85af16e5c35404147406fa236fe87b9f3991a529096ffd1ae917662d1a5477db

Analysis

max time kernel
120s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2679b0d07c3a3cb408be006ca8723142.html
Size

63KB
MD5

2679b0d07c3a3cb408be006ca8723142
SHA1

31ab86e1f4c2d4059554b0cbc0c577cc94d16ddc
SHA256

85af16e5c35404147406fa236fe87b9f3991a529096ffd1ae917662d1a5477db
SHA512

513ca884bd1a11602a9eb0ee62e6ae7d1141a68b4da680d335d35c38f48841447955d2dcad48fb6eefb6b9a3a34afb28d3344620593b9167b699d998a765020c
SSDEEP

1536:WN5XDPtERi/KrH+HHXpAeRmrAWJVcCywxYXekebj9P2xnzeDK9NFWnb/HCI9iNL8:zYCrHeH+NrAWJuCyReK9NFkrCIARSdL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F05F3D1-ABAF-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007c1fe695af59218dbe88b365cc4d09c8a19f9207620d860e993054bc09f53e15000000000e80000000020000200000000bc5d27d3979127b54f728ddf9d5a3a65057cb1de83d6417a6fbd770946636fd90000000eb6d6229d9e76b15d308eaf6a4d5ec042a1c2b6efcac0387999dd4f9f6bd255300e4e57bf1b419459a584b522b7d741887ca31d4dfcd523703e6ce77aae16c36eed85089020127c3a907da6e7313035e06c88cfbbfe9959750baf3315f9ce1e0da45560ec12f37f4ef3b2655080805f4c7996267d5aba30c104f162d0ca5eed29bf615f2efd67d27240329efd9a6432940000000a7f661bd75894021e9b4e9b8b90ab720d41350a9b926baef362f8cc178d3e4fb262c9dd2de34af6cf950a4a84710c98149fcc58ed1feb50c5259824881ef5a78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08f967abc3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410610007"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f8d8c538e063cd293c7ea69f894c2cbe50151b80b6d17ad875c729d2cf1ff7fc000000000e800000000200002000000010356bd2ddfe91e9510ec71cc6de5919c1a36fbaeaa5670c43950ffe5a5fe3bc2000000054b69124b9137c23b7ae39009c9cbb8587f90144c2a2dbb45e10c48c18d742b740000000ebb9cf598ca9354b8ee4e135fa9062a9359459192700d0f071633b07fc6639b6033c3928af60c8f2f03da9f74f6b0f9592dbf452cdc1333be5c400b6685e148f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2376	2208	iexplore.exe	28
PID 2208 wrote to memory of 2376	2208	iexplore.exe	28
PID 2208 wrote to memory of 2376	2208	iexplore.exe	28
PID 2208 wrote to memory of 2376	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2679b0d07c3a3cb408be006ca8723142.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83ba329628894176b3582a11a4a74e51

SHA1
fa357d64f4e58069f35ecefb63c04ed5b2146a45

SHA256
82e4575a7eb27c70a4833ac15b753cf946c6bf850a1928658343297861d587d2

SHA512
8e47101c67a50d1ba1d28d7d830b9f71f1acbf5d41f43c6b5dd7e3d2e144b9930abb09a28ac279957329e09c65d39cd84af3ef6e58fa4063a0c7535bfea92716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a43588f306dd6e181de518f3fbc422

SHA1
d9fbf315ad8fc60f653fadf15725711cb5a31dc9

SHA256
42959869989052e0d9b1e5cc8ce92093eb25146d7c7fd9c0df2aea03851282af

SHA512
96de45f0e081681db1312f1c05c2dd7080c985bec125576edd999c49d9ee6f61fc84c370330eefecde39498c7204b5879cfa3d574fe79b0497321ddb0ac7aa9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb7c31e158b9a35c37bef6d1e35386f

SHA1
c6b4a4a023ffbd68bfa27e917d8dea5a31588e8c

SHA256
d9d46f031f967e479b225981382d0a1e027ea16483c3397225b8fe034e56e594

SHA512
16f32d8266bf49fca027d840c9e01492b55a7e7c8aeb82447ed6f124cbaf0d36830967bc54b0a7eb1c0ae7e6fc6669afa5fb4d6354cfc316abc48b6256574908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7468807a9eb7791bbb2ba4e79ac662a6

