47689cbfa4854b0269dcb9b0f56791f3bd8652f161078ac4bbdc435114da8e3b

Analysis

max time kernel
0s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27f9c8535c2d860bda09fbcaa9118802.html
Size

104KB
MD5

27f9c8535c2d860bda09fbcaa9118802
SHA1

6fdc23411c69fcd9f5ba77b696fafe838d0ff59b
SHA256

47689cbfa4854b0269dcb9b0f56791f3bd8652f161078ac4bbdc435114da8e3b
SHA512

14526d6fba5569ad2c7e26e1053970e9ecc0b76bf7bf7848a6b4c48617330424980a3381888cbf4614cb7b2c8c04ab24e60144fdec0d9c74e8fdfd58ce7bb0a6
SSDEEP

3072:iv1YPTvqq3SJU4onhEGNuV9dzEDY2H7sMl+6:i9YS3VIv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6BD0A41-A92B-11EE-AA09-E6B549E8BD88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3052	2360	iexplore.exe	15
PID 2360 wrote to memory of 3052	2360	iexplore.exe	15
PID 2360 wrote to memory of 3052	2360	iexplore.exe	15
PID 2360 wrote to memory of 3052	2360	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27f9c8535c2d860bda09fbcaa9118802.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

Filesize
889B

MD5
3e455215095192e1b75d379fb187298a

SHA1
b1bc968bd4f49d622aa89a81f2150152a41d829c

SHA256
ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

SHA512
54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69159a0f5d16b0dfd27cb731d7510e39

SHA1
fca5802aa1710e94218957d5c136ddd31d4306b8

SHA256
76e6cff4b19e587280bedd61a28dc60f28d9bd4bbe607ccc51e32800de443225

SHA512
14dec11b2bd188bc374c2797aedabca51af931dd11ad37fd33e230c12666d27701b9b85a2585b5dc6deae1e9192d2d6c2b8474df0b31651f9f9a551d2ee464ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a258e5cc2b1f4a83fa531afbbbaad6

SHA1
d20ce9c896e31a52c39dfead5d1908616da387f0

SHA256
10d9ec1c4b1e81c9eb2ec791fa32dcce17185c6122713e4118d6d531c6bffa2c

SHA512
eab04662efd28deb1f627fec9812ca57ba5e5c678f4001be761e14c84895c2ad52120e200ae7754940a6fa1f067e59e94979d194e4afe2927c729a98baeb24f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5b3783decb1abb9f3ff540ea88b89ce

SHA1
3bc6bce271d249ae207f0b30b005a5cfcff5d819

SHA256
b492455ebb32faeee67ca8bb7d92aa1dcc7f4e66295b78a8c3d44ac429538b21

SHA512
005399d802c59c9219da25e02607d2f96c6138844b4bd09526fa5ff4e3c2532f6c558b426f9c6873969435c1a3374b2d610662ce576488948360acddee27d083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d356646bb9f5f518a7cd23dc776e3d1c

SHA1
12f5a468433448afc1a5e5c909a97a0771cb9523

SHA256
28a040deefc5ad97d887fd9a0af82b08c225b9eacdf101f10bd704a62b75b6a9

SHA512
facb8d3647e904b5428d769c0a366aecfc7600436d0763468bd81ad4f92a6b09af8bf80c0d07b7b74c6155a39b5aa2eaae27bd6001c25259d19ded2c69ac9fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfe16a7fe75ac3c813775663a798dfe7

SHA1
7f29adcc4936724fe9d8ee821a6987e6a996e4da

SHA256
e960ef48cd4705b22a39bee238ff839226e4076260c3dfbce44af64ad2dddb35

SHA512
eb7c007cf134d1cdfb69e3d58d68b7ebf7df1b0a408aeb21a58a76cbe229453af80d16b1fea8ae9b40081d711724276240f6b3be9ccec95a9a7d401c355d27b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e6bb064f89230fe8893333ef45f95d5

SHA1
da352b7a58b5d1779b51f4bf7e95acf69197e55e

SHA256
e455b8014970526c82d202342f8cefaf53d3006ed2d1a2df9f7eeeced277bbde

SHA512
48de3c052706b61860a1f0ecb8191ed4458cfdc92c1ccd1e6a02f4ebf2395319914e5eec9c41d11ee24895e6a0bdd2c992dd60102314bfb2e8f44be282120b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afbe4ac577409152924330ce40cb90e0

SHA1
fed878528c3225b5dd83ec6f3394de6ed0095c61

SHA256
5779994fa684e6277fbfa61f09d7caac05cc31f8a9bd76c3da301136449de2db

SHA512
8d7d45e0e1c363593f0df64abaf8d65dea1b1bb943ca55546e3c9a28ff2b4fdc549dd0d7e0a6e79c8416cddf464c012d03fc90ae388b04a269370600ee48eb0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29b128e97dd530fd0fb55552128fc787

SHA1
6d6938de0fca3b507f043bde2e9fdf6a758b2b0c

SHA256
2d3f048c8a1eed9e706162e6b97ec4703f99cec5206d09df41e8fca775c2f744

SHA512
26e24bb1838031ad5576fbfc5ba9a44ff37bebd0ca34e321bac6285d3d51885cf98ddd7440f9c4f057c5e65d4bb8f4eafa27a068bf30ee699a906c417a9f89b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f52432d5a5e5a646df2388c57c343f

SHA1
5f0affd15e8e723036346a77989c288416756aab

SHA256
758215977156e650691d01e8bfacd9d52eae5b813de3680dfaffcbd13b6381fa

SHA512
02d7d5b149496b1d3298498a951d27561899927cb6c640f1aaa8ec8dc922d508407e50a9d9b98ab324f21ee2d91a02bf57fde2764c5686f8d71316bdf3481516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88a7566f6331c1720977dfc7481652e2

SHA1
c1730b3565115e39104ffb9e179503b42329b7a0

SHA256
ffd5f67d5525bb2c3c457417916c463c9fe5330dcc65ac39006c0030f1702f38

SHA512
2741a590d704be86f0c1faf6557425e89521e09d02e2cfcd1fe4e6a7a1678299f323e03f1f1803bf66e7893bf91f0a4bcdd17bb65061d73f0d65e9938c0d5bc9

Download Submit