ceae73c424147cdc1b2faea05d0b8645a65d72aa68073bd42b625968168863c3

Analysis

max time kernel
132s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a45f15820c32f7cd70bf71e33ef98fb.html
Size

45KB
MD5

2a45f15820c32f7cd70bf71e33ef98fb
SHA1

0fb306b384807f60ec960a571ae0fee71045818b
SHA256

ceae73c424147cdc1b2faea05d0b8645a65d72aa68073bd42b625968168863c3
SHA512

f71f647b426fe858aba415ed1f2977f3864e9f8acd6940d196f122ce002ea1b737e6602b5c38b17a601ae0f054eae47cdb990c295e3e913f25d3b8653744a52e
SSDEEP

768:RVGJ7+fDsb7KPJEtVI4OKO8RrUbM80DmOz3P+:RVGJ7+fDuKPJEbU8RrkMtDmOz/+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E5B9FE1-A949-11EE-AA51-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410346078"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1928	2320	iexplore.exe	28
PID 2320 wrote to memory of 1928	2320	iexplore.exe	28
PID 2320 wrote to memory of 1928	2320	iexplore.exe	28
PID 2320 wrote to memory of 1928	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a45f15820c32f7cd70bf71e33ef98fb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33

Filesize
472B

MD5
3da301bebfc91bc17293860847ab380a

SHA1
642cbe49e91a191ed8a6e16d5dcca250e28b6f6a

SHA256
33b52377803e57e80cb1f8c91a636acc60de3cc76cbfb39fa4344c144be17d54

SHA512
5aa0202856066deba89f096310e2198b06daba299bf597f5bf9f864ad963ca6ca038f4c2fb8cb41af92dc5ed4b6e87c866d1f9263caa64a09ca3c75b152904ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ef0d4089ce78a0be2fc54779a54c5539

SHA1
ab68149523aa01374747dee0a34271f6cd0d2658

SHA256
d1664ab048e0fc9608f9a83502a180413c500dfa307d28453634e6bce1ddfb4e

SHA512
8036b84c4b65639dc834994adaf5b9deb6de9432e9bbac2163edb3bbcf8e5de139d739c61550fced9183539c4a7d13783b3ba581f8a151a846e6943d8d4aca26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40fce45899e0869d8efddb2b69087edd

SHA1
c5144a074a09605dd9b3ef8f187fce886d0c9bc4

SHA256
a724e6cc262214ce406cd65a02daab91c735d373377c063f7a99ddafad4d60e7

SHA512
e8ed5f267ae1f9b3b43a176238b52fd0dc2a2512476543d31f3f1d11d3b14a4b5420b903071f760716e9605d152d114d912a84737ecb1b6f5ce58d824f9754d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a5906b84777850b7e8698db44ba126b

SHA1
c7b48fe0a1468f7301b54587bda4fa52260e25b6

SHA256
c95d5dd964d9e17f0cb116d9e0751bd6e14a32e828a513d106246318d2db4601

SHA512
a0fb8cd4cf36348396e08be4f91fa23dde1c1a0af2450d161adf67371eb3d36e41cba24f51b083ffa90bbd9418060478fc803fbacebeb0108ea0e13f028401c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5975ba58551bc9ccdf4e482d1556c517

SHA1
8dceddfd2b880bdc09a487af61b734a0bf94f39c

SHA256
f04c048390f045316f6957f447db0a1d380dcce08d4b4135d373020b73fb2d35

SHA512
b05ad8e46195439d86a8564dc18154a975dde65200c5a17052af9f98644a6d434e4df2f0c8ae7f99b9e5b5459664a1989e9c54569b5a74afb037bbad6d9fbda6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb704a0406c9762cbf1f200021689711

SHA1
efd750f5436cba6007e520ca4db42baaf22a2ece

SHA256
980fcca73c9d26ee15b36044286d31927a488ba0cf585cd791aee0b05d215d83

SHA512
85177675c08ab13ce5bb8429d835a46b1c047d2d6b451eb27067825b6a23606f84da1bd17ad6d1e4a1bec6b68e775c6cea335ae61640f8a04c49f51d61032a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4598.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46E3.tmp

Filesize
91KB

MD5
44384ac4c0d7007ef04317a20cce7a39

SHA1
0402f8d38de81f8587fd63ba15712e9148c80cc6

SHA256
e55ccd62ee91304ddc5762ab05cd25fb1a12748ecd019f9ba791304fac45cc17

SHA512
f81455803ba962a0a60fd65eb15376499df0d82cecd9a49f46e2577e87a56b11c9f91acaebb2221ff8ac8a34778cf9bc9bbc4ceecf9d9c7370334e16a13ffd13

Download Submit