fa8cfb2047737e9bd0429f91a13518d062730fb30401e43767fe1175e7ef9284

Analysis

max time kernel
102s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25250553a0e2cc9800689cc8aa6acb39.html
Size

908B
MD5

25250553a0e2cc9800689cc8aa6acb39
SHA1

9dac0ec13557e46ca53faae3c6817c58ed205e62
SHA256

fa8cfb2047737e9bd0429f91a13518d062730fb30401e43767fe1175e7ef9284
SHA512

1233b450fa39ac8c4b2aca7cf41e89acb65a857c04a357ccde57815ee9cc40c03cb1a9a0de82c31bb3c150ca343a4e29cf2a42f7e5d161b820cce274949ab2f4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009f590b1ed7cd44183e2cca07afbac4af52302c5676fcc1526fc884c3b89bce61000000000e80000000020000200000009bcc0f9d1913036393d6500ff907e2a2badd99b8b07eafabfd3e9a95383a0bc2200000008827efcbe1a2c2f425a92ff15da355ba970301893c4ce3f267a35b08375f0c8240000000aa0065e7c3fa24668df0f132c47315ee3614667dd4a6f1799dba61be4ff232ac8eb25646010da4e9d27b6372276a5c98bac800d22f45b6ffecbe5e3f2ceea7f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000074200f35c042f74206ae21f9f58bcbcc9ade4a5ea72de2dbaf0d0f3593a6cfc2000000000e8000000002000020000000201c4fdf872b196f71737f816a08a14bfdf067c073b7da6e06056aae9cc33b17900000006b4c5590e20737e58860b79080cf183f0fcf82427afc99a09a48b6de9e18a168cea4ee985a676b9eb97162512e5fb0342331b2fbfb1edc5994eefda65ddda9026ed919387f969965044ce934657e683114743bb600a775a9019ee3d4d7e0219cb983973a3c7191060bea04548d2712fe3b792919470ff13cbd631702188179881029ddbbbd843bba75a5a1327d6e3ffd4000000003f905bee7ae0ed7e844bce93fa49fddf95adddfc26dedb11a2bffd04c9d2f72a430536c8dab1b2a1e18fb586457aaba679a95161f1653720b6e323444cee007	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C34D091-AB9D-11EE-A1FE-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6068ae04aa3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2820	2764	iexplore.exe	30
PID 2764 wrote to memory of 2820	2764	iexplore.exe	30
PID 2764 wrote to memory of 2820	2764	iexplore.exe	30
PID 2764 wrote to memory of 2820	2764	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25250553a0e2cc9800689cc8aa6acb39.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ac17e717d6551d5b8f0a00b6215cac3

SHA1
8e37204b73ca70e20a4590521db66afaea492830

SHA256
417102649fa8deb41d81cdeb30a04d936a04c2c349409da8c9a1144f84404e2a

SHA512
edc445b611a0fdebfc6afabbe1314029d10312468d8081873f0c5a118d1db6090c128bc186e4821cfe5be9c6ac8e7e258e5b3a20b97d39bd02b145e57e2cc078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff0d8c0a1144514ec677dbdbf0e1f8f

SHA1
623242ee05517500a511dd92b9cdb5a8ad0dc24a

SHA256
a1c37ad85de886f25f07943d39b2699358a29327216166b931eba1814f3381b1

SHA512
2d139d88e21ff1e5b731c3f129204da3cd94159b51918be45d05dd52e4e649b737fb8f43e2541effba7805c43bf099b64e5a227c82173ce1b4b7ea59eb01725d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8696ec08d3d9fd4c57f2afe9efe45a1

SHA1
30e9da08567fb8b0a7daac18b79beb129d98ac05

SHA256
8f19f1dc49646c302ecce8625511ff0a1f743efe5b84cbb19b4b0d2c34300167

SHA512
73711bf87eb316802d7c5376427e99df7317ad295dfb4ab80bc103e5455717bc7d535351bd68ed4869301b4b7f9f9791a88284fbba2e0a229f07f4e5053fb365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bd478c6f98e88df133c1d72fd9a97a3

SHA1
2e8aa036aed163aa7ff82e7457b2df34bc822de9

SHA256
3a80ba2e8b63e08986fa37c8997ad3b4ed143b4d7dfa93d05a222c2a1b8b425f

SHA512
3e4741af20017b535b14f3e5aa16572607088b5dbc08144f84ae804210eda21f31d40a0678d2b318c6a66f89c6115821ad37cfdea84ef90b4c517816cbcaf1e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58a7445e3f4a85c4aa9013b12fc2f875

SHA1
09d63c7b4f1fb7d41535dc91267f447515452dc8

SHA256
c63cc5c2d14efd7d681eea41d52c5b65cf97b4b52d5eb58d930175456c4db876

SHA512
7d9a907e8a3461837bc4934ad11d47a6d78e46a55749898194879b918651da882b20ba166e36496e711435b66a35d7cc4314d95064477c2dcc33d010f81417af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87b04aeff626f336efe4651c9ed3b2b1

SHA1
ca19cbc54b9e9c1ddfd8a066ae46c5431d9b1137

SHA256
2344e5592921626397aaa41e0d2c4ba4de5115cb5dca22a4a2765a9fec0b8eea

SHA512
a6695b391e6efe912456ecc3bcf66478031aba1b556c99738e32d07919d4234386718e05d939660f1539235069196973e3e79abcd5565af15daebc4447f8155f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6862ef7abe9d996daa2005c0234cb75b

SHA1
ded67ae8cfc8c8e4d3837017c7262e6d810a7742

SHA256
bdefc966e4e47c384c04b80de53b75e50fa6b61409ba248346e7a3ac7cc4aa0f

SHA512
953f85ffcf771de6337ec2f78def41269791116212140bcbee94a3b06504f00783cae9a70c633fc18b1d9242a394e05918916dcdb121ab63dfc799972975aeea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CE2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D24.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit