d89fe80d62ecccd53eb3537ec61e8cd6154299cfb66ea203ebd6ca13f6703b0e

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cce6784b7ea75fe809dae4699cc3074.html
Size

35KB
MD5

1cce6784b7ea75fe809dae4699cc3074
SHA1

aabb8a8127d95b4917e459203e69e4fa7f504ed0
SHA256

d89fe80d62ecccd53eb3537ec61e8cd6154299cfb66ea203ebd6ca13f6703b0e
SHA512

d79b3e1314f5e23b496b84266126b7435faf879159dfa9cfc974c81fee51bd2d05c4cdb41e0d2e7fbc1e4b513f2dd3110c2d60d1b6c30828b73ef6be5649715e
SSDEEP

768:zwx/MDTHOQ88hAR7tZPXxeE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TOZOF6DJtxo62:Q/zNVbJxNV/uuSe/28rK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD172D51-AAEA-11EE-B58D-6A1079A24C90} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000435a04f9137208e242eb3af8e794a9106286363b40b42017d87604dbfadb51f6000000000e8000000002000020000000e838c68bfc8d7b43969b026183028fc494503fbd1dd5beddd7f7c156999577d3200000003a07a111dba1395213e9f5b0c53cab9d3165bf91d73c11e840624e7c1b2c8928400000002584065e4e5a2d284de039e7ce299a6803c8d774063b01b21dd51cce21ead535ee0b5371f58424e252454e1075b7cd6312f041f0c0439ac1ff0e57ae8a0905b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000bea6c0f0d31d616c1f68719a196a1666a304c83e8c0cd7d3e2cd5c41ddd8fe4b000000000e8000000002000020000000cd744628d63c6ec32ae5baf6c9615733fa1b26a5c0695b5605f1e09588d4f65f9000000090ee0a47ab1f6795f64a2f0ff8583325f21e5cf6a9126414c7a785bbb3fca76677a60f89f269409e1ae094ac0bf641b6ee334fd742c090409c9fb46d01fd31b0c3619c54f982f69b265a2bee4904977e33a065a36af461e76d7a8c0ee3eb1e88f8e2abe59d2b18dce9362c77c7ea878f151922753d147ed416667cc6685e9bfd4001e1ef4b22ba84ffcf6fef137526ec400000003688dc60c9999f599f01a2b7dbfbb9b2a9ae3c5661f548ae99ace06d774b02459a7697671a50be662c0bb7c76e9f0374071fc3d8b2fe867bce1092e0499f1661	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410525435"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6095b894f73eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2388	2184	iexplore.exe	16
PID 2184 wrote to memory of 2388	2184	iexplore.exe	16
PID 2184 wrote to memory of 2388	2184	iexplore.exe	16
PID 2184 wrote to memory of 2388	2184	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1cce6784b7ea75fe809dae4699cc3074.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73bd5eabaa5ad216cbd77f3d9ab494c6

SHA1
792b2e0b037dfd3b046413789a4acd6e4657d42e

SHA256
f6f8993c3b1e4fe2d8334c5f7acdc7e76156c70170e11c0fa322613f93e42f63

SHA512
3d3b975a261287eaf517405eb66b00ade93e83dfea4ec6623f9431ee40d890c7d236fed479ee2bbffcf39829767f441f6a19348516fc3c3a98fd686a8d8186ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57bf5542742e3893e65014f199e0e019

SHA1
a48a3fc9b03475e117074723da2cae180b2bf846

SHA256
5a432f815d930f8a95c61176555808681e29e37b151ece2c2cea5dfcdb8bb763

SHA512
ecf15b41a649287b8c6c9e0c0f4d8dd3123f17a7f4a55836e886d709b534e9b6b2d9eabf0744a2d3948b1433ad95f7d2d4fa9c75492c725381403633f8b3bbed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fed463acceddd25e956b350debd9a1d

SHA1
d92f4c31b0f0f856e6f6ecce3a0f6996c4821b5e

SHA256
b43d648822472b4a5682f6223f4cd18dea8408c1595052bfaca1e48b2792ef32

SHA512
fdcbcfe24180c217a4105aad80af77ceda59dae88e11c6e1c293eb0c77d9157fe8f3897575400027663929056d09000f4f83a8d31abc06162d6453fa956663dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a19724d91df7da6f90d230c3fc76a477

SHA1
b839762f3a9c94ca7538625d4617fce695184e1c

SHA256
09fa995eb475e309aaae4cf8d123f784e2c5996cb9d5ffa452c5e192574e94e6

SHA512
cf83ca21bc7d27352c6751657ae0b35a88656dc0277670797cab7b58fddb5738b4a03842e9291ec611d264f80dbd58b30e88dde2b9cdf6aa7f3d0ec8d97a8097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d484702ca6a3d5b42350cd0566a015cb

SHA1
987a9fb308d5d67ca24e22ccb4426a20277c160d

SHA256
25b5eb00dcdbb9aaa4002ce1016acc7dbe1caf728ec9d762fdce554c34fc9fae

SHA512
8e01040cdb9a581ca3fb08174faa267059f69753965de2b5cee16bebe6b20f3c5e1de502fb01777819057206b0cb537bde5936ee97946e11d3850d3d6f801c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f214fc1ecaa7ce1dd3610d0371e179ee

SHA1
d553c53025ef3f755e39cb095f4d299313cfdec0

SHA256
21f4efd9aab53fdc6df679f35198af03ac39bc5994e0f68b2118403eb948c093

SHA512
7df2b7f15cdd6dc2cf55647501e18b4c16b24122130200612868f64d1681a62ebdcac93fcb30ad92151593a44b29bce484860e9eab02351726ba283127fd2cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C58.tmp

Filesize
61KB

MD5
48ec55ef446b8df810ac093e7523993c

SHA1
c578ba9486b177590d8dfb5122727fda52a8135e

SHA256
4c9ec4506978adbcec7f7c085201ef78a35b362c28a8643a1c4bf583d5eef833

SHA512
922dfdc38ea0433e84288d622ac0df27459f028f7f0b517d8921acdee2cf578acc73c52e5c9682dfcf0ec0f391b87d46cbe5f737d245188fe2e69057153a7a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C5A.tmp

Filesize
38KB

MD5
0772063196008dcc4c9a6222eb1caae0

SHA1
15a4f5d2e5867a4843ddfaee418fb65d590436de

SHA256
a57d4befb4a25f26712e8fe48e52e997d5dd3f5d3b9831b5e90ddf59bf68abe5

SHA512
b455ae5a1c17672fdc172b9dcb586841c17df2f6fec83455528670051b3725f83ef6c4d6a3e08180ce0a42b4b4d4c74deed2b9fccdaebffd56d13e57cbeb3abc

Download Submit