dbac2bcf257021192a404f067213d4530affcb36e997632b30afbdd568d24166

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27822006f97df3221dc615ccf48621b5.html
Size

58KB
MD5

27822006f97df3221dc615ccf48621b5
SHA1

eb478e71a0272f79463a33d780bef9ce1e2f6ddc
SHA256

dbac2bcf257021192a404f067213d4530affcb36e997632b30afbdd568d24166
SHA512

aa3fcf98e35a53e5f5d192693e0037ebaea01d50f5fe8d28f5ee8ddec57962c52d7aff2f5187bf8464dbc89f7d6669cb52037f880ca61324aec296ab2cd042bb
SSDEEP

1536:gQZBCCOd50IxCCxkQfjfJUfxfAf3flfsfjfVfDfnfBfffTfEfGfgfdfyf/fqfR7m:gk270IxL7RUpo/90rN7vJHrMe4FaXS5C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410616274"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{389CDBE1-ABBE-11EE-B092-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000122f4ff76c48f420f2c3059e0080625bd8d9daadbbb2ded05b67c6e2f5648923000000000e8000000002000020000000a92bb2227802370b0e705872096c9911840fa9c86c3a5d1c0597bdb98f0e37e1200000005a22a4476229a70b75bcc6916ef7d6ee54dd4a3796976dd1d1622925ab93a4e040000000b850b9149e1101930524c4fc97da4734786866a41938acabd9456ce7ac0c8b7feccb9c1caafcd2fa0c10cccab762c3067a3ae84e9ef019266061c848833804de	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40415826cb3fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d671279468c17853bef8860206f262a5841c9be8c6be53b1e6dd728c028729be000000000e8000000002000020000000d2d57cf56cace91ce74d9018a96dfd1908c5b37734ac125021ec2b8e17a44ef2900000007a6850ffcad9d1580e80cf7b3dde6a16f67121e3478b997a6767b3e54a51f95d444d519c05d7e772359ad1b1bcf1c37c73c6773a906db61bfe673cabe3434fbd1d163754582998fbe3f9d6c4cbe09d6edf6e9d03dea1dae399c77cbd6ae5f5c8ad1ff1e8be5f420739cec6e335391c30e9624ac836bfe1f337c7c333835fe98e69fc58d5c72907037d1f8b162d6ddd2c40000000e419b2b9b28276362713bd37952eb40b50971586d33b07edd12a86bcebff714cf5b78f8ce0f720e888df1018dccd7cd464b738431154791970412a66a20420ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2688	2108	iexplore.exe	15
PID 2108 wrote to memory of 2688	2108	iexplore.exe	15
PID 2108 wrote to memory of 2688	2108	iexplore.exe	15
PID 2108 wrote to memory of 2688	2108	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27822006f97df3221dc615ccf48621b5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09013323485467c6c16e26425d90def8

SHA1
a09952b33845968bcd2e237b9951c32f515594c6

SHA256
90a6bb7d68b8fd465a2fda63f4326421d85ceaaf37805728b95474c6c4545f56

SHA512
8b32d217903367c1df5f75c50aae6597d52f8f6cbf97251e65e02c357e00b9f2453d2a116fd4e6adbce07765811446097d19dc630159d8c051b73251faf15ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b60978fe016e5c27d9694c76fcb84d4

SHA1
9953a12685f3a9df19b7166178cf17de21bfac1a

SHA256
b26439bfeaa7ec379ef6578440415f396d72618b944839866e255d880a4bc4a6

SHA512
b78259d6b61a91623d5e2c52e5e4d112b3235b4bc50142e95bb6d6f321fed53e308da163f6da8bce15d641674322e9d2a2f84d19424b7a1284808da385e3a64b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
904d63a9d4dfea46ed36105001295f07

SHA1
fd267065917d4135c743da36a79807b8e62eac90

SHA256
7b6b3fb2d9657960f882bb2fd0c08c0ae825f75222b2412960d8dd76d0616a2b

SHA512
1e6a76610b9a2374cef5a56135b06fe7541b417392ddd0599d3265e248fed27be0ddbb5e962cfe7f90f9eb2312d2c2a0e30fa01fdff3e5691d3b5eb8de52ebef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ff54a1d3ae939c01f5a9b4cfa9cc822

SHA1
bfdf17d6f49e0d5af7010233e18a4606bcd334a0

SHA256
d3f9283ded2232d8b0dc12506dc98f9cf6f318cd4bc85a3b3928c2f1576ee06f

SHA512
5cd0f91428927ec94f312944458d5352a035b57e81e59d16c93d624b7e40feea01dbacc30dffba3bd1800877c3e7eec722fe36214ec44f376e35f7a4b0dce710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f52dfd8d27f64d609825bb8ecfa3d330

SHA1
6fc5c0a5b02554f723b982c3abea859ceba16e72

SHA256
d3b288ba024b1a2eb1077fcd63110ab7f47b801cd912fc183bf95c0209739649

SHA512
5cd1fbcd20247f5a65d2d33f388503305046f1ce7a95290faf4c07095ba8961631bba435035ccd2c363de3af37154d20866c58136ccb38128b6059f95095245c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05d9cae0dc823f7360ad272c438f3029

SHA1
538a4b88bf1fcd469b48d9333fc19472a7f9a3df

SHA256
46558c4ba7e96f94587d9463a0cf0dcaa90bd1c06931f6c3539d095cfd71fab7

SHA512
408035d426708c8fb8832d0d4284df03ddf6c7c95fc9e8cf7753438a9ddd5790a2616832d23ec42ad9a271c9167df0f8cc80df28a1c154c76843b7e831306118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8366a746f3e42fabb1b4d42495e1a15a

SHA1
d3374458796da36c8b2b0064660a0901e823d176

SHA256
8e8a3cea54b3045a2dbb660d4d9d11d0ea4f77d8e945feae094a4660626d9706

SHA512
8070e6037bd01c9c21d74f5800bfba63344741cb32c8e54e7e90bdd181ace71f496cb041219308eea4067a8115b1b9a717b1d754aa7066fd9b6597e9e636c8b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8a0c168dc8cd38739f64b49cab56dea

SHA1
cbb2eccfedc5c06d9132dd2f446ea52aef35739c

SHA256
de82e150ef692755a2ed50058a7ccceda0359718358bc5595438a0802b8b4a19

SHA512
eadd04c365a9659042fabaefae323dcfbc453b3693d2d3cc67f3a150735379dbad167a650466d979a63e6640521d319cc80b6b7f8e70c997f394914e61812a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7532.tmp

Filesize
53KB

MD5
4615785afee89b304fa2b3e58fab53c7

SHA1
3bc9b401b8c609da62dde14c37e4415d2a5ab987

SHA256
9bbe5ff8685abac21b2c9230ba312caa170637fe85afd86a7fa94e0586ec98a0

SHA512
f47bfb1395ec330e7eadd4162bbe97656931c5c6f2911a836a656e0481f78870bf6baf6f7f72974da09095754945788a2105c898a5b19f284eb58f2e22e9a322

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7564.tmp

Filesize
68KB

MD5
c892563f13abfe9d809c3a0bdd931d68

SHA1
40ff1df7b5e017dab3f77a24bc7bc0492cc91eae

SHA256
818e7a5abe3e00e35d43a7fb078ea78c806aa52c7f9107e332d507982766fbe2

SHA512
fe59c4ec2b819ec4f4db147e17254595b3aa1e32eb056f239ec4a945e7905fb6622e227eb0d5a108f9f894c02f7c0b46add9eef29155d38ac21b708900cdd01d

Download Submit