b13f5e821bae5d3f80a84238d226c87b6b29505be92af4e79261e58db0e6300d

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c153f89f5782ee967ee40d844e769e0.html
Size

94KB
MD5

1c153f89f5782ee967ee40d844e769e0
SHA1

dce2206a8e711e1ae499c700619cd23da4098927
SHA256

b13f5e821bae5d3f80a84238d226c87b6b29505be92af4e79261e58db0e6300d
SHA512

b0d9305e8b2ebb8e50f4d3e0a40d0ce745afd11b40d150c9c6c4aaf053097d0c8ed3f24541e7735c6bff2c7e8c1face61c6d440306d4330801d63afa9d8f8dc7
SSDEEP

1536:WIV1+B4yz6GWuRAaHaG1WNGaXAS7aU7pxDG9lE/LIMUmNL4cFrP6Y:31A1b1WNJXAS7VjDG9lE/sMUmBFrP6Y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001aa27efbe4da13c697540317f9fd57c3f6c6a1a1919a6e5d2b3c445f9c3a0e3b000000000e8000000002000020000000e8969ff0133d0a2018c50771f7384171486e36a94c4cab5d1ccb3f6129ff589690000000f79be5ac980ab902d7da874fe929fd9198c3fbb7a95cf19a4efb268d1612a7812e3179c8b3cd63de8e4c687fcef183ddfab1c528e141470de3cb30ffa094acb2d6b77e6745fb0bda9daff8693b7904c46ece90a375d33b74448efddae2522c1a73687bb8932c055e8e81dfab0ad617c29e5d388e381014424d8b6a4afbde0c4898a573cd0c2ba93c1241cfc5bbae526a40000000ac04107ec91e49903acc2d540dd457196123bd5dfb1acce95a9bd13e1a53dd07a0be83b3e7db46d217e14b04a54715a6f56c119cca9d0e88f4c0db496222ff09	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000adfb3417e11dcde8f24e9aefc1d99be108726807cc104ee53d3e49af008cf182000000000e80000000020000200000008731099674c60ba2d77b9fbabf9166ea0cf6c082b389251c4936bd2ad606606c200000003ceff34a1e0920dbbe66c9533b4cefda4209abde6d98e30f20766ede474d0e5440000000705ef3674aace0393d8634d136a3537e1779d0ee7bbd7b48800cbdc115fc6d42de1eddb54933a0dc579736b4b2a667090073dd369f357841da9c450d0d005667	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8B95BB1-A85E-11EE-92F6-EEC5CD00071E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410245479"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203c5cc36b3cda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2792	2192	iexplore.exe	16
PID 2192 wrote to memory of 2792	2192	iexplore.exe	16
PID 2192 wrote to memory of 2792	2192	iexplore.exe	16
PID 2192 wrote to memory of 2792	2192	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c153f89f5782ee967ee40d844e769e0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
00d05bdfae83dc1a7581977aa309749a

SHA1
ff38b1f051402e79fe43ce11739af1f10eb2af15

SHA256
ccaf3f38f64877ad3553e8f7b568ac5acc04a1133ea462733d7ff24cf27b0ce8

SHA512
b8aa97b51fb78d583511882ed90c9c1b8de17f5a5c338ec80b928d1728e923777e0b3855d6e71db0fcbe2fcdc88cfdff0ba36d55c946fa7b8e4e77fcde0639ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
cd5653067b398aff6a4112ed77b8d8a7

SHA1
fbb6373584b11eda522787e365a462bd8327414f

SHA256
3dfa7e7de42c358daed5476b3c218a61e5ca67a6ddc8de394788bf53cd82eaed

SHA512
02df968301ddc12e871a014859b7d1605fb3a6d1bf200863b9a0ce10f7616173e2b279c533f98eb4f1df3f6364f3732f8b92dd12287ca222aaf41ef4b957a486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bdbfc985d5b3eaf77f1118b68343287

SHA1
f1bdc28232ac52d472d050c0a3d4a4651477aef1

SHA256
7f16d51324b63ceaf4fac1a765a7595317c99c3a73c3788fe7eb4fad9c87174e

SHA512
f24ce965cce94af3167e37ecfb262f498288029c0f7b5ed38a60f4b0a5bf994c07d12f32dd5fb337ca3e9a7362560369097f9ccb9419521aa8475b516c877eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f6a83237c5c07d8bd5256f4e7296737

SHA1
aaf6378d4766f1cecf3a89e1b6f557c9805698b7

SHA256
89eda2debee60e600e1118bff019e1fde13e4644046e73ae41739c473b7ccd36

SHA512
e7fcd4c00ffc64ebbd617c03405c65dfff97182e985bb25eb84e4a8b57ee200e974640a1487410cb3867f6e60ff34a9b4274b7ee2ded6951a43d9de6e54db8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dac6ff958d58139d5990d25dd962b8eb

SHA1
7a8d123b8f1f17d68ed9a19eb7fe2f3d74e3c506

SHA256
df65da61b230d8d69feede7c9fe45c860100ddb61e14d1ad74a1af6c07a3ff0b

SHA512
bd14c6311e3a4401456a113462be6c718c34061c54df5e2ca48d85e1f63f955d7efd1cf1b3c476b8309f66739dac333e99c824590f2bc2d9954e260f0fbbdbf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e2e33e4da15754d122189d4806a2ec3

SHA1
d45b8df87eb43c6ffd441a7517f50ecfed0b5b67

SHA256
f4bd8e39c40530b0f1f8456f497392dff294d4abc499ad6eb8830621084eddf2

SHA512
3eb007ccde34c1ab477be9abe4c7498347aee66ce7f4b7a79f7b256a54f4d0fccd163ac176bda521017284bb648a1b6d15da4ea4c9cee4d1daac2579f652d521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
0f1ae689fca95dcdb2072ac9f2efcb25

SHA1
edd24ca274c8d7cdd405be1f0f1303014c046e9f

SHA256
0520afb6219034058764a1e9dbba1a1d16e6b3c9ad2a562c1f02cf4b3250aa10

SHA512
64db16abfd79ffe230f137d014fada37d5b67aee927c2327f9d31cce9cf1d3b44b386dfb7b81f00f42abdbe674a893954f3038ab7445da366343a053c57841bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit