e1ab2f3e4ceedf1dbb06e7f526cad9d42d643ed7c267c09d9a8536536a0d0a6a

Analysis

max time kernel
177s
max time network
220s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27da18c4fd7e13358f533cd10ce06abe.html
Size

42KB
MD5

27da18c4fd7e13358f533cd10ce06abe
SHA1

ab5f5929002317a557566aa9eac686c66b86c672
SHA256

e1ab2f3e4ceedf1dbb06e7f526cad9d42d643ed7c267c09d9a8536536a0d0a6a
SHA512

cd0aa5b2688731f48c9cfccadf1f09c74e3c0be473aa10e62ed663dc8b60035100f84eb27ea1c4002e6d0746b0b9007843b61452fdc7d431c31348966a792a77
SSDEEP

768:Zcd9QZBC7mOdMkepC5I9nC4/dBjxEufSwBwow7n6KPd:gQZBCCOda0IxCadBjbSwBwowj6KPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410332920"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000012028938f90b52e44516e1888849161630245f1af0a7e8273ac9cda056a2dccf000000000e8000000002000020000000b77297be66a58c3b5eba8fbb0fb4f08b2a02e4f71c62f0193797aa03946aefbf20000000def00d2ee161627d63cc8825ac64967868050793e32605f5e3a30ff869c409d940000000bc43df96467b3d9cc8fa6c4ceb9226178c37869fe8907e8c8897e8bcc765ad2518924793f04cc57d1ceeb2c50656fe71239781f41bbb6c7ed302051b0d0382a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D0D0571-A92A-11EE-86D4-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000075ff9781f232ec91841e78c4528d303c32e4f90e17acf6babd83dd72b9f24fc1000000000e80000000020000200000006e81a74e086c9e982db59bcc3fde58b48d917a4b52ded78f330d89d088c8af7790000000ff078d7bcb8682cdb8ea4bfcbee3e0c6406c975f021a4684f4f89505b2f51bdb8be5b605a78ac4287c1d10788058d069675ec72e016685a288df6328690b0ed5d6f4f6994b9fc58cba440ddb7d60d584dbb0d13b31da256cec949a3e8c7535aa8db0f87fcbcd860b1272ad55973ea5cfd29d85b3175d1d20c92e9c8b57e7fe45a93f8a3c78d712ec7cfb64baed37456840000000b52956dfc296fd81b464add2dfc0468e8834d6a14418c24db1a5dec2050beb671f9808d7a8e451344702c01bcaaa40abae843bbd29b1565443f003dbdbb17fae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d4d17d373dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2604	2728	iexplore.exe	30
PID 2728 wrote to memory of 2604	2728	iexplore.exe	30
PID 2728 wrote to memory of 2604	2728	iexplore.exe	30
PID 2728 wrote to memory of 2604	2728	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27da18c4fd7e13358f533cd10ce06abe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a7d1448aea05d21bcaff145e2fc871d

SHA1
43b66c41928693023cebc0ded79a1e4707825135

SHA256
2842c767f8a5bb652b75a58f9f273fdaca1856f24382b4da1ea0722b121a2710

SHA512
ffad0745bbd398f346fbd756da950c164a092a06a8c1f93c0d81de3eae28d8db2b289b4a79cd2462023a2eb74ea16d8a36bbaa2907e54fb94f14d8277c6d894a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebf0bc1a7f7645365455e8fc823ccc65

SHA1
116117dad03b7c2b5de4385892184c07c8bd1213

SHA256
e6e60523f57b6638880a2261bfbb043a1f282e9fb965ed2a205e9202f924693a

SHA512
55eeca8c44ea09fe8cf9c5600f3120c32069ee30a135052ab32e5a6861d0844547d3a5dafe73ccda1d4faedc3b5d751efd94c1747435cadebbc3f02174c8d3d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e53eefd26adf4e6f596548f1f40bc911

SHA1
e9fcbf721795a16501cea9d5369b3544377156a3

SHA256
684d03141f5104754681665fbf4a1c8e5bbc5ea2430db1ade53de97157b09c05

SHA512
67ddd5aa88a9045e0e7c3823a8903d7b78a329e001f51101ac688108fb33e3376bedc204d16e67ffd76ac0a02141bd29cd22ea02d11aa9a09516a766e94d4214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf7c31640f3467d3e02beabb0a00f51

SHA1
2682fb1815b88523e1af42c606140682450ac558

SHA256
d3e820a54c9c0ecb0161e452e01d5002a546ba19924cb38b91a71dbdeb923304

SHA512
ec833376a21f5c83381904ffa9e0f98b2251914d2b65e9be579256864829b8502cbe017547feaefc228e1b3d67d47ed9c50aeb23c362da2b67bad685dc8e27d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47cb240f3f99abcb99d7da020a1ab891

SHA1
6700f3805d9dab4f6cbcc7df743f97bbaca5d0ff

SHA256
3c877165b833ff8f3e72e25eb519d9f28554ba85bfe51d1ff83d318b09376108

SHA512
31a99589f1a692d1eef2eefaac95eb2f89faf617695252dc04f52bf904e6f05190ed52ad88a939c3e67e16a0f2e11b69bb260e3e4d55edf0fa5dbb11db85c5ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fadd1f7f31de2a2fa1009fd8aa44dcc

SHA1
3415ea18047eb058a2b2323bb42b8a14cafa01a1

SHA256
837a5ccf939292c56f6d3a4cad12336727b61935722e9c8d021bf3aa5c1b7354

SHA512
a976f92eceae9bdd802bf54b9da9f1b8e0e1137ec6adfe221a796046aa15d4ff1aaa5794ee8a8dea4d93b328a9b69739d1e44fef45a349a8b5b8a186fd3e1d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99d7a0bda6e483d2758c11c88c86490

SHA1
a1a4777228407233290722ef05f3453c37bd24d2

SHA256
0c30744cbb4c79d301a6fab5cc9c0ad4b53fd08d892e688ee4e46172d87b1110

SHA512
d0612994c9a55b64d97a5f1aab2d0268fe66d635cdf00073fcbda6d1d03a4eb25416047390b37483963fc6218b28a28dedd37e60c0f147bd0ba35ee5c487788d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97d124e616fe757a63313f8fcbc07f3b

SHA1
a657e604e76315235fe989d4d4ce5ed7bb4b74a5

SHA256
fd2a3ca80207024fdd84101e2f9e99548fbee7b71c1bd44a327d780f7997fa2f

SHA512
973e4ea0ad79dba056c3976bacb166c7069958636f94cfd0420debdda277b9706110c311fe244cba4cd89a278eeb5c4a103e8585a3e4efd09db11cf5860e3470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04c201debbbcba00467aef5f023836f1

SHA1
8fe1141db20c927ecf27d2fca485fb2af26463f4

SHA256
5ccd34a60e415c630ea5ebb8b9e481cdbf9b111555a90bb2ad62619a5f202bbb

SHA512
fccd2d3bcf041721402eef9fa4f542473cb8a78ab56c6fa1567d6224a1ed0874c153db5a03c85561d48fb1ae8959e1b860669f5fc5eb579ee7abee20e832607c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81f7af804a8b9216b202c1ac85e77880

SHA1
d44c0454c1b1cd5cc19af4dd5aed921573e6ffca

SHA256
a35be5c3593203374f384aa384b9c7f913e024f751093485429c155053aa2872

SHA512
9b197ebfaf98222cbb7f80b2d25b6c898bd5dce50a8af769901ef765348fe211111665741b8e22f3e48733631b4168ebfd013d2ba6eaa0def012c3c1e105eda1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25d5601a98e7e292e431c9a46bf9657a

SHA1
1356eb61dac5045bec75ff77f977baa899008f67

SHA256
ecddc6a92f461eacf951835f8472a0cb970bfe790c276e8aae5262a2ddb74eb5

SHA512
aa4fd1a007cb4a1bfd3ba9375ef69f2ec8ec1cc49fc4ec52584093c16f91861c4247beb8780d32b2dd4f7ddac926103aceeb40b2d180b157e85d672349cd256f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bc8170774be5b5512f77c8bb53bfdba

SHA1
dc361157e7cfd9042bb01b6b5caeb367ad1afdfc

SHA256
c8eaf004f0e7d894c47cf3fa571e12347a30c7d5351b9788cf36dc0a968ea4a2

SHA512
65ff60292ef128323959960637e899ef6431e57416d8e1caa5a88713ea894223d6482aca09fefd982cc8450bf1738b6593e27a6c9e2331beda2852c570eb95a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e152cde2dcf509e8b9fe8999c66004d

SHA1
ecce3bcf39e2a7c6aa9c28451c59256f3f3dc653

SHA256
56a6717973cd5c3e4dfce4c89cee70ff7caecbb0f7170ab2a716632af0b7ab95

SHA512
d7800016058726160d7b7374e4dcd0b8547c7c5b247b0532538b6b97a224d0a30cf8405e4b6569fe7cedbc68b6c9c0645e02a949277922f9167b3e000391cb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e42b89b44aa1e8e3603c091027ed516a

SHA1
09ef6dcbc5067c90a0781fe093d00d78588e76c3

SHA256
30ab6f496902825de89b1e5f68d08d862c135b5fe03ac4ff37980919a6bbda26

SHA512
e521cda090f6d88ef0ebf770ca716e715dee57a95065e609bd889d880e80c69a5eba8ff7c897282dffcd3579ed87fe9c3a44d4de7916f2dfa93a0ad89d1d1e76

Download Submit