SHA1
68aaa0976b3d524840d80d8f44a6bc718fc4f87a

SHA256
a9fdf583e1808d11409e7bc53cf5fff615858467b0672e9f86cab8c6547fcfdb

SHA512
fb687c40376df0fd69432e298743ca8b532162966d16b7d05b68149919691a192aa641fdeb7b56a222a49a406df221a271e697a9820bf3959a4d69a52bed0801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6921afae7137af94bd2f67cc5c83d4f

SHA1
f5077605ba3e7940006495320216d5d960183290

SHA256
13a9d30bb685d44af43575ca9a45f3fb7a7dbdfe2a1f599a3d3b8b190235dddc

SHA512
c4db798f9c6dcd910ea7eb556172ccd0011e9fde122b12d126daa7d484f549e6e51c1f84f55f6c2227b2c4c537281392e696d688bd35f49b08114e539f3467ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b584ac0c70e76f5b4905e7314ec2faf7

SHA1
138d7f016bf93a3442d552f5064fc4bfa808f139

SHA256
ff85c95b7e4a3e48a2761d32a16ba9c944c0643d309fa21778f238cdde8f47bd

SHA512
662d584d5216592573674972203d67dbcc51b5cf2a3b42e2ef7c0e6b84ece9f095f4116e12498d3d715ee4c9326aa151e636431b093fea6113b1abbeece930a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c611b74a6164f37fac47a6efd7b7bc41

SHA1
1e70a010c88b1914143756ff911a8621be3a9541

SHA256
5128dd03a618a3064ee1bd090ebee58e3983d88ea2e05c57dc781b1afa85e168

SHA512
9bc55b15a74808bdf33dbcc0c4011854c7b0bd7f06f9ef65f073581c4c283b282a49883ef259315ca42c264f63c7d93ca5f3a1e77bf1d27f9fc054a49b1ca5aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beed3ab0167cc06583f376400ac79dc9

SHA1
ab4fdd6efb24b72ab801da60298efa42ab2f409b

SHA256
6e05f7af12a148d66c0e59b0705a6d84224e6f478f263a325594b3b4d73a2367

SHA512
06d40ed6d619bda2b8bf6773093c94bcf9432bb3b096e1242211d7aedde78effc9bd07d03873164e7fd74059c41a352be7de460e56a24b504f949ec8ba2e21f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4180bf942c26dfc551d1d91b69df43be

SHA1
9eb28817c163e469ef062484f62b845dfda0cad4

SHA256
1875149fb40ff578c57054140aa2b799c3c00d67dcbd745bc49767d48768ad03

SHA512
bd84f2871bb598066a1aaa836440f6cedee771df22aede29f7a3039ea3edabc99eba90f1f7cd49d6f288109c07174fe0094d4fb0191c34f4cea77b860eb651e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6e10fb921c9494b0b0eaf8c4ef76322

SHA1
e863fad36208c4937c9628aba2e8099590652822

SHA256
a6931c36a545da22226e2d1639be708a24a6a8e2d8f9da413a1ccc1e601ee6c9

SHA512
ff5e57c57da92fb6d5e5277b9c2cb934c117afcc4d0ed865ae92e1f44cd7a26067ab11d965eb66ef46a55f3f1a4c1254ba12a2cba5f507161349fb101907cf37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
335e12853c5bf0488642210a249035a6

SHA1
1be4aae01423885c7e411eb65f8ef69247e46876

SHA256
95b270a3f3e175fa6ea9525854cc8f1acb7cb772d9b0c0aa5caf8b54b240e8ee

SHA512
fa2f1837dfd6c3caa18a498824fcd63a61ba0ad3382d4999b178fd2eefaa0581e51788d2d202f9271c3c119509270de782b6386f6ce6cc904a58258ab7dd0cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
549cb9e5750f4fb0ae9866410bac687d

SHA1
f02b27746d5715acb756eeb0100effdb5e3d0167

SHA256
d2ebd6575041302e330ef273039547b0574166e19d98bcdbb0b5ecc0256d485a

SHA512
5f5d4d78dc43a9aa920054367663de4014a08a504abdcaac50b775c7c730213e80409b75351718c5dc9ed233b1049b5a70725ddd61bacfe538bcaa78ae141844

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAAA2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB8F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit