d8427d2e2c6ec2c412c4cf912277cbfde76b7ad200fd2d6d520448149e5521d8

Analysis

max time kernel
117s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ced002a6b05d411a3792282df2ce108.html
Size

7KB
MD5

1ced002a6b05d411a3792282df2ce108
SHA1

c93736b98d2e0f30c8659974c8e12d3893c22d92
SHA256

d8427d2e2c6ec2c412c4cf912277cbfde76b7ad200fd2d6d520448149e5521d8
SHA512

ad9307bdcfb2cbd86c05d5194e0a839817abaf8a29503aa26242960c23512789ed54b9b3b91641ef2a720fdaffbfd8d39d18689fcd9a91fc5f3037ab343e777a
SSDEEP

96:SFrLVuWyNy0XtG8hOtCDiBqWQ+xMfy5GQ+xMfy51Q+xMfy5mQ+xMfy5+Lrn:SFrL0PWCrd++y5N++y5u++y5t++y5Gn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410251213"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000090e978e591d8399cb46b5bfbb87a873bb8b2eb73dec22bbb471c9bb2fd44e774000000000e8000000002000020000000d3888dcadeba7b9713cff14b556e7858705623b53ae77fba46c9e8d2e519c18020000000bc1df2d947f1358e48f3fd8c2df50dc551918a7fe93f1eb275b497e2e7f1f87140000000e435147eb6bda9f6affd09b9ff42b781911bac9fad0ba709ddd6ce224b6f8ce86053d9557f928a8cab4222069258c107a0093bcb5c8e2f26d302f447d0fe684c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000071f0ba8d3ac6df99f68f77c237af1ce57cc94f9f9e14fe9cdfe22844209c7a2f000000000e80000000020000200000005ab4e8972bb84243fcced9fb3a92a770e4286fd14d4589dc71b5a7f8648bf01d90000000f2cc34e6916b07c2d0b08d46b1cb1d6173181684efe42074e196f51b25369c0d50974c06c88cd1c695137fc3b8def9f9df2d26f29f770904e5271e4a981f9bd381e6a2f4afd3c642fe2dbe72648cfb039491d157a8247a781a7afea856811981ffa695cb7d4f05f0f4a1fa7b7b4c9b47d86f68ae3df1a4f2688dcfaa7dd8739df1901efec24fa031c4ac6baa139829bd40000000443b73bcb359b473196bc4d67d4ed409210734c82dc9fce7e99795751fd5b26dcba04f5e50e3cf2c8f57d196d3f573eff18a3084dd5f2aa5f2935c8817fc9fb4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{390281C1-A86C-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30100100793cda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ced002a6b05d411a3792282df2ce108.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
911de77f2059ab4865b06fbe8704d47f

SHA1
ce1b09169254e786625cc1c22ab5315f385fe4a1

SHA256
267bd605a0b203b4f87f09e479927d1e8c65add396a4c4e1df0dc2259c9231b4

SHA512
ebc2c85427a1b20fefcccccde08e4837d8652e5cbd1e56f0b85282453f42be758f4349d78992499378f93a8fc0c90748bd418f44f3dd91d052566f7bbb2ca5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee1fa51d83ac28f0ab15057f16774f09

SHA1
7c20022a5ed73cda9941920d9cf01dd14d50d6a6

SHA256
170d0599970a527d666cfa38745ef469d185529d933c4e67fa8309e57ae54bca

SHA512
9a6db1166e10366fa614ff75331561cd1cd34bbbdc28d3c2ee53bcdff981165c8d94512b7e8ed8a7d7293494106e2585d3060561a31e88da2146b1f8b53b244b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d9db9cc4b78b0fe5e45d794927dd73e

SHA1
50aef3d8e37fbe83a7818e28f18be396b6fc1f74

SHA256
fe72603add556dfca8b943d3c66555f9c567855744f0cfed8a1f2bc7849fe3ca

SHA512
3266d90ee83f7172bef9d3457324f41e4424b40383a83a7198ee8d659c26147e0994985fe2da5b8f6f49c3f0dac3aa0028eb87cd0f69ed8b7b3e4fd10dad9353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfafbecedf80ff01a0e6d6c3df6a425d

SHA1
ad882c86422dc94624f8b5f4371404eab770bda9

SHA256
2f739704c8ae54fce4de505e00596a0bf3d205ae5f751e7f6e605ba04e98dff9

SHA512
7f9b84410603230891d839aa58584d0cb0ae9e3244540e11ed3a4647db3670b2d8b20e5c3f4274e0d1b4763818415c4c3eeddd94c9e6ffc5afa13496913ff5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
067c8380d581c480404846498c3f12a2

SHA1
eb08f660b218d49169060e702c119b8d176651ae

SHA256
2dde32665f1eedd93adc124268fde4cf086a6ed0f75bfdf0593d25b1a055eefb

SHA512
d0574dd30a6e7c38a24a8fda51c5d603664c83adfa44dde949b4da01b1b595db3ba777a191b7edff4ec75882cbe1d286a0f5d8a8dba568c376f2e90fdf0d8e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b4e96420883fe43d4c757085a099d8

SHA1
0dd6dd681b4f89796d58c28b76e70762ecca6faf

SHA256
21505282bd10079926abba8cf256a98f762a096d78efde447856468e54fbcebb

SHA512
e372caab6688ff08fc2becf4010d8563290a31cb4399a6aa6cb1508521beccdb120842619922edda6462b808dfa29138c87edbcfc9f96c369c7d942c44929552

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B87.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BB9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit