e844382475b3ba3c2ed126eae3c6dd792120bd1d331382c65dbd46ffa80575fe

Analysis

max time kernel
117s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25a3bd71ce2c382b7abd906bb7fdc0c3.html
Size

10KB
MD5

25a3bd71ce2c382b7abd906bb7fdc0c3
SHA1

91207da732a94530fc476a17ce0e3780178ddffb
SHA256

e844382475b3ba3c2ed126eae3c6dd792120bd1d331382c65dbd46ffa80575fe
SHA512

f8bd538f1403cfc724ad36fb57e793f0877980e28860fa498107879e51392da4823f3d2f532d1b3404b3eb981abb3bc93904e802228390052f3b8a8a7e15265b
SSDEEP

96:uzVs+ux7I5LLY1k9o84d12ef7CSTUaGT/krIpfLWN9xzhkdZMVeUWN9xy7lVHcE8:csz7I5AYS/HizwAUVVwQPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0EF7D01-A90D-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000000488e9f97ab8d5ed2b2aa90a5b4cd36da50fe77eecfc1fa5acce195651c71751000000000e80000000020000200000009d362674bd418370ee36742fbe0a63ff53afe8d14bbc18d20b9795479b58194220000000cb6759924f109b33e4393aa37362db2c798af988f3f2f7382f9008349ef4b30840000000ea5c8ab2b9bb11a84d037555d352a50db08025cff7b10b2949b0227fc0a228a67c1b0f617dd7c147bf63c3b32cc00302710ea049d8668305bfcda9f08ef6de66	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f1c8c71a3dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000003254231418aa5c352f73cea21bb92122f0da33acf1f525a000b1a1c050b1af1000000000e8000000002000020000000212977f5809b94db03af7ad037a0304b53b561d8623a989fbd1f61ce60265ccf900000007a1ff69748b45cb196998c3baf2d6e9d835dfdb9c0196fd4489fd321a42454fcb04549dfab518c2731121e8e742ee4e8d8270d2f05f29f02008c0c24ef58e6c1f9bee09d86e5be596c885c95f5c879f1a1c6b28201ea7250482d4ba23d88d78bd784c20be51dc6bc6e0d8326f55eac5d140ca46e32a810f0cde470791d6eaf9a4c039cb32492f4d2d89920c0be7a696a400000005cf86f36719fad266ab53dbcdf2df61cd954632135a15439c47bac59890c984b7e2df20109f6d971c843e41dbe5e1e7b516fb9d3baf1347ed7087b1a614c86d3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410320667"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28
PID 2504 wrote to memory of 2352	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25a3bd71ce2c382b7abd906bb7fdc0c3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8df0899da2344c09ba5fb5b4d639f948

SHA1
8bfa65cd5c334f351ba4687f00f14cfef68569ec

SHA256
fe561b7a7402a3781f60981881d5d232a98af356f03559105af0894b807d4440

SHA512
3586359620021f8166bb0fbb983a323689ab39577b7d5a4d46107572a8e04225383c028af65b68bb6954810e6dea20c37d87ba1fde68a1f70b58988e6120ffa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
052ad5680e84a2087e53e53de1b5746e

SHA1
731841de53c659917ea742781b68ffef6d5c2e83

SHA256
cbc32fc1a1d1c59252263198e712fe7946299b65de495ae5c37e7140387506b1

SHA512
276b4888666bf8eab641c2e08949bd92e71daf3ff1102439d9238df50fb92ef1c517fdde5c44b2e7d1af92e3400ef7913b5b6338b3ed71689183619ffee0696f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0123aaf37676947a7e88c49dbd364b26

SHA1
5661579f86958a59edc88ef7dec012b5cb96a252

SHA256
14e10f5b48bde4c4b5f1412a78c8b7bc5de1b6c233868b4d003e6666fa466115

SHA512
5097ad181449bae2030ecfee34ef20ad91721b094849a9645022c4fd848b7a3a0a71046bd29ec453046902a69a1029cb4f2e45a32cd06137c319a72ee2e73120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75aed174560dd2f3b5879a7ed91572c

SHA1
c59cb17e50018e3547e3d6021562cba2c46667a8

SHA256
5695b0ed218da4f264da3ae0db5b726f660c6245ed139ab14bdc60f955711815

SHA512
516e84f0d6439f775aaa00b2b8a59822c146f36d47d061878c9b019ee8b85c49ca9c85885564515813f3816c7d349c55500381f63c2b65133b5f973dbbffc45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caabfb40886d2f5c0a7461e7791d1d0e

SHA1
c2379ce3c3f5d3cf750214a22f60efbea381bec2

SHA256
fbcb71c782888fd95f1f3bc989ff8809c8a1ccf4635ee7a5e3906223c47acd9f

SHA512
0055fdc53350adb7895af4130bc037b261e8aacc0a8e9a0a7f5768a812aa18e58c1597d891b85c8c3ca0bf00d4410c2bcdd69040e92f69ed5139ee3277741bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf1c2a2a3df1800fca1df6d132b3dee

SHA1
d447570b44d914becb1eb59c132601fd5b5eaef4

SHA256
83de8853cd7245646a341396530732c7c7f43d1fd5459706301900307ae24425

SHA512
a4fcd177b383fec3e2c3c837611e3c1bd3bf438c8dca5a6076034f41a87550dc7a7f9b582f34bd3e0d190bb798526abaf66e35ba864914c73ecc60ccf631af5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
088904e10fb3dcd59d23cd9b9d88c770

SHA1
5534cdf5d9e1ead8c364bf3db28fec8781cf0e25

SHA256
32ebb46f20c4faaaae43bf453ed8c8550ab0d9a5adc7e7b4e3d72b78586c3388

SHA512
f808d8ab654918d4155ebc6604842c3600fd317f3fced20e6b61b95aad74a8b62ffaf9914f4614aaf95e65b1aa263ae84bc5a60ce0d5ba1ae86ab03dd4f46c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab630A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar631C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit