da65ca095aba9c6405a648de81f1cd839455782e884492fcd15a76d924626c3c

Analysis

max time kernel
160s
max time network
178s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2110266d901966b70fe3bce918f536b4.html
Size

75KB
MD5

2110266d901966b70fe3bce918f536b4
SHA1

ad6e641befc56447738f2d4853c6c29912d31f14
SHA256

da65ca095aba9c6405a648de81f1cd839455782e884492fcd15a76d924626c3c
SHA512

41c62fb7b0d2b0aa9007d7d3916bfeecfdbf24ebb83c6d66bd18f0714c80bae1592832c71dce5d9fc6ea3e041ee18cb5fc8784394947a9d7c559bdbe3cc53140
SSDEEP

1536:E+RMEjGBvnpco++504sTnijQAwvkD1uW2kCxMRnCurYPeLtCtF:EpEjGBvnpco++5VCijQkudkCxMRnCurG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410569185"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97ECBD41-AB50-11EE-8723-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2992	2380	iexplore.exe	28
PID 2380 wrote to memory of 2992	2380	iexplore.exe	28
PID 2380 wrote to memory of 2992	2380	iexplore.exe	28
PID 2380 wrote to memory of 2992	2380	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2110266d901966b70fe3bce918f536b4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beebde7525f3ac4162afc807846b8049

SHA1
3bc00b7056a0a23a4cb8981172faa3af9ae306b6

SHA256
b0a894857526f9438f2efa84782176aaacdbd83def69b98e3f06c0e8ceb0c1d0

SHA512
29c8394c686f0bb28b0d60c1ac69b33bf9ea9098abbc3ea8634aac3178402d10801550e72aaffe8b7e71eda7cf2b79f3d14ca12475fde32ea5d3bcdfdd921873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9d5aa7801f887360854061e4acb87c0

SHA1
9e6939f4741e01f1a84fca5186633d5a1833b330

SHA256
9e55c20a66e6971260a97448afc07b60480b90883b358bb5f0c60189eee35408

SHA512
63f69073b6d17c28f69f7824a5927a3698fb3db109f2eec3a82ecf2145cc5750a9b2c5829df7f8e3ef39dbd76db776e532f10d5556ababca07f1802764659705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03e0bd7db1fdc2e1c52510d48974f77b

SHA1
ad9843bbe7673a48d70e06abebc5af9b72891817

SHA256
c0688e63b432e5b04523abc9695476dcaee928b0f5bc0a85a14e7373577f9e92

SHA512
0188e1ee10b9c888e531d66992746f27f004853db6e5507e982ae732a310344e23a308fe2bf9e78eb37f991524ad19441fe33704eb5ae058c675026dfcf09047

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14df1704cac3ba8f9003dc3e2a90c5da

SHA1
9773072b9a0e6d271470c627d571bd3e877b4db2

SHA256
0c8aa26bc507c4e32549f3b5d0f298ad43989db434cf724dcba2aea781135f70

SHA512
247fedac1553c7b0ddbc63259e898ac016682ea9fbb4897b13a9244a2f67e3144571377c2212c2797de498fd43dd5e4e281b5f29d787111e8e21b44e3b5a3923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85ec3c526cbbc1edbd64eeae52ee2a8d

SHA1
558bbdf01d9303a4260479211d77664a812ab8d3

SHA256
3bd98be55d3721d56557fadc65371fb22e859ae8e5b00dbaee21dcaf60009a19

SHA512
912dc495b1d2f13e09579d0849e16f2d9155f140e0c912fe0e5241d66751d160df6d4efc91fc3b4a94682ea3afab29b942737c843c44d7b2a767690ced796b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563c257c027480ed626d90b5fc11889c

SHA1
bba05aaa67d4e5061b2252a2278068e7fbb0edb7

SHA256
5dfc30fbd935c34b02db24c441a5edf4f9e54f4001b91d4547e8271c23bc5ba9

SHA512
d397ac00ba75fa6363209785066de74b63ca9108ae41ad41c097ef85f415b4e0dd92515221d58009ae57258140f9cafd672b73369e84af5d184a69587bd2055c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5edabeabd02064539c119c2678e9f699

SHA1
a3c4dad3404db40a9070076911d481753c0a5f5c

SHA256
fa295941c4d265381e304a56bbdaf490e262cd467a30f49034d24515724a0e74

SHA512
536e569433558974baa7e4c50bce711ec6039d96c3142e17ea9663f84d7bc1a0442cd0618dd8468858541b5a7c86b9db6757dc58d4841290d49960f28826f056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989ab3ee6943926a8c8790fcc17305fc

SHA1
3f5bbcba26ac91cad3318bdd09c780709419fa4d

SHA256
84dc41d24b0969d7bb6fc88f39b69afda799939be6b6dff614fd4deaf0ce2a22

SHA512
75331187d30c6a099156261147f000dc45f13bd05e1e90aa1a0dad280041dfc54fae6532bf4170aa1ff3230198b2766a2e4998da1d6f45ab35a40c5bc8bf9a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f653db2d68d70a8b8b9bde8af3dd85ec

SHA1
a34c0154f157338995d375b3b8b0d183203e065a

SHA256
b4c0ffcf2bb5788bd0fae1e4bf2528b1f848f71b145d309a3200740f25f2fdf1

SHA512
444c454ef1c5ad0bd7bf76a4663bc41d8b20df73b86577ce8a0cbd416924357dbc92dd752999fd1cc1081159cc7810f11a02aaeb11ea6b571df52cddf766e49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c9029245282678771782270db30f2c0

SHA1
9ff91fb6a4714f81482e055b5b916af73fb78991

SHA256
c8303d4f0d35a42c182628832d027ddaaac329dd6f7ab4586f915bbdcd0efd5c

SHA512
ae41365c5843419f3bc6288f7d678b9640a9430ffe2da33d50aba0a7a23c5ed99db91267033def6880873ebc883775f26f3db0fbb9fa240ccf76899cdb9b077d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbad1d0dabbaa6f65d6d886563f7d8dd

SHA1
cef966f1e945350cac3c9e1f311e7174bf6dc0a0

SHA256
2c845dec3d7b0e2186105e7b5546083fbc7ac0efed11916f83c472d4e8b4408b

SHA512
e28f8f97a592ed02c6b6971a1e44be493fa92d83061b50851cdc2fe3c1b7a96312b0b732f3bc5c91154e47576c8f9cfa48192a7b8c7de00a504dc389a09f28bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4D7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC518.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit