233b195c991225bcfc34035f86c186fe08c2e227fd69e3bea8ca9f059002ca29

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

180fdf4ad23c00c7301772936ca72a55.html
Size

11KB
MD5

180fdf4ad23c00c7301772936ca72a55
SHA1

c34ba85a53be6da4118057e412a2887560eaaaa3
SHA256

233b195c991225bcfc34035f86c186fe08c2e227fd69e3bea8ca9f059002ca29
SHA512

d87788dcd17c713cb80e50745148e4e04a8b1b5e4d9a8bdbb0a858713a64d98c590449998f8e5811e207f975346cca68aae1fcebad0c9cea506a44efdb9610e3
SSDEEP

192:EzY8Y85R5/QNXhJITEu6u161g5tzk7C1z+IQYIgVg6rroILxWzfkR0:EzY8Y85R5WXhJITEu11p5tzk1FD6rreB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410214899"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B406B261-A817-11EE-A5DE-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000000dd76bda6c8381be79e328777d5af1786055425a584fe60c217d011055f50f45000000000e8000000002000020000000a2831236dac72cb51afc424b3a7b8c0d889c8288aaabb6d2d584dc1aa8e53de2900000009961b97c225a927dd96db49d12753d0174c99460f9dda2ef1974f2dec3b0083b4624692028c099c6bbd676287135059e04da0b04f421aeb0c68718edff5164e677d9171712142b19b5646a20314ff413a1ccc07840c41ffb268fe2cbe78a0a470a6a5b8f8bd0d573451633e6161a56b2346ff06247bb05d4f24ccb7fbd4dfe7a4f5ef03a0c27d097734462ea88c43b904000000041acb5735fb82f8abd143f4ee3b0cafb0413377fc02a19d4e8e68edc0d45f88e66ab9ed1042c18c01710295d3f85d47cd6580ec5518201aeafa24e09c55cd662	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000581dcbfc3a916be8ce6c6ede9e6d4bbddef376859941c51014f8f5e8b6abbb77000000000e800000000200002000000003985b662b78c90f29b39aac3f5e520b9093542d271daaf48fef6f8a57ba17f720000000bd4c263842bfca8a49e707ed3f26b31633bb56980e76dbe0cb2d673cf7a14d0740000000c4b93ba454926188fea0ca15f8fcaff49910a4f2a7edcb510ab672334d2864a97f2556097367507189c78ab70e1f52796c528d4c63d09ecea1c8c5058c10a1b5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ed2689243cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1520	iexplore.exe
1520	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2656	1520	iexplore.exe	17
PID 1520 wrote to memory of 2656	1520	iexplore.exe	17
PID 1520 wrote to memory of 2656	1520	iexplore.exe	17
PID 1520 wrote to memory of 2656	1520	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\180fdf4ad23c00c7301772936ca72a55.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7bc351cde5c5a1c9b22b70b2af8d4bc

SHA1
3580b4bd198e6aee4d538d9abd2332a34150fbb7

SHA256
3528b5e6f634fc94762d6c6d2552c75996511910337bfc89ac80b083ccf4364f

SHA512
ecfc940df493158b0952c3e5d0767589985eaad4a9b823e3763c936deaa834a1c73c7682cc87610bbe8c261f59d43bda88d028d43fd6e927d4a2aff6a0dbcd96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f8c4c70e3b3aec40ecebb72b9807a98

SHA1
8cda7d1875e3e6da5ae7f2887e7bf886218be3ed

SHA256
94c1687012d7490901e7d31011fa6e64b6faff0b44461890fd188e536e300337

SHA512
48ada63ee43ad349e04b4bd2c03759e567e49b150f644b4e0f5e09ebbd6608484044c926dfd3d3093dbab434f050aed0fca1809bae3b06c85f8973a382bf26f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6933cd1d11083a4cd3d9d4cbe0e30d6

SHA1
958732cd940f5024e0e9c4974f5e9328e608c6f0

SHA256
86d4fd92620777714d2fc45ed0642cf9e855eb959ddc5ca9902a93663e9b329c

SHA512
a53e9e9514da59b6eda2353e800c413f0638e0a1559e8b665ae42ec5969ec1a5c46b08968822e7207ac93479adf24091b0b150be2aa8d25aa73d010491be9f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a45fe62ab604aaab69210c45175592

SHA1
697cce5158acdc818a85bed4c6dda285fe158e62

SHA256
f574a2326d66d1ceaa1a25695198b934027f83e71360177f06ec52d4b73dcd05

SHA512
fd8cc4593a5549634efd831f131b12050fb6aed9f357af327bd41d9a3711defe28764d669f41d329f44549f4e34ab539d15334d94abc80f068d48e87c811056b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4cea96c5a26ffbcd0a25d1f6ba2cc1c

SHA1
85779a2f8f9026dcf8589d677e50bb6ddf8c0b46

SHA256
8fb27ed7e3799eda7f458324306b9eac248da673a8a479f31c21cec46118bd2d

SHA512
873e54ed24d19ac9a4d80a3fa593fbdc77eb71da6aeac6f9c5b9c41c418f84b21b6a21baa7ae3b5d357591e1e760d54fd8cc65ab366c4b75c9be9828ef5f6ba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4dd1b599076e2ab05ba197a816696d

SHA1
4fc3da803b3bf59a0561ffd33e8f673d8faa3995

SHA256
190fd180496b429292c79dfd7954fa3a45199de33a8cbc8577deb6ee8d8f2d3b

SHA512
3f6a23306a9008d8c0f4f0822c72d634ebd3f18d4156d2fcb67fb2fee7a5a6a236277b7beb25554847eefb7e8e59048ba170661ed8ad059b39390256a4b76dcd

Download Submit