ca3db551acd55947858f8cd7f71d82f2c69d00f733d16d73dc63e1f0c9d62994

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23e24dce8620b0806d5d3dccbb83517b.html
Size

9KB
MD5

23e24dce8620b0806d5d3dccbb83517b
SHA1

9ebed9db6aaa5ed58d3436c01d04de8753537ce9
SHA256

ca3db551acd55947858f8cd7f71d82f2c69d00f733d16d73dc63e1f0c9d62994
SHA512

615a07ba863fb01e76da301e4ad6e328e7b03d0402810d5d02db7abe9d74a0b505484df942bafeb6a8303315871a8d0d4c40cfb437a282606f46f9ee0b721c28
SSDEEP

192:FY/H8+e+YC49ClK5qLGkK3EkfLLnKup6QLoM6G:FYy+GKLGkeEA3nKngozG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FA9E131-A8EE-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0205265fb3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410307181"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004717022c873ecb7fa801b9b67fc90cd5e5a698a35bd7e6542682b06b5475b50a000000000e8000000002000020000000e4f8843d6d6b23686f7b7867aa6237a98f8e4a1290d500304c4e68ae76a61dc72000000017ee0f5ac12826d9324bc568118e89d108adab94895f032c87952234071a4e89400000006629f02dcfa5148b8bf94dc32e5c29d28750dbfa84cbf7c20c96ca5c1a839e50efbb20d6b24e33a9c141c2637c21f7877a8038ad9a1fb795280a16371b8666c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000391088b0c4909f79ac9a38a24d7ba9791eaec877489a25424d28788e58cf5c27000000000e8000000002000020000000faffbfed50189af479058d5fb29380e55ed14ec3ca00a58792f51cfb883e8b7c90000000902dd3e9e689c6b23ec02a1ea5d0205154a881a2ac412da786bbdea9f3af0b0857c03244466c19c48de1541fba872002e80206a9eb1e825d94765be8dd9ee58dfdf822efb0ebb4aa926a14469e7772bf84993e32ed046820525227b2376d7443af2b2b64b87fb3e857d881a3fe7c4487a607424b34d436336ffd5f3873947a2262c73369f4653104f7c13e4a1fbb353240000000e59df44f3c27a3044bc91cdf89f45a2fbee4c5a7e9e5364df94855c056e349a3762b51054dd350cad170519c371f1c39ca137ef63178c6dadf7c633fab863f8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2716	2876	iexplore.exe	28
PID 2876 wrote to memory of 2716	2876	iexplore.exe	28
PID 2876 wrote to memory of 2716	2876	iexplore.exe	28
PID 2876 wrote to memory of 2716	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23e24dce8620b0806d5d3dccbb83517b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc89e80f8b7e8afcf7d78469c25a316c

SHA1
7d64d44459f6d7f2c50c404ca260301be86eeeee

SHA256
d8047abebd7f9d35e4cefb6113b51e84f37e5f65dc0371313cc9d122e669eef2

SHA512
c952f19ea0aaea7bc396cfac5d81c5520c70c0714148de4655ad0e07495c7ffdc2799ab43d25b0af7c17bb1234ef0c5cb23a99b8c701b2a62caa99b3be9485c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d019d9265366d077799f32140bbe2d8

SHA1
3826804899b462834e480dfbea35b640845c525d

SHA256
0e0803b5f24aa997f2d2a1a06c51b3d27bd94751dd96a12389f5adfd0132552f

SHA512
a750ae278c31fa566ed9ce2a6a3bf30b7dc747444c2b8cf9f76c032528fbaf6150c478b615c72544ec03f5d2004143e54b09167689b6578c309262bae2ebd2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46f6355ee43cb489700373542ebb3608

SHA1
0916154d1587aaa58a419fdf8c994c665077d85f

SHA256
2faa33019b6585eb1b20d3e01d4a5a6ae49a38cd1b11b632d30eb3b03303e690

SHA512
fc22af46eb7d570018ba25760d7b867ed6483009c84d560ab507b4dd4a152aca064ae6aee8af47a4521322e6863d91a613c35ac779061ca9b1d29debe83aea7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72b673918288a6192c0e1e21c56adea2

SHA1
c426b284170e24b156e3f337b40ff20cd51b5fca

SHA256
830b110bbf5021754db0a2c997eaf3f8b4fa28011a38073f33fac2423d1da6a2

SHA512
f1310729191d3a32f750dbab02874df492025cd8ef80847fee16fd419b13120174134544fe48428d6b4dcd7456c90c0132e3e896174e1a0d52f487ccadaea4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a0f7d23abcc615698afee1240950f2

SHA1
b9b794ea11babded4742269c615f22bc8ce9414d

SHA256
e414d2611be419ec4e6ac3741bc6cab03374114d88c8bf0784056ff7a54790db

SHA512
12724869c777611c59d91deaf22ce6aa462d7d2a44e4a04191fc1e6a4c4cb97a483f8c8a510ce58cb49e249a4940d2fd419304dfaab1da36766dca09502b2750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c2afa80fdc1a3791cf3052210de38a

SHA1
8ecd061580c07e487fc9db0b20acdedde19cfaaf

SHA256
f474be3673ff321b9d6d0c8258690dab8cb477b9485064dcae94af2b645b415c

SHA512
d8e80627d649f241fe9b06af8b883b9687795d812e76e4cc812c0b88e81fc296ded4800ba1af68883ab5c8ae3dc4b8cdfaecd7dcee4d2a2e897a8c1f1fc40f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9beb76d263a6be3949b76beb67d373a

SHA1
76c6557a339fc49b5d950c65c0af3b0dabb3e3d7

SHA256
fc2978cd142523b97a1ee9196b8150848b2b765bfc670e29fa205869ec09c5d7

SHA512
589bed836b00cf64b1eca01e12d07629e7b8c78e8575443afa0fd065437d41734122ccdbbf5d8f553c167c222d8040877c229a98bc44d371ac8a6cd000838e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29e49b021d6dc7cc558a9accb2a3cac

SHA1
6aa3d24abd2ec460d6d71eae1b53ea69ef438ffb

SHA256
48ecc08e8b5b0f33e9901bf7b30273d6a144b6047ea20de7532c370ffb93c937

SHA512
84db43b1d694ab062baf7167e4801d03fccccbb94762348c575f978f27cc0f24b076e430bc92d180db810465329f70aa7fdbc25886a122b45d397c2fec39fd42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a996718367e8c5d621ba4323e234c4a0

SHA1
cef0b6bc5b07cf20d5a4ac3cdf134feea31f3756

SHA256
cf0d2e174bfa01b4f63b10843f732a8fdeba399ddddad80bc4233d5c95c02d78

SHA512
15aae9f49704747a7ef6e42d408416ee325c9a2c03ad12571d59c7de44c01f455c15e10786951f61befc5d1f6b309976bb91a52160673970d9c4986e83fc0d2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1bf455119fa2204d8f0a267819dfc5

SHA1
9982b060118677b17ea6248e5b3c1fe2b31646ba

SHA256
14db1cb1fd69f6d13658958d5cf1f2a6704ed909108e4c16a6a38f5ace3d1e54

SHA512
74306429cb65dcb6ff9a5700b038bf2400b816179be029339ee2970e84e62421966d5f4f8069294e5db77ccfd3a901166b7e1862dba2b02a20b433dcd8ece3c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acfb0d93ea589ec2a157fa796ad339da

SHA1
4e28b8032be4c0e78e243f0a9854659cba656a57

SHA256
01149c18b1891cf3dfb867334f2229614a91192367fae0fb2b74248a59751f8e

SHA512
810021c44266d97d2368234312bcdcdf390c34da9291f5a2f926b2a052dd5091e532491b5de741eb1ef57f4f4b0bca47927cbe7e6eec9d524ee8c03f833b31b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9ca7850e022ce77dfb5ba1fe1e9ff83

SHA1
5e1d7c0a99a09a0ce744c05274df5acbea7440ad

SHA256
00422ad78304f13c523dd22e388c4682c85e2c806151cb57dec14d17fb807c05

SHA512
32e5ec10b521ff9ba474b4160d5e4180ce7b2c13310fc7647f5919afa5bd1677740c99612d9363946a86a013d1d2223fcd25320afcedbd5067036701eeb996df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3c8a07b175a2f1ea165dbf5189d040b

SHA1
b31cf82d4014af2c07149b9c50db68ee027da541

SHA256
5cab1e1afc37e059a3a48dd8964b1c99c5f483d4898c46ee394a3043c425af2a

SHA512
169c1a86518329982e271c0a5ece92f92b7fbffcfcf1bfe576ca6d166c8cb2298ca532a6bc6a65e98eff76cf4c36a9e8387ee60319b757127d394bdc8a0855ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87C8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C5E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit