98e55532dd1aaca429ba7ea56e4580649f0088af02449955914ba0624b774307

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21a6f0a2ddb914091b2f47da4a68a716.html
Size

28KB
MD5

21a6f0a2ddb914091b2f47da4a68a716
SHA1

e635bdda2ab9bc18011e47140380b979135470b4
SHA256

98e55532dd1aaca429ba7ea56e4580649f0088af02449955914ba0624b774307
SHA512

d23709e9fd9909708fae2f276d585a09a553c2da46d2606f81b6f20bab36849ce3e4afda3faf74b4980e5ed681e1678c783ee04ac75d4adde1fbf0e96f993e2c
SSDEEP

192:uwUND2nEb5nvEhInQjxn5Q/jnQien6Nn/WlInQOkEntZj9nQTbnJnQ9eoym6MIm3:vQ/oIpaAw60Sjb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410573310"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E0C7231-AB5A-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2380	3004	iexplore.exe	28
PID 3004 wrote to memory of 2380	3004	iexplore.exe	28
PID 3004 wrote to memory of 2380	3004	iexplore.exe	28
PID 3004 wrote to memory of 2380	3004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21a6f0a2ddb914091b2f47da4a68a716.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d8644bc4364c319f8acc10fccdc5b01

SHA1
2f4a271f67dac766cf5010ecfec5ec84d4a9bc2a

SHA256
10e5a32a009f27740dd2987dd0537b8fdd8272c646a4ce9343fdd650ca0c96cb

SHA512
399a47771a6e59032202eab4bbb5628c97068598be2d2a79dc0ad86e8d0be41f02b2c7f0603a2f0faa70047f24b078593e03ed6adc14d08be2b9ed3af8fb5824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dd65b988df274610e08035df854ddfc

SHA1
6ab4bf21f0ef396e4cfc4b951b1c2b3ebf62d5ba

SHA256
7fd9f21fd9cbb56fa39dff3f89f51c81be60d563eb23ba2873b376668421adf2

SHA512
b1dc7cd50bb55e37d667bb1ce9772e855e5908e7b68b9b56246aacf678238088649f473c1c34494f0c3d781a8758f2abcf5786c7d9302b0bda36de9052372cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e6f72d6678751144d80d2ee06f424eb

SHA1
0a1181fc681678a517c053ebb2fb2b02e408b3ad

SHA256
79081f09962be432210c91635320b842ced732003d6bef014c84d2e594f2ae94

SHA512
0ba8f0deb0a8d3254b51d1bf6314c43a8a00fcd6f6a009ede6aceb631770a626c95b7e7b685f4fc0ac79f560790f451d858e92f5ee97b91e1a9c875afcd4d9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f70c94c492b8e2328964364a25813ef7

SHA1
dbd3bacca3744cdf900f509762770880feb20ee3

SHA256
9966f6c0a944f10b930ce459e4a41bed262685baa81cac131639d55d446995c7

SHA512
17a6a2175773ab0b5f5f185d1716cedfaca5fec0e97e438181a536d04429322f9fe1b347f5a4d04ec1aed3ee52304670a3c7cc64d4e0fb0ec9b80225d159f933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7139e87b85895cdf30b1ed259f598f

SHA1
eabe1cb4621586b9d4da4e94bd0052ea3a63d7b4

SHA256
2feec885e5fa46b2f82f65c855b1aeecc60207ec77caf007c60c2532ec38da5b

SHA512
6a2afe8de00108cced12b1bbe41e79d575ca3db6ab00fe7e71ef085e3adc7ac2715b959fd0c8ae077b1651ac73154791866c4a6ca06e13f77eecf397ee474a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efc05cfc1b5f12bf2541d49ef672bbe8

SHA1
e96d9cf8e6055660726c16f6adbd00cc0369e03b

SHA256
ea92df1cf9338b4b2d0d09063acf118499f63a9261e23e9722b52f7d23ed139f

SHA512
63addf172fab90262a356e1a0e86d8ab3987fbc0add6046748a472bc2283c45f69b968c173239519e7a21995d869b35919979ea5fab81b2b2d0e0f97ffe622ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45d2a18cd5c3a8b8e1cd14152db4f5dc

SHA1
6da144a4489b31de7bcd35052359c942a48468e7

SHA256
4ddfcc19783a3cb892b7ae06065c3744a6be9d795e54d70c0d18b3e4ebf4f572

SHA512
53d30cabd68dbc64b7b6fe82204603acdf2ccfb60cac8f45c58c8bccbf78f9468d37ca7313ec9079a9f3b7e34d063bccea409eb25c44e217c6b25189e60dc5b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c5e1c60b2056e24de8f785e7eeb9bf8

SHA1
c71979cbb44c9bebe73fcc5298e674278b67dbd2

SHA256
b08bbbe9d52bab537a1301a6821fae75750c246632320de878e9e20105588137

SHA512
81b6a3767fa4c1c21f9bb99743810f9d75d5a06e589830fbdc419f1710d123dd4851f3b5054af2336c5d9964874b238353eb2118eeeb759df011677318f9443b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFB2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFF3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit