278ef475124243ed7cafe5ed9fc0875185d8281b3504d5ebd98d3687f4264902

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

22903604d63a39f220d84d97d5614684.html
Size

37KB
MD5

22903604d63a39f220d84d97d5614684
SHA1

dd548a9534f0a10c87aedb44f909343215dbbf79
SHA256

278ef475124243ed7cafe5ed9fc0875185d8281b3504d5ebd98d3687f4264902
SHA512

e8f9e9f20de7b10bc20034aa999ced044b2a04ede71b1e95399dc99ec0f2de476d604c2cdd2a5f7065bb75fcd4214f2d3f018ef72fc5a32f6e56257af15daa0d
SSDEEP

768:zufCA8R0wSuFquX3uHvnufjkURa2s/vy2MXcVkW/oeI7fIQxgInorg:zufCA20vCjkURa2s/vy2MXcVV/oeI7fN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C14CB3D1-AB68-11EE-B645-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410579571"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09c4898753fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006523dfd6c6e9827fbbed143b91b2f6bc32d9c734dc716b19a7e43ef66045065a000000000e8000000002000020000000beb7adcb841896e126a93b1e37db7b24de800dfdb7b2716b51f3adf7ea353e5d20000000822695d7c816fd4d50a20ef4517da8a48636a4d56be3f33221097f98a0c8a82a400000002ffbcbb643816897c41af68305d9695fd5160f0e8badd7ac69e06ec681fc84a87aae61199aadc121e71b014433c2ab9a8d02230110d68b4eabc08449d0e57120	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000025c44ed62a9761c1cfb55c6a2cf120220f11bb26d4d0f551ff7b9f626f36224d000000000e80000000020000200000000bfb801703af170eb07d17e286477b9dd688d4e16cd3b270b5b9de6bd49020ff90000000926b1c040ac2c76c6aaed576f1986a458d07b86eecb906c56fec9c708d829ea825558a23c9349bbf33101ad6f2f6addfde4ec40a62df09b6d31466bac6193bc22199750bf6a604ded9dd3e8c743bdb9734b6c6f50bef2b2177fd7d3b5bccf7be5e7533e8469f893715f8a2d74cffb6a470f9d54ba97271ff0b76e497a931b646f4b2f8adcf657d9a9a0020f19642dce240000000d26ed34f1e763363a440e758cbd39379a0633070f2fb91d98477b878fb863ea6222b90e7918989685c4188883cb250f46a7c89c0a84c80d8aac8799eb628ef6d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2220	3036	iexplore.exe	28
PID 3036 wrote to memory of 2220	3036	iexplore.exe	28
PID 3036 wrote to memory of 2220	3036	iexplore.exe	28
PID 3036 wrote to memory of 2220	3036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22903604d63a39f220d84d97d5614684.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f939721e0e6ad7cb16381d23b9cdf47b

SHA1
afd6a8bd41e3e744b8e91c6bdb74f9da0ffc6720

SHA256
8a6be395c9a74165639bb87b1e912b7a2067a3b87e7f0d13ef67638ed79e5180

SHA512
ee07c91f8e1907dec1419148487cbb93e2ae1c4634576ac6810f6273fcd512a6b2b1ced6d814055a116a9b06e9ce8a476e6a8b66fcca9820d8dc35f25dee0da8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a79a4d23bb0b6eafa846b41033aef2

SHA1
e0803ee06c92c48e31ddf0b8aa53b7c173e87a2a

SHA256
ba4afa5dbe3e36dc61b7e1f5c3e0ea3d68719fb9c2c4aad0231f42c639a13254

SHA512
fa704ca54d14725e719ceee4d3fc7636e447df07a920c0db9a31ec7384f8f5dc1bac8868a1257b0ff185711059bfc5b10decd78a09fa91b4809e0da4dbea9cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ff9d8f4a8e47e3999ba6d6f5486c77

SHA1
4cf247c856112efc786486bc6096b8b30fb2e0dc

SHA256
b8ee4bb4bd382d858801da03a828ebc7ce14323e1cddc23aa005a05a50d58aa4

SHA512
fcf10012f9c39c08222f771be831e89fb54a8c423e16efd3a92a7fe3d42aebbddcb7264952e9f1edec4c66f6ee70bbc13050c75723db1e1ae680d4fcd00b8d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a4dc5bcd1c67ac4b3cbc0dc3c7be64b

SHA1
2a83bfd232076d92b242e33de5d31456ec4eb4f5

SHA256
c0d6264782869d31f07e50a0676bf717bfc346fc47c5bd412a919ac24982ee4d

SHA512
48917f809b1f1f12e26560f1962a8eaf43a52a6cfc13267a84a08bfe7fef22ea9f791b185960f6e2fd8b5a90053dc186cb8d5a64789337c9896785cade305c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
684547bb9ef277cab416b2d76bfb1168

SHA1
5a1804acf458947d8bd3baed0c83daa5b51bc84f

SHA256
b1ccc51eb021cb0bfb964061bcaa0f0fc98d53eaceecf3b8c2a0598e79ff9c91

SHA512
df896ffca127201fb5edd7d4503810ace193506b1d974f9da3b152fe5ff2dab972f052ee86e9576923b042a5057e445a5895a9244e23900511cf3a89c142f369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5bc6fd92b9865636adb1f1c0e7c61df

SHA1
7bfdd17ca6dc366194477088f3fb0739792506cc

SHA256
62318fd4ab796ae4c998abc4c949cc5c0e1f460172ef2b52bf2b9a7cdec8949a

SHA512
a460dcca045f284ea33a54f44fce0d514cf628dc2ff0720e9d49a60f72992de2dfda6e01a92352509349405b3fc362f62a36895d6faa75759057fe0ca1973177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bae6867541ccb321055e98033341ec2

SHA1
9df5b195cf7bd3688f73b3bc3bd657b9f5af0768

SHA256
6d246209f18ed32d77c0019af3609c2c2ecf23edeba390918eed2c99e5685d45

SHA512
fe9556c3e0333d64bc664b6ee38bea7b6dfe80745f50cbee3852581b5e5f8167107b64a9b6bc9b3866d5983d4666f75fbbd69977ed6576fb17bdd853305bc4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3852.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38E2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit