458e5721bd73668301e359fbd3fe325295f84afa839a9b6ddb4b59975ef83dc6

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b46a1e2f9e3f37f304cf4b713b0dddc.html
Size

11KB
MD5

1b46a1e2f9e3f37f304cf4b713b0dddc
SHA1

39dbdd43aa150ad519a0c6cc6488ad5a6a575bc0
SHA256

458e5721bd73668301e359fbd3fe325295f84afa839a9b6ddb4b59975ef83dc6
SHA512

9e0c27574811b45bdcd15b0c432178f7ef79afa90dbb1459e16a49d07151d4f80bb29ab6a5896b7e9dacbb343232c0f9dbabf3ce6cbcfe734c190fd15b85d029
SSDEEP

192:ln8uqnGDSSW0nqoULAGE7k0pNSG4UurXtjHoGmB5QopN6w4JUJB3QcvzeWPMJHMC:ln8uqnGDnW0qx8GE7k0pNSG4UurX5H3x

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410236783"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000081d09c48cbed69d5cd54f1b17e476c3d4f7dbce49f1141749498df6fc776735a000000000e8000000002000020000000e058e2043cffffba7ddc68d8f04f64074a69db0347d1c1b91f593abfa01262c7200000002d1b74d2f70f1945346becc2d5716b71e2d032d1476a2a4699e85a5b82a3d31d4000000072afce3767804aedc6adcb6dca2f696bfaaefb0b91f90e7014d0df6a75c685b3216df914655adabe593d9d258f01c689fd4cf8ae5a27753e5c2a1cb5cf571d79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007b4155c2f6b461d0fb87630c67b228e509fe4cb396dbc423011e13110fe3961a000000000e80000000020000200000004b71d6f1deffa447c445f6de0f6ec51c281c8460dd636d607a7ac164af92b42c90000000ac56826689dc9d44b5231d704c4bfab76ac5f913fe7ecdde99f32e97ffeff25c87f8948de94b55cd0314bd78de507cf0ad72dacf887a3d30d601e488e3e8ded459f85c8d874da24aa19656188945b695140f0632e84c0f10ad4c7879ec1105481723c5d0b0367884f7c16dcc8f2dc23f6aa6ad05536c208afff7fcfb56fceefdc57298f868e20c91df389aca4e8fb07840000000712b5fab374ad94e31128b7ee284fccf2e58a661ed689452d5b4e0b612f78804a42cc52a66715bfb594bf059d68cc946e250dfe1263b902f6d48256539abceac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8FD8001-A84A-11EE-9776-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b9c291573cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1316	iexplore.exe
1316	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2696	1316	iexplore.exe	28
PID 1316 wrote to memory of 2696	1316	iexplore.exe	28
PID 1316 wrote to memory of 2696	1316	iexplore.exe	28
PID 1316 wrote to memory of 2696	1316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b46a1e2f9e3f37f304cf4b713b0dddc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82397c74d3cd895d4ed31b16abdc602c

SHA1
e23ac4f8c307fb4ba09384fb1de47ed7682b2f26

SHA256
11c175e7f3eda03411201e367d575795f2b279783741a459fee393e076f154e9

SHA512
ce8240a52ca58351576240a95de7661f3ff55898c85d2ba5fdb70d4a9cee9cc08ed928f18143a62aa73b8fb20904e8702e4df3ed33ed4154356bd4ea0ef5ccc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
927878c0d13d19a6173f26ba73271070

SHA1
5629bd2c88ab680ea95428dfea6905fd07b5fb7c

SHA256
959e4cc6c36ebab70d1428b9a191ed5b764e584cc4c33480c6aefaf47cc96a3d

SHA512
3d6033db03027fae8b59ad9edd409f30dfc596c257725cb3564441ca7fd3b70394625993bfef6523c9cb39b889b15ac8741c56592e91be6dbe56bb87bf8d5922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3817d1ac216b72ecbb493e33e527c95

SHA1
d2abfa3c95ed5d267119262589b1164cf3290293

SHA256
27f529db4a1be3296c0b42ae6c56173bdc9ba3070be0ea80f3cbf820700dffc7

SHA512
b57d87e8a8595cefb79915fdf56c7c79ce0e28683271f80105690805e9d417793713d64462d3b30bd97e7ad77c9c274a7406e52265d5f0f5d81d3f0c4a2cd149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff17c8eb148c0d96dc0345dcb9610bb5

SHA1
a908ac698e19cd2b65cc7680b246f5a7ec383b54

SHA256
9de3a021ce4671edbc38a920a0585ac6009d75c3ed2754ab7122753abab526d1

SHA512
6c324facd56e63f13ae7b00c5878f745f9956b594e0f0f3b3948fa67d487878954875d0e2b387bd0d38bb3b06f926182b566eda8d7b5c671dc33abdd3947cc5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80ef7bad4fa95ffcf693af1be7699cb1

SHA1
72f6be7445b32f0f47dd61639c7a7c409d182742

SHA256
8527f9d2c7e455a57edcbaa88f5d875c74515be98c7675a4a92bd168d82eb3ed

SHA512
383c2e23bb50b2098dc5eb20a9495432ab51ec7da154acd63d1d73716eab835c630190f411b10c722653318aae9699fe233c22aa494440656867a4ae6585177c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e08067c29db1bd39514cb398aa256d9

SHA1
41f4c706bb3ce5cb8e99ccee3ea3ddd7da2d1759

SHA256
7f00a4021387fa629c09f8970246dd4e4f05ea5eaa00ee814163ecfdd726e37c

SHA512
bc7cda4c0e3e6acccad9ce39fc4084bbec06c554697fc4b54dc434c917a33d46ba9108dd33c4a79932f789a1d1807fc8e5a69b2ebc5898b91521c6b1180c4d89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c672b1de603d6b1856d77bcf266a9e

SHA1
3f70767b51471204c593de3d879267d3af17fa52

SHA256
32cb1792b65f1d9f33964eca523444a410810e9873536ca5327078081dde85b8

SHA512
9e8f27454f14af53eb177b157fc22ebb983f5b819cbf161dc281e67349ca76f2a390b2e230b7b3758930383c1371df777fd5b824bf13cda2a0722e1b4e649548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
935bb66fb31cf5fc88b926b383ad930a

SHA1
6b691a5d2cda5477a9b475c9c06ba5105b9fe079

SHA256
c4d43e41bc7c7ce0fdc78fdbc00b726ffcfce5f98f9b3aba7d2118b12d8d7837

SHA512
53b87e76fa3dcb60325154ca12f01c8c61879a7b9d332e6cf5176c7168075f18075e95cb3f10051e9ae3c33ec9ac81395ec1a045f0664176d168d6a743110011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee9e32910508e112e004f8d546574189

SHA1
973060e070d86af67116a67788177ec5bacaf5b0

SHA256
a3ee480266c027e49ee4d00464bf88583bcebb90d5232fae8d0546efc7faf066

SHA512
b3fda5790b4d0d9407c1e7966dc35499f898b92c0b228da45d070d33284965916708c3f1067eaed51fcef580d26ea5b03aed0b015ca9b619d6ed02a431c86786

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6B4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8C9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit