947254023fdc7610bd5db9dbaa11c12093d503b01dd01fde561aebaaeba05bec

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

225e4450676bff20d6402f3c8d6d7f64.html
Size

2KB
MD5

225e4450676bff20d6402f3c8d6d7f64
SHA1

3ee3c426eda1435cef9c277f2c1e404adb5830a1
SHA256

947254023fdc7610bd5db9dbaa11c12093d503b01dd01fde561aebaaeba05bec
SHA512

1e73d5fc8019c0186bea2813518047914c65a22b7ed3e2cf83b1ff741c78745f156263218f1ea8494cc5f955255982891f54f0f56499781d8b39beb1231e7d9d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003af22db5bd162c7c0688519064253c7e12016bf029f106992ba6edcc7e10028e000000000e800000000200002000000067757ff359c91b57e81eaf7ef96e1e0270214aad9009dae34c8308ea57c7b92c90000000ef3c33f0ae9739b66d1bf6eecc70f431f01c6387c071c0c108255aebf5b4a003a3cb2da158a2e548fa81c2772e4ead2f343656e3a1eb7320234a440ff8eb65cfaffa17ab62f46b7133da655ac11d3a8dc042068ddd4245d0fd781a88bc25a82f063f8497db68a9e3c653c33e6ec0c26de64cfeb2b61f1c37d279a56fb898117a2baddd2ddeaba75c886536bd13284abf400000003093e5360ffd5419d374193965be710cf99af5937b01856c987222ac4f3546ea4969a1d828b004ead6964ecaa50d84abf7d293e54874dd9575a5b8729e8b362b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410578261"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADC69F91-AB65-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07b3e84723fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f07e7a84728ecf994621146b508c7ef857a5e1e8ab8826098a295623a6416ed6000000000e800000000200002000000032f01e58e8b4bcc1b7673bfa66eba3c859c282406389009f2e0f5d9bcf02e82e2000000076055673b40fca0c5f35d1f47f01820de140179a53fb9865ac291a176a2935fc400000005c10a4d2eabe4b3688739b55f4aecdca1289e51ba3c48bb1711fbe25c77730ed19e416c268b0bf512620168d138cd77b7347795a0bc3a9902901862b86c0e236	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2160	2152	iexplore.exe	28
PID 2152 wrote to memory of 2160	2152	iexplore.exe	28
PID 2152 wrote to memory of 2160	2152	iexplore.exe	28
PID 2152 wrote to memory of 2160	2152	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\225e4450676bff20d6402f3c8d6d7f64.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
011d6d71b6bbdab4af96ba1daa9afffb

SHA1
793cffae5e1454b39570bbf11bf67df2a61a266f

SHA256
0082c43472f38832802b991d9220c825c45a5db988c8072b3860aaac9a41f215

SHA512
93eea89b567237e1d38db52283a73a2c0689450bc3b47142e10577c29b567ae82e05270db2b2886f11dfaacf6e94bb8c6db1cce5315d7f0040f2abb976b767ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cddbc2e931c20862e789eab9f493037

SHA1
dc598f12a65ddbd31c12cc38ce01e71ffdde63b7

SHA256
36ceaaced3f67f3a4101d7d1f6732ba0569711e7f924f6fdd56862233887c5bc

SHA512
0c361c67135ddb4749aa227007e3fc58f84fb2bb845a4fa5b653e7f8a6566907ef484c5bacad98d34f86ad9c42a648e958bea3444c8c74fd3f0729ca633161da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdc2b2f2d31271d3e0affe8b3813fbb5

SHA1
cbca75f2fcd904ef1b9efcca3ea89d36710b697e

SHA256
f74fd7cd3f7bbeb944d9d45f8114cdf7ba1cd4696f65eca10a276f1165ee7aa5

SHA512
3fceb02aaf863920a21e2f786212a0d7b56ea04c2cc478905e314e94ed6ec9c0b52b984ccf34028d47c0b76bcd4dda08b6009b1c5544bbc0bf719ce46c64f673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3db2c5f5a1a20aa1427f9c1d02a0c63e

SHA1
544d785e430accb6ce9c56519094c75af36f622e

SHA256
d5dc02b17180ea319c002f6186482002cf0785b5b91d56ce74813025bb6963fe

SHA512
b9f82800be4209591819565589bd6e27f8428a4950a6de4459625870adedb5f0c6ec53e1fae0470a8faf6bdf14f8a79a8afc5b70cbdce517569c0c20a0484f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b40383c285cc9bc43a22afba21ec150

SHA1
13110b43c5ad84b1a621e5a3fbe46349dbbd5520

SHA256
5393632a8cc9baf2a9a7d88e167d826d94e82dea8d8b547187d628d8f6f4fbe5

SHA512
0bd1dbd11fb5f491387da7b8d76a55bc41cec2e11c3a70afaaffa718f911af12de9546c8f271b0f2c2f7d646c5a4bc54a3550a95c03469b4a0b62c7bac3536de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73bee8bbb5c7e0aaf7be731d75cf3108

SHA1
3b0a9a478a72597b64c1a7a144d3cd739d913d4b

SHA256
04c1b863aca1397275d99632330058088a357d9f4a7ed44a3b532ea6d16fba54

SHA512
7ced01fb78fb158a61ac2c1b50cb51fc6a913985252459cc17d86c02d53dcd30a62f3d51fefa7295d47256dc19ac8c00513f2859034ece259ea1f05ecd1e3ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
017500c226fac5897507c34ee9dff289

SHA1
a58f164d8429ae3d758f3923ec3ecbb09ef320c5

SHA256
68cdf96fcce5ddd873fe318289c359d11e711d697273ed31a7df342c720c397d

SHA512
701f6c38f928f751c9243edecb8cb6e8abfabde9613bd59bf0507505951a8f44e953c42bffe1145b7dfca923edf8a039088369804966160204bebe9131398178

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5412aa1dde14fc710ac298e473a6be8

SHA1
e08caf9d7c62d013143390028def04c19dd0393d

SHA256
7c898fdbf9cc74ef23603a54ea286507d38f01ce6a7fe6ffa61aed1130311977

SHA512
bec4259730a7e11079fff39209219ff2f39af01ed2c6b7ee15998d4d2ade336b125d04935e8716d04a20fb17c6176750ab2a0c9ad1b3711a4dd16dfb5e761e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE527.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit