ad5c81df7f52fdb527b94a5414446afe6e406fadad3e8f8df01bb8c4a8cefdf0

Analysis

max time kernel
148s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

266a7ca94554cc3ae6424fb150451c2c.html
Size

28KB
MD5

266a7ca94554cc3ae6424fb150451c2c
SHA1

523198212ea7b2b38162dd7b3a8c05c839a566f4
SHA256

ad5c81df7f52fdb527b94a5414446afe6e406fadad3e8f8df01bb8c4a8cefdf0
SHA512

4e25de90901f7fdb5a6157d19d865a841b8692464913869b58c6f4092245e11af6eb7cb5e52451edcf4f797d72127e1fee4372864f003a27adbfd591306348aa
SSDEEP

192:uWf9Tb5neBynQjxn5Q/onQieLNn/nQOkEntwWnQTbnxnQDXCZAiaEwWcwqHAYZQl:qQ/5aE34L

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8276C5E1-A917-11EE-A497-46361BFF2467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410324768"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3068	2936	iexplore.exe	15
PID 2936 wrote to memory of 3068	2936	iexplore.exe	15
PID 2936 wrote to memory of 3068	2936	iexplore.exe	15
PID 2936 wrote to memory of 3068	2936	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\266a7ca94554cc3ae6424fb150451c2c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c89469bee658ce13d1fcdfe283fa70dc

SHA1
a6121547d7e4defa729cb2692fcaf3715be9cdbf

SHA256
252960b937d82789c9f1102ba92315af1d7c013fd08e3d83631dcb551bd8b5a3

SHA512
1830c05d9c6446bb967f2e42ba920e4dab6c46226eb82c3592f101969bb90e71a1165601a2ac88802e94c9c0aca5487a338fe7cc08eae1c14debf6408ef753b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb8636cee65adf3950caf1f2a182748

SHA1
1dd8cea88d1fc472ed8e8c7c7ed22ad427da582d

SHA256
49aa89a54b9619bb7661aa73d5d73336d45028318f00fce24aa6858e3698b47a

SHA512
b8390d7f1837c988e765c77b7d666cea718afda7ce2a2495d1cf6b4262d1f1d27ed72427f7d191b5f3338b6d234e8525578e9c543ce32c1a55018a2bc7eb9a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f7a88c4426ab9ca396b77e0e9ef0ec

SHA1
9cf216f745ab5f960929e89474f88c1e1267fa96

SHA256
091b4579e20a929b6a063b6c38f6da654e81d97a3182205c532d5097dd13efac

SHA512
7f1d5c1aa8f40844f6863ef1e63c80bcaf29d8ff82aa77bebb8d589836403b22ccdd66ed1797430f261de56bbaa96ade0d0093ca74ae239fdf7f1e7f246f30d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b4898dc128b911df651a45985eb39f4

SHA1
b3ab327fad8dfff513b660bd27f09be5049b1463

SHA256
a593e2341cdfb66ddf937dfb9cb50a33304876022b319dfa9aec8864d15867bb

SHA512
f6fc48ed9680b22f02f6b80e8c7d82dacd4403e34e8fd5b773dd96a382c559847d1c33983c5fdc89b50aabf643b2121d447d8f9c050fa26a1482e64c40635f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c2192bf2328e9da191df8b92007ee50

SHA1
6ce945db263c5f1c25b3934a112960b6a6a2832a

SHA256
b04597632fd455ec8f71e8b45fd6a9bd14302bfe3b7ebfe58766c2c105637ad6

SHA512
41ab507cb0ad2d477c48f663567759e15cf37c6470c20bbe4ed79618cc05ad0eec7b04d9c9c8609f233f80a476fb663d6a1df19a2aef3f31da46b6f6e49606bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25d1bf85cb716774f9d86400795b768e

SHA1
1e8e2c47dcf7bcda9382e2a3ccbc0f2d4d6d0f40

SHA256
8b1ff688895f7e039ac18019596e27d7f65a53b79c1987833d75385eeb0ae6bb

SHA512
f501bf8409bd33eccc3bb124b37957cba9b316891454a9436b105eedfd468ff2e473e2fb2e6196cbe278aac4c3e0fcf6a0b42a4f4cd422036db2f5228e6ee164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f211057d240bceeb8b8499973b4443b

SHA1
e4e81dcb24e9bf3525b8c0785d2b530b578e5a3e

SHA256
1f206771f85705e0870fdc50c9ee35e3dafff1abcd636d8095445ffb01875ed3

SHA512
9dd0845a7ad58acab4c877b075ee4632f8ff6405c09d22306d2cc445f51b8ba661507ca3021330eab093e9e4b942b2bde5526262be521d0a45788d79698ceb33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8fb734068ae593fdf30e88b7e37ddb3

SHA1
380a37b8a576aae3bd7b75f02d91185c98f8b504

SHA256
7670b247db2ed805271aa6dee7d2883784377ba51697c4d751031894dbf57c15

SHA512
e2fcec3f895c1657e0baab5092295f4842e8468db6cc691671f38bca3222b497135ff2d9542454308e5345e1dafbf1b34f0851e8e03700f5e71d6ac61dfe63fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a64b8962e1e6a52c1561951baa1087ea

SHA1
cf5b0c0b9eb5c869ea437d643b8225e05b4a120c

SHA256
4b774f77c4e62820eddc1e88d13759a10ea41e0145afdfc143cf8480b330196e

SHA512
2215b45744f5c8fd9fe9ea9a2ab0e3c8a3df23028509d47ec52f9ac25b33d45db34062c0f1cfbfe77f4883a1e65c8b99141d9828687e8a491db71d9f11a26aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0d877fd3178a3c62e3309aef667f1e62

SHA1
77578340444d4cd50e7e514ce9889d9caccdb187

SHA256
cdd53746ab755cb79a94dd6114e676c93e86ea2445b384e1f63c6510aa16a3ae

SHA512
cb8c34d5dca9325697b1b12f925723aee6205cf030f77a2fa8bd17a73d43193fdfe2fe884c8daeb8cc96604984e9c4e223596baae99d7e2d655638a1962d6b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18C0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar198E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit