522620d85b9e3118f67887ddf661d3ca14b850bf4fe1b7b124e3ed110eb7aab1

Analysis

max time kernel
119s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29038f7db4579b53537b7614ebdbbd90.html
Size

7KB
MD5

29038f7db4579b53537b7614ebdbbd90
SHA1

8867289bce3e5ecbf6eb4748753b02e001137ee5
SHA256

522620d85b9e3118f67887ddf661d3ca14b850bf4fe1b7b124e3ed110eb7aab1
SHA512

c4a84c105b1abc2c1c0b3b8b83384e619e369e7123af2d61088141ab2ba1e46a5fb7200b983ad56901a854cdb8f3d7b3362a432d06dade5b5f43ecc971622e34
SSDEEP

192:dWz8P5sYNnNYkzT7jq2ZEYcctbcVvc83lbXqDb+5E:VDq2ZfncVs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC207E81-ABD7-11EE-8CF2-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000dcc8336e3dca44030568329e06049c47599caae7debecec96ae5662e88daf9a8000000000e80000000020000200000006aa6df67abcbfe1d547c4fedbb9d7ea1ebf4dc8206b8bf53d1a7d62487bf3369900000005645c1945a1ca614fcdaa4505f378b1b9701fea23fb41295764857176e7ffeb7b75c1ac9c6851a08513ae52b31d7e9dcebbaec0c88ba740fa0d1f42a10908201895291fa0c4553702c8e672a98eeaa6ad3f00e1813b177889c3867b885e0220fe1a030af90e1a3f3b9fe3f8de764736c23e2f71da2b7e294ba364847ff46476946feb04e9395e2195ab09adf0c2c424640000000031bccef20faf50aa941df1ed202adea7541e37a64a0c8a71f16ccc4a30213573e22d842dee2f268ba9995804e624d30b6f5dfd2c544a15fab617128e59b7953	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410627267"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001171bd73acdf6df71787d60c36c46b8209c32a6c19830011d9c792fbe665d4a2000000000e800000000200002000000025ac148b69e65ab3886ed0125881303740e7487444d74d99923f5d4a79db831b2000000036a93da4eae2a83d59e6b271ba11d56df47cd15d81284f3e2f178e3e203b60d540000000ca13f5b580725b459a1bbfe6ad7f25bfd8f4faa91e6dfe8a72ef0aa93d645191ea41b2ad1703c91a5f3ce70c6de5fd5a200accda9e9521c80f79dad2b343a199	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1065f3a0e43fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1512	iexplore.exe
1512	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2724	1512	iexplore.exe	16
PID 1512 wrote to memory of 2724	1512	iexplore.exe	16
PID 1512 wrote to memory of 2724	1512	iexplore.exe	16
PID 1512 wrote to memory of 2724	1512	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29038f7db4579b53537b7614ebdbbd90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42883638f5d0edf4202cf6f2ba4f80ac

SHA1
6f0ea7bb89cc70089de3109407a008866456a229

SHA256
e025956f44ec34041bcdd47b0de7d9443ca089b3048a6465a1badbd14af6c7d9

SHA512
978876d0e530a6bc77963f2d7ccdbc7b95b1f28245de43a76a4fe575189a06839ab0d9f91f2d0061b4ea55d25ca8cb495a60e3d7cbefaf30f15d640509708892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af1f43f7380f512d16972a40c678e9e0

SHA1
a5fdb6a58eb2bd670de84e5b57bb631d964f71c8

SHA256
31f8d3f049841e24e0b27f2ef1c63a535381cb80dc81623bd3aefcf51cd3d614

SHA512
a1c9a0d1445b9c3c5aa43af1f6fc049569e4108c07e30e28002b57920c837390463600b1e8c1c46d092e7d98a900da852f0eba8df6f8e23175e936844695e928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
510f4f4ca8b21e40a8c28e73050adbad

SHA1
981d46aa4a3459bb08e54b5b51c53c6d76fa2335

SHA256
d1730e2a4c223398cc71373fb2cd6e797ee5534ec850748eccea6be426adb10d

SHA512
a14a8de7d1f0edb272afe058ffafc6f039bf1fa71f2666076d63dba597b2580e0a796fe7286bfff9d33c35fca64bce8d4ebf5ba86d94df9430648fe8a68cece6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
079967b337d1b86ea845df785c179c66

SHA1
461a64dab9c461fe46e4402e063b0cd1c4311829

SHA256
59e2147a88c9ed9e8030d12537c882fbe9273c47f85430e899ce1c825fb03ba9

SHA512
df8cd5299c5cee7fcb41e6f635e785726437638844d1229983816ecefa9bb1542040ca54b3c20b87ad51f831f81a56f1c3f77fd10d953d5d2bcd21035aa09aa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f04594310ff86b198a5f131c1a2915fa

SHA1
e8e37e13b38ef4fa1ed9fa2c62a218cdd3ed16a6

SHA256
f27631e49ee9aaaed60186ab885134c1cbb8f662c352f6350d6e62cbeb4d8a96

SHA512
aaadeda10fb679ed1e8b296a7f3fb4247d928119988e8d0ddfff63d9156c55f7a79b86eec00bfa802b7af5526dad67de39587c7e6c57c658b9c3ca944d9cf869

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab933D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA653.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit