e876e713cfccdaefa73e01d554af276fc503fc495445cbaf01df5adb236561f5

Analysis

max time kernel
147s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

260e3422e4d03265d91f813bdc26efff.html
Size

57KB
MD5

260e3422e4d03265d91f813bdc26efff
SHA1

b158bee471f518a8bf96f2998a4820c3896cd91d
SHA256

e876e713cfccdaefa73e01d554af276fc503fc495445cbaf01df5adb236561f5
SHA512

dab44500a9448911b3db550a049d615faf0e791fab447142a794865f3399e72bf0d20d5e1117a3e81d317688ad6a753257bed50fdf2dd55bb104b8512f31910e
SSDEEP

1536:ijEQvK8OPHdsATo2vgyHJv0owbd6zKD6CDK2RVroThwpDK2RVy:ijnOPHdsd2vgyHJutDK2RVroThwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B3DB081-A913-11EE-9028-E6629DF8543F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000dde9af43945ed01bfef7911fed065d1f0892742f2635784befb2028e88814922000000000e8000000002000020000000f02ae18c63f193da2ad3f0ee901275e952acd5082e7ba096933042757b85eeea20000000e3824ca0f41fa18086a8d268d21c80889ecfc55dc8cb3f301e30c37f9c40c257400000005fb580a129a4e2e00242897e5b1c3e5863131a4c1bfa8b463ba5888c977dd7dba3126e86cbc3a5f62aad1a09cec8035791cd50eaf1ce16dc07891ae9ded33ded	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006047d6fbedb3a482e21ef6a0a51548f9c82e4db065bd5087002b884529d13e16000000000e800000000200002000000070c1ba23add4ff63134fa1097079ed0a02c4bd033b00210d704d272cd09c221a90000000d39f1c0612fd5ee396299f3f9bcdd452888dbeec95e80f983286b2581ccd08791776fcc73368af35e2d56e90102358c327122698950ba0dc7b04bd570cc8ac5b45a86f9abe144ff8450bf706e57728f0b6fc32847ae2681afd69a1e0d75bc9e8e8ac5c538c87092735b4621d7c5a8ff4479ed9e2ec0bc95729c022b1d998a07114ee8f8f9a2f539983b22dbc70558f4b40000000a467ae67d3a306f85ce4cc9a837ee675b99cf332835e56a0f29b9316dc13775e6b3e2a1dead6adc8fe2bc51d2e833ad17a3afa51c5445cc5ef5ba3e6a0921a9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a022d416203dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410322909"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
832	iexplore.exe
832	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2792	832	iexplore.exe	28
PID 832 wrote to memory of 2792	832	iexplore.exe	28
PID 832 wrote to memory of 2792	832	iexplore.exe	28
PID 832 wrote to memory of 2792	832	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\260e3422e4d03265d91f813bdc26efff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
f29ee2183566d510872b1482e1c6e2af

SHA1
a7f09caa7057ebf50f6d9e2347d7048b2229bf25

SHA256
b7b74341077b8ab370a11d789ab5b6b62b896009765b1aaf363fcf38952b13f4

SHA512
330ed75d8e0bd0bc3a6eb3aaad21f7ecec2ea8a70c8cac5d9e55dc62166ce26e236c86eee085d23c01cf4e81ee1c60dc943b278996bf3f30af4cf8a42f3ced92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
821d78b93b2901adb2c41fd4cf7a57de

SHA1
f6ea4f040f391a77828437a0e35ee200fdd85be7

SHA256
5134a548469c64df2c789c649eef1ee42393e72cdac73cbf7730c0febd269984

SHA512
e76739bfe801926fa1ed3881b9cf09feacd6d7098cab5a39526a6895b683d2c165d4252f2b16d3ac03ba4bf8a3e533766fa245a07253baff364441f98ed5e45f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e286c307e18406d4775f3a8c653af7

SHA1
4e50dfe4f5dea727b3b07a01131f490258e63a14

SHA256
e5ac20ce57268aef6fcdd4ec83c748854738bbd8515f3f2782b627a728e7eda7

SHA512
aaa626b6dd30bf11455ea1e68558878693cec792d8a66faa7054c3536d96fb18bddd08b0d76346df4a291f3e86b9eca864949f53a2f872db0de7ef8fef989b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
040d1e40f6c4a55fc36db3c8a58afa5c

SHA1
e56eb0978b15c5ca68b83d2c3553934fac0bda94

SHA256
30ddd6369138cd9b7910ffb031294a9dedf4e0518bc759ddb9c71c6be7a1dbaa

SHA512
d3dadbee67c9a87aa18ed3a085c1a4af5f9d80a957379810a1bf199f261e9b3f7132d5ad92daccc9c8fe95ffbe012f48187cd880b1a9ec17570240932a54a523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14a02d4111ea75b5797ab66c7cf75dee

SHA1
b6aba03839b267b6006bceb227053ace16b2b0a8

SHA256
2a2e3285ee708991ee3152fad7fe2c88d70a804d1904652821eb4857145e624e

SHA512
90b27a67b5bda0658de2c6434661dc985d7c9e0984c3848b22128491d0e15465faa223cf8801019c5ecfc871279a971ac9e60e53c74708c838edc6a3cc8b9dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83a1c1bba92fae6c35bb7c7807a67448

SHA1
62585b6e0ef6fecf0d8cfa5485e420fd8064284e

SHA256
ca6d1a285ac52b69f4b20fb558575eb59513064867d67717ce8a60164ffddf8b

SHA512
9ce814580b78849ff45d2cf967739432b94e4f44ddb37aceccb5596cec10fe0c3aca6fc3d5a1306f2f4a985350344c19ffa6f8a3c4461e28d072de4245087388

Download Submit