685dfc241777f7ee5ddddb1edfce9e052f5d680d1ecb53933b9e293d2da209b3

Analysis

max time kernel
125s
max time network
198s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a7c4bda93aa0f2ad889632c9d462d66.html
Size

6KB
MD5

2a7c4bda93aa0f2ad889632c9d462d66
SHA1

ddaa0d66cfe34a81ce2dc155d2721bbe63770218
SHA256

685dfc241777f7ee5ddddb1edfce9e052f5d680d1ecb53933b9e293d2da209b3
SHA512

5fbad85298b2819c4b171f78b13bbbca81f11e88e109d5cb0bd1f9db03aea639f120e756b4b35472d76c4e43c4d5d6d8755241f8e206edb2e8013596af1f4510
SSDEEP

192:0XRlx7wJ/HIeC/aTbg+saLm9vu59lspLHa:2G/C/afQaa9vu59l4Ha

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F85D07B1-ABEC-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410636348"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2676	iexplore.exe
2676	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2552	2676	iexplore.exe	30
PID 2676 wrote to memory of 2552	2676	iexplore.exe	30
PID 2676 wrote to memory of 2552	2676	iexplore.exe	30
PID 2676 wrote to memory of 2552	2676	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a7c4bda93aa0f2ad889632c9d462d66.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b2c5e44f1b8e126900886d631c0add2

SHA1
571ebc1a6e0480da250aef441f5900d38eaeb582

SHA256
15a96aaf76157983c609d4917e85f4986cc853400704739cdd9a7f48f13a0adc

SHA512
aa69043c2a13862b21232b1824dd55f68f9391ed46f944cadc8063ccb3ec6ca31fd06e0b46c84abd66bda821bd5fdffaa008058c0fff541e0a0c74b42c491dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
774a75ab6711b2b117a3a45f0478f853

SHA1
2f8bdba02422e8d377b29a84ff5ba84a1948cd8c

SHA256
7b09239e46d4aceefb8e1c01032cb80283a14db7d9d49ec1cba0bf5fe2dab0fb

SHA512
0bd61302a1c2368581d2d308a05ebaf2d2b516a2ef7674dda56768d1524369f2c98392dedd29fce88bea22db0e80a2134bf771ea0cf4158537ebe2634417267b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e1eabc88be1d6acb15121dd7c85601a

SHA1
92b64a98e9d6956346258eaac0dfeb5dd24c80ec

SHA256
662748da042fb03ab1d843b08681e147c9c91d8abf1e5870fe8ac2a5e9dc6bef

SHA512
e77169c71615c8978a85abee2ec03b4a3a115a167b4619ae072a65a933f8a2620986577e14bc626331421fbc8319b1618638332e0634733df4673df9b0aa14b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b084651ea2f2693a905a9201ed3367

SHA1
39f4b3be0c7dd621c23e6988b23db1830dfdaad0

SHA256
3f689d5cbfd5d0726c636a6b1182bbe924e3b7ac1063d4031d91f4b94e583403

SHA512
f7154ae8d04bbcbca66c04ff939abe9a463e1159a8963d5fbc3c3a1043fa883891b5ee7936cd27670ec9d4faadc36cd40ed38d3f410c03dee0b824a191021d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c210dd9b9c452d1266b07450708ebe47

SHA1
c0bb6e0d973fdd3a6dad4229cae1d8eb0d16f649

SHA256
ae11582729aa8422ebbcdb3c9e355bfb63ff1ae8fc5447defc716f89b3ed8d82

SHA512
2a16898fa231a3bcc250de726717ffd71d44073c0348ccdcaf257be4324284c0f9cbe36ffb0e7d154d59415998c3fff7bd9765795ef01b224046cee087a26fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1494eccbfc33e3022b43b527d268fb9

SHA1
ad543b0f17ca72448b7960c36c8c3bfc8fee9cee

SHA256
6ce45e42454e65c59fe89937359591b9c91c37573ad71913054785be013e4dad

SHA512
4ab2828860a03398541961ecf333c0b34b0861433146ad2cdb5dbf5e82297e2461c4a04357ded9eb3a3829edaf9f24362da3512fff6a43376238000442404ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7718e29eb546df3f13846927d25ed40

SHA1
6423107fb3e2824a66b2250511e91dbd4640ace9

SHA256
b0403be8feac168bef425326bf2d4aaa882a08adacaeff7de33e7cc85ab05a85

SHA512
3d71d63fc8614fbab54745d856002516216b69f1200d847c0c0caf08ec0b0fbfe7fae508cebbcd56bddef91d3abd556cc347c9f18c659973e815d56e542f17b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5adc1257251e3d20195f363139f3e6fa

SHA1
1921548ddd5da6298f917f01c50cea7dbc4136c6

SHA256
c70b078fb10f0a017e7aa56ffb37fe1f8061e5f8a4393a860bf8ac4b589ca72e

SHA512
9dda979edd67ae6748fc76ed441a01c978389251db387d736aa2a9c0a9ae