f5caebb9c43643eb7dc5e1197faf0f8161525241de91ff6a671309a5c041a341

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2321e8b43410f411dbc14540bb8e04f3.html
Size

6KB
MD5

2321e8b43410f411dbc14540bb8e04f3
SHA1

669cb7ee88b397ee3a2f0bea1bcea6fc77acba41
SHA256

f5caebb9c43643eb7dc5e1197faf0f8161525241de91ff6a671309a5c041a341
SHA512

629456b2b56ddc73ae7379282565fddd3d585f90b08526f005630c5825a45466072989c6a2bd78189731f7fcd2863154d1dc2c640d9f645ab84bf5f19103706b
SSDEEP

96:cuvXr5k9ZBDZU4ci0w9iFcFbv3XXr5k9ZBDZU4ewWVTaTxXr5k9ZBDZU4cS/+xXF:culS0FcxtS8VTaTrSSSYxeCZZ5WS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410583531"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09a3ed57e3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC974411-AB71-11EE-ACD1-56A82BE80DF6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000074ee7ddf18840f2de6e520eb7c996aa459fdb66e986f60e06145857a8d83f068000000000e8000000002000020000000deb11c0a00515950ca761f97f6b632f0cc30161389327967f6c48a9fa2dcc31590000000ac28f51453e9b0bc4331c16c291db2531ffa53d5d206f7283e6edf0dad223a986f0edff4d2c95a4fc3cd082c9f273b4056ecbecc4805ddaa94135bd0578612d3b99b3ea347e93ca6a0f97fc6749db47b18ee1dd421d5ea6f5ed2ca998367c325ca568f1d50566f55d1fbb60223ff12a409a61a2982b0452c566aefa2abbc1f8e85e959f60dbc32458248a18d7e6cee8c40000000d9a6d96c540da6b4d0f39ecb5d77b8c5a3bd47eeb287b6d1378a2857eeb57374bb98e7c2b35094a15fd74dda9feb2056c2c17cd3fd39fdf3d96e3a3c71cf1c02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000021ae85a3b5cf4a627a22eb40c066e52fe18fd49ae60f0dd94a6ba5ecf373ee25000000000e8000000002000020000000b772acb09ca6a2a06b57160f58ffa573920013ff83ceff75d22fc77251ad34552000000072d64b4007399be0750f89be6f6cc14df42e8d3d2a1640f2a8ca843082946a7d4000000081204e3c8307c9aa93847ba26531a4b0424aa55a191e895d35f785a78e2f971bf5df3228ce91c9ceafc72e15a378f8522f5048e2a6e9ff57db74406ab19da5ec	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 804	3020	iexplore.exe	17
PID 3020 wrote to memory of 804	3020	iexplore.exe	17
PID 3020 wrote to memory of 804	3020	iexplore.exe	17
PID 3020 wrote to memory of 804	3020	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2321e8b43410f411dbc14540bb8e04f3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
3KB

MD5
05303236a72ea6ce904e8f15ed06739e

SHA1
11aa497f573b867c4076a3908884b84822f0035a

SHA256
96b1f3ae3b2f0b6dd66ddf63f43d45f3e1b3d2a28fee4f816c49ac7ec1764059

SHA512
c5f07e2d450f6d5dc448da32134771bc99f9e3b6c3f87e7fefa139d618c42d1cfe20c9cdf8e6af67c9c3694ce1b90f95f7b21eb3cb616a0dd9225f79ec4d31ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165e785acbdabdf5bb290d17933048a5

SHA1
a8dd4494ec20a8adb5d0c99bd85b65b3b3a6d20a

SHA256
dbe53dd30ad1a50c1e3a7ff8877e4fa88110e647860ea5e11e3df6b858e28fd8

SHA512
5d4f4fac3fcd4d0b6d560bc923f4101bb06ccd142f6fb79869f628c1ca6a983ac90466f56fb159e6ee76bb51695b5ffa6cb1df569fa94925bfd724b5d800de8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da3742e2996e1115d7efeb1c5100f3ff

SHA1
4d4ac91554211c50ed764e370772dd3e84bbbe3f

SHA256
f22f61118b64f38a034c0edb051b2e76e19d09f768ddd92c3e02599ff2bc8428

SHA512
a4e9bee11ef04f8f669fbc0e9b330fcca53019f60dfd0be116f354d9bd030a387635452cf02810adfd133fce3fcd93456546ca01bec9ea05e305527370289d32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4609d08295efbcef80ce684269ef044

SHA1
42d77eca88caedf77ce73d1c17d9f9e0d9be3245

SHA256
e87808890adc0224215e6878e63a94592b75db6c8bac097e542e8b790c328619

SHA512
b135d62e85fd388322b2c74767059dd517dc804ec891d6d2f2b651e573e8508e8cbb52d3e358d568de96f03083caa7b79142bcdd1f5aa61112dd4b5e487340e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
623aed8076d5479d52b7780252c37931

SHA1
ebf928df2e4e42ce8d72c4ca973342b016376eee

SHA256
3dae8158b9caece2c2d679b29c23bec0de1ae156d0ab083d5eea0c5cb4a97b49

SHA512
9cef45d9bfa3b0480f22759b5ab2d542e970dad96a76eb9350b96738bb924012da2e97a38526766fabed1b6850a688f51814349e12daf7b01713f970eed7ff96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61a2346a36cfa33b86950b418dda514c

SHA1
46daa6189fad2ea6aed8237ab026cf59d966a071

SHA256
d3981228ae14d394eed04546a5d09532a5839f4e249a2a086230bd9acc32e137

SHA512
f258d9ea536922f32b00aba0a9601a4233b1ab2d1e95d1ba8d95a4ebce231abc703e8bab14bc2cd0152c2fac71691b15e6376c23e6a83f09b8d3486951dca966

Download Submit