ad51b1f0807632a6327366e5408dc62ca50fbd9f2fc7cb7821357c04b0ca79e2

Analysis

max time kernel
124s
max time network
200s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1780bc9d27a9c1fb4625d6fbb901c661.html
Size

68KB
MD5

1780bc9d27a9c1fb4625d6fbb901c661
SHA1

c14e51b7b49c3bf83cd4bae70f7d195cc4f5c473
SHA256

ad51b1f0807632a6327366e5408dc62ca50fbd9f2fc7cb7821357c04b0ca79e2
SHA512

f6fa070345b89d067e80f8ed90d78b620458c91ad409e75499d12ed8abf786cbcc93a0e62be451f11b8e00aa24acacb79979905d58610745fad6fc24f3bef6e0
SSDEEP

1536:h0HkF68lIKlmCPv8/imocXgQawhtRvjn8+6AHD8d+YBiwv8P2eC/C9Dv8WuBQF:qUmqcQQprtD5kBQF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA23D1A1-A80E-11EE-B36A-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410211164"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008c1a0a926bd9886504073ca99f2dc0902c4eb109b187262819bd42b156bb338b000000000e8000000002000020000000c3c1d99ed38a58e00ce94923692e8d804b0b334549fce7213e5a92a080932c4c200000000876240771d08adf0c806a4e23e456ed2aa73a2a3323d5a842ebacfbd032878540000000f33a8438cf58a030b27ee9108e8e795100e2f5a6d2292b12360a02492737d328a1e73918d3a9c977830fc3d3b6485fa50a1f560e5cd40afb4d27e59e7f6423ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000298e656ef78d54aa4b9de41300fd91a9f1a91e36d872950544c16f63921b1726000000000e800000000200002000000066ba701f58cfcda4fb3711615c71ff3fac44d48ddfd5d30dded5391474845bee900000002ddab0d67556b75ae750792420201172e2cbdde1cc702b7d0fd9ae0ce39ef2a09a7cb4ce6d1c9f7957d955eef672a3ff635be531e1df506cc84036c3b597b4df4b2a23727422153503b87281bf5402cba5fe423a93b92c66bce3a2ca9626bf5b2a198e973d068670c3e0c2358ae0a99e54bfc8e1fc69b9d70db059232fd6eb8afd33c5c367c3022d0e8e2e8fb95c5b7e40000000b635a3e2a86333ab45f4fcb96fe3e96d339f55d105a3d768070037a0d217add3e7d6785e7482d9812a9be33dbd79e3b866be75aefebab993dd16df77037f003b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2082d0f41b3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2604	2348	iexplore.exe	30
PID 2348 wrote to memory of 2604	2348	iexplore.exe	30
PID 2348 wrote to memory of 2604	2348	iexplore.exe	30
PID 2348 wrote to memory of 2604	2348	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1780bc9d27a9c1fb4625d6fbb901c661.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b54869f51995af18fc87355f4559d542

SHA1
969899f64f05d1c32a00a8530f770bb5640c55cd

SHA256
ec59788720362ba6a3073cf2f5f1a69dded6c6b1382fe9123486e98df6cc998e

SHA512
06caf2fe982c97ac59bbd820b8867ab70a43cb6c62419a6ddf709df82ef09de40be90c29c628cc4bd1ca972d521753557e6d294cdd4abd15f713936029e8c924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24857a2b1fa71cf14e8d5f1d12e842e0

SHA1
33c90502c3e4379bd83f353ef86386f0e60c69e5

SHA256
9dd3602f19e78f31ed9d1b94bf7dbf2149f21480877284a4aede451d2639cc59

SHA512
9d72de91cee744507f41d6a0f3b234df0dab999f6c15c8aebb535ce1e629b396c3db681b82f739c8b18b0a28ff03a49507783ab7fe541f1bb4ed83f10563351b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b3bbba5d22fc2f35fd63eca2068623b

SHA1
12ae2693629fccefeb167ba115c665a630675c14

SHA256
f32e4194b8ac41f8eb721b5eb07bfd1c017ce140fb6ecdf49a762dec08a6a9be

SHA512
2a7d8aca1ae808eac750e5283c0976421e6481316d33c782d7a90fbaa821c0761841b2385f6f0dc5f2968638aada9eedd702eee9350614c9ecac7b950c6758ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16e7c78044945015460a513d3fb37f9d

SHA1
33af315aec8f78ac61673a06ed9c1d24fd871a3d

SHA256
fca0ca4ae98d799fdcb4dff9cf1c77d9324d8f39d12552929c92a48b41f6b8e1

SHA512
f6bb4a2473a312408438a29bfb0f7617e8067e6722825685b7c8d055ac73e667e44f0812245d6d1a06b265d2dde538cee590c8c74f8fa3565186752fb6e09321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
776156e14e3f75e3bd5189957960051e

SHA1
d39940e88c1b1d641097ec7e76112aeae41fe94d

SHA256
6fcca5386e8f1016abcca52a79af381d41bce55f375ffd73cf1e4b7d3816627c

SHA512
6740cd08c43a8739cabe88d0ef808dc8eabf378bf2671b24f54e52f7c521864c14f0e40abcf156725fe6048a9bfabb410f704ce2422a300ce44340b041593956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
719f12b4305b3c59b1057e503614f98b

SHA1
843517d6043f89a34adf02b2f3d7bf1a44bce090

SHA256
d0be004f84a66214420e50fbbc5dd5856d7abb0d28fd3258cedfd6afc2b60ec6

SHA512
03245cf6693a0ec05a1acd14ccefe617e2c50790d7e9f7d0a5653167519408cbfa6dcdae4bd5a34669cc4450e0d58ceb30a54f2b0534e915cbbbc83d9724f01d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38ec31a8afe1e9cab2977d8260840f12

SHA1
154ad7aa1bb3946a68df2671b62b736c2089753b

SHA256
040a6875bdcd48243574fe2f7df42ebe8cf0771e01c3390aee2b5e5a81f61282

SHA512
f0c993d1bac7f8eb24b3782d57e0f1c4b0cac7f5ebd96e94e95e84d317649dacb8928785974cc0ec50527fe774dff9d2814314f9fe7ee6eb8f8a6937b78b0800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b16df1ac93dd783404631528c175e3

SHA1
db986f39abd7bb832119eb4759556e158a8f3519

SHA256
2dd301907d6c2d8b97977e6fbd029adc89514400882ad3f597c72b4df1a89a23

SHA512
8eeedf2c341a9e13c3c3a3e5307338cc35d87a7e898ca5d4d60f212df5d369780eae0df718c32cbbcaded4d873acb30bd362f41b80fb309af8a08535bc2ff189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b047a1e2600cfe4442fb1c10935e7110

SHA1
76b412cbd1858869ad3a886921aa54c14cdcd7ab

SHA256
9b7bcb82984377a0b2981d2d202acb85d2c89e01cbcc964f037b5c747b6066a0

SHA512
d4a2d1d244825dca282ec59dd4586a89121ecc655f1ccacf66020eb2e89bb76b63abd6a8921b35f5e8a1a351d63e64b16b5da69a4b8d31e020e513fa97c41bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea0363f7ee6e19678c6f56cd70e9a1d2

SHA1
29fbf479aac753ae80fa4f8426bc66431a7d3ac7

SHA256
4cfbacf40c0af9e64bdcad938f9226d93eea20e5eec52f2c3a205835435a2b9e

SHA512
f37678488c0e54d7f28ed8ae1271f67712bf1cc22f3536615a31dccda02d287c53d71a5a01ecfd9f2cae343fef98b632e928166f0308ba268d03e8769264c0f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e5ab72deb36eca30be97559fbcf0b1a

SHA1
5dcd1def353ec3ff6135d143339313846f75dbfb

SHA256
a42e3540a6c17a987d809885bb1ba5df91ddfc7b47b63604b87934aa3f6d0278

SHA512
2ee3c7631d99123de5fa7e05cf77c9b406fb3bb66505700a67135dfe63b2b2a386b9c774ed0d13833ef1cd327ef1c30bdcf802f2f8aff6a6d60bf9cb9da63ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3a2f79fa3aa293a5d8eee69a4f33cd0

SHA1
968fc8629869b21505f12e9021470430142bcf0f

SHA256
3995eb3500e3b9bdfbee90365e5e503646099d3ae48ae8d82d713ec9892b4607

SHA512
d9c535acb1d1dcbe172416c6ccfb2c4952fe0818adf8f018e87d0139c6f868f02b00d258cbbd9435b7f8cdeb19bf3187bd364d626695f7e3e6deb92e3aba8651

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab190E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BCF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit