e43d78005162503556dbc07411727d35e08fef7b3d45d7d264dedd03fad77d38

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bb1518191a9a07eb5226756055ad26e.html
Size

12KB
MD5

1bb1518191a9a07eb5226756055ad26e
SHA1

26a463b82a27ad0a539d082e4151326597712992
SHA256

e43d78005162503556dbc07411727d35e08fef7b3d45d7d264dedd03fad77d38
SHA512

00582b14d8b895e9703025ff3acce32d9456a6e8351a33ad05ce0efd96ab7a8f34a0232573207a279a93f017a76139401351525e75e5cc57907e530dae857d3c
SSDEEP

384:sTlIc7Vnojxa/gYLBkZcnY1DA703aguLZ:WFgTyCaxLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410242706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72446751-A858-11EE-9201-42DF7B237CB2} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1208	iexplore.exe
1208	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2716	1208	iexplore.exe	28
PID 1208 wrote to memory of 2716	1208	iexplore.exe	28
PID 1208 wrote to memory of 2716	1208	iexplore.exe	28
PID 1208 wrote to memory of 2716	1208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1bb1518191a9a07eb5226756055ad26e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87d3c1a1e836e46155ad5852da0a0f6a

SHA1
0552434f60fb9504d685920af6cd226c7ec8b1d4

SHA256
f29cc7c07a8e97ed0722d4cf3dcda523da0e942ccac4de29226a94dd65a6df15

SHA512
41438c399f5f61a8d5bafe9e8fb2fe3004e422449e64b61ba2e41b32275fe9638a9fc38185148615a6a144f85ca6052bc46cdc5156ae6f1aa4c2ef81e28a5d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73d0aa75dcf85701b7e6e02f35d435f6

SHA1
7c51fe78f481e0a7bfb3e79fcdadd8f6094871b7

SHA256
82b8d1c4c40239933783dbb9a45d23da2c15d1e8f97d92097762fe25e5b5b921

SHA512
c21ebfacf6ce6755abecf5b769bdc1027744fce494e72d28453d0fd89de410283cb584c2bb9ca6e425b544de13f9b3279c798fe0734d97ef9538ffbbc804f46f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06c79e71dd3b5810d297b8e8017520df

SHA1
ccef97d4384bf3c13ddf220ec386ecd676c653a2

SHA256
3165344668fe1e9eb8d2bd1cb4695330dc75f4287cee995c2208c4659fb76bf5

SHA512
ff5dda738311a7f799af391289854d6008c73dbeb6cd9f9b61e13213fed925052b777824868c98a036607faf40b2908f9fc6e151efd05a48b6dc673d475ce150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5220a7a9a58eea0d5ee7b2df3a92c77c

SHA1
a60adaa1980fcec868d24375d4ca2273654472cd

SHA256
fcd0817ac1910894a338602650aa82407daeba220251718ebf39761745acfaa8

SHA512
c5647d8106e659f09373f4988ca0a89f3f2b7c56c95f2a5e6be90183bd00ad412cdd740c5e7567f834aaa3a07e85a493f5c649b51fcefe302b5feeb1b5070da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e04f2ca0314328218fd41c696efe26

SHA1
a6417d9a4232313eaab7fda63411050b9e864d55

SHA256
490c95dcb3e54fbb92dcdbfa45d3e7bc791b9b2fdf4f4283323f7144b7e8a0ed

SHA512
609aa13fdb3e832ef581bec725a949e1815f87411aebd942e41ef49b281247d2ebe4c8f8890395e4f94baed445d3447b21205434fd83561bf798af03ac42be5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa6075ea775cdf16473a289293fc0b64

SHA1
0e56344d781402c373edb4456d0312de581484e5

SHA256
5d51245eef940c96b047fde8223abe49d9b328b263590c72fc993d0819a20542

SHA512
3ac605635b51a05a6b6586178765325b4f8957861f7d3e495e57256b45a20b55d06a2d2f7561748870a676208f53e7dcee032635455e402790a510d24168c24d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe4b6976a8eec720d15bb1ca89089a8

SHA1
b9760ba653c8d9248cf56fcd22e51692db994c34

SHA256
f06c42225dd61a023994477b20fe577cf414d409625fd10c747917c75c9dade7

SHA512
898fd6c6a73139699fd23dcbc1d1c17a1b16fea14f9f50855e95b7f532b086ac035ae4f78ad103bc7302efb1121565b1a837c7b38602ea95d968a39f6e9cf2a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96a6c570fedb48cb85d13d52183a545a

SHA1
3778df2e8b9ec0e3c4f33c735b6422f570b5085f

SHA256
82844a5f01f70752b1f80002a27003efb798b5252dfe537a345c36ecc5df3e7a

SHA512
b3a8d39cb1f1cf39ff592bbdc94c8af4c445bca52bec1a6d683e0aa318fcfd17ce23549edde9e569a8ae0be7cf0b96d36156150041d5d63b1622f5f4d0967774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
109233b308068e79ba11eede206b7ee1

SHA1
168777c724f2539090ece4e63d1df3e0671bc493

SHA256
054e6dfec34527cdc58900007d9a1dae8fb8fb3c2c82d4c980efde43c90391de

SHA512
c0535b841d70060a7ce72b83de2433a338e007b5ef4668839cbd120f8c0781d569fbe7fa72f1e6807a0c94a9bcb65fabef8e1f8271e6ce6519e8b3efd3e6aecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf50a4ca13c68f6a1d3dc4b54fc70e6e

SHA1
28478406616057062b2e34d897f9a1bd0c3e0f89

SHA256
2f10e0198f570dc37a8e435fb3e862fe221942c852b71fdab44a2a6e512e9f57

SHA512
d8a4cbd4fceb9467f8689f65a806fa655e69db422fc6dc6922163e30442ca1b8ce6ad87233f1e8db5a0e68c277976d4a135612d75738b838628bc1a790a9183f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3331cdebc3e828dafa603df867d48d

SHA1
9d7e8a961f420bc932c195fe6a3a64426b1a0efd

SHA256
0753e9333a40223cf96c8b54766e587e397069febdb68f182f65827d9bcc7d3f

SHA512
243490adcf70751f36f7be8d5bc1bd4fa8066bb2b147f7c49d83c530195753f95b61b9d8d2b50d0e8fb4f25ef53416225c149e447c1031425900020a3d3fbc26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b02f9fde24df02714ab03624dec4d5c1

SHA1
1952260419c9524c1902234698232022a76b4b80

SHA256
7fc608a6cafabd786ef69416f8d3829b59ac5da1a30805d748dfa07d7dbf667d

SHA512
388eb044187c049757d164e90fdb74d58ed0147e33f6b29e02cc483f34fd9948330bb69635a1a8467eaa7f829a153b5c7273a28ed5af994d57da2d24029db865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81dfb12c15651b1858b4ac853324239

SHA1
15e32aedefd2b1d453043dbf287a1f500ce7acb2

SHA256
46263f20ec1e3b6f2370afcac1401f9e44e400434c8c8e55b7cd6033b6f9259a

SHA512
82dbf92cbc2ab8c6112c400eeac80de44a7b85f2aa5d2674d54cb13c2d55418693ea3984398dd00c1b93f9b86936d7390f52835de08b05e89700979712748865

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5082.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar516F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit