52350dbe
SHA256

eb40d978fadaa6122307e8f366a691cd8a3e3fdfd43c5e9f0be4199165835beb
SHA512

23ebf9d7f00c32bc9e904ed964351068e6e65105c17d9889a4ba8ba74f1b3b73506dbb392b4303e14a897751158f1fc2282d59c90cd4016cfa9471ccd8bcbfc6
SSDEEP

384:WlGh0JgkjwdHE3pNjQiF+1zW54Fy9bzTXe2Im2yOEoAUcOOo4C0UMUEEcU00uBQJ:JoZ4HuFV4Fy97aKE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007171e9badeb85c21c2a144ae4a5cef2cd21836b77c7212a2182d787b38cbcad9000000000e8000000002000020000000b0a9875662cdf19dd5366737b18fc5be244377451a385bb5de791814903025c720000000059de4e9da956d91dc1f75b8381032c32d002e8e76aed4c37b6a1cf332be139740000000406fefaa7edca5b0c842b896b7fcfcb10e89c16aad35e0d889a2c6ff92efee54e05f1a06b4fbce94d287cfb94d8c2578b0e71c05735dbd7ed1b221a223b1e31b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02a7841243eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B859961-AA17-11EE-9005-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410434651"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000010d48832a5bf1313849b08f422dadc3543adef287b8ac18221dc61191e5cf3a4000000000e8000000002000020000000bb3721e53eeb408b66624e4a001c10d88772cdd9de1746265f3f686da4ea6665900000009522fc60af9797172a32d6663e42afe8a46128a3820760a37e264ef012d81bb4fa6f914d755f4d30901241e360257128f3141eec40131a7142a2ba61c7c0b19b1a27c3a8727eb616f833a41865d8738e8004bb9eb7943254b069c336352904f9100162dd08c7db7b1532ca5c4000de11b82652b8113de98026188858375c7bae217f2559468df08f7e9cc8d11f9cc5dd40000000866e55e77e2131852299b545e9007e8ed2ddf4b7c82027af6c1084beed845a1fa0d776648659256d92944552f216fc8e70f62d0df9620d64bfa0a40f230e40ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2684	2540	iexplore.exe	28
PID 2540 wrote to memory of 2684	2540	iexplore.exe	28
PID 2540 wrote to memory of 2684	2540	iexplore.exe	28
PID 2540 wrote to memory of 2684	2540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17a107d8825f9a3a28c449a9627880e7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d1b69629a70a17b9f1fa292cc2c1fec

SHA1
295384c7655f09e6b47e96e5fd0b0657565ec06c

SHA256
bce17a3116567398dc9c65f34353820b885d83c43ddac01577e07420041a29db

SHA512
ca1953577f6d5506c7611f1ec61ad38ae1ec29ebf3f9f48177078888362bf9b895dfc473a6201bdffc866b8b7a16339aba43f4e8bf447acb68671179f04be2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
485915b57f56b643c795defd0e5fddf0

SHA1
d197a28b7197f4fe7a63e908ecd5a13595f32611

SHA256
7dc327d57e5c03789df9288b7c2cff234281cbd9c84de5f1de4633fd7e878362

SHA512
a0f7695575dcaf4c350e610d0c4a5fe50c03f1a8284bda05aabb38a378ca07456daceeb2512d370a85ea301758e900cf08695befbaf532bd83d1426088f16056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67bc1a584dfe725ff5da7af470d9158a

SHA1
a9900a3665cbe8105e522d11fdad27f707cc1dde

SHA256
a82357996f7124dbcc0084415e95460087f4ed37c6878b8e86a8b2e7386a4674

SHA512
c8d3f3daadb223eda711510dd4dab04c72a26cb0e0f484ef04934da86b4f0faf37ab95b215bc7aef74b9daee90da94956f5909e7e8c06f800a1eedd0aded9162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff95a18306b5302c16ffc532511adae7

SHA1
eed7bfb53db57c970233b7c3f7b281cc3564e1b3

SHA256
b3d16fc194fb8bfaaef00679ae4533e1d4d5ce05f0c449f00940a45594c613a8

SHA512
9a9deb947424dd1e4a0146e0f54df2afa3a431141ca0a11ebde5fb6ad8cf62a0d47995921faf59b06e7884f8a8ccffb5de57ba3908f895a11ad69d80c8ceaea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
696e6cc658697a9bdbe3f2ab0517063f

SHA1
583b7e3ebd533bba4039cf59c6171ef9ed631ea1

SHA256
886152ee295e696cbdfdde7731b00814746b6144c95f711078e6461ff1eab3d3

SHA512
8835c26df26f6d0a2d12a0d92cd8f22c345c62e79b9b3b00428cbbdd372448a580dde8e2e418629a72abbe81124e2639b6f5e8ac8879ba9f9b7cd34bf655874c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de8f8c8a54fa3bc240494e6401e31a7

SHA1
e3f49e696db3106c18fbbe42a6573f22eb41bc69

SHA256
e99de91bc3c5b8076a5d1f6a54cd9c9e31dd34ec36a0a10938d44d70fb1f7ec0

SHA512
41c480110da73e79eb00b0389fc05ad86ab139f8f3ae878712527df1e71f00bccddc8a1f59c26eb5f9238a90ae0268d39dfe06d07bfb66452686669aa564b7c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d00a06bd679c029f6050b6449620c71

SHA1
094607554d08f9e6aeba15ed7b42642d9d302379

SHA256
6b03d7779b1a606f1d49ab4496fa3a451d9313c37324a08300452b2a43d65950

SHA512
e26369dfc5abb4051ff76430d6bd4221fb436ab8c31f52f06dcf9ab247c2461ed5f20b68032106104df15c045f301b25afaa242f33d56a2d746ddaad8318e5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e42a2e2f876fe62de739e0321316f91

SHA1
09db24bdb1955ad48ea2fcacd899b641cf73ccc8

SHA256
030477d7c33c850f6d971b760f716ba08d05ea5a15cd126a94138384e9544766

SHA512
466eebb42415050fc5262b8b8d580833dfe3c5d333afa98754e8d69b555db2a9af963e360bcfebbc14868f452cc95a73a1f6dc0bf65ed42a61514ed9ad04c274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fcb6d50c154b10a8cd152fc1b400505

SHA1
be2f1504f781202b312ea8a8c943f2e1411d5278

SHA256
ce8a45ca772ad42a85f418c8ca95fa47f37cea73a836162cb5eb1acc3bfd365e

SHA512
a39d5b6f254599993e56031afd89e5081684ff4a981d989c1dec06db307c1d568c936c074facff81e6681c3eb37851c5556aa810cefb1347a6426734e5a5ca39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
616cc5d79da62ba01c6c2f6d9b2d36c8

SHA1
5a6f378ad9e94777d3c26f60592313fdc160b8ff

SHA256
453b8d69232a0e4684df9f8fc290adfb30c1f97ba18d17994c6f6967575e9058

SHA512
679c1f09473444cab9adcefec5d618f9d255b41468bee83e570051c795256fd992958280d0866208df152b34576a627628ab48b8785df376abed11b3b2c82dc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE67B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE68E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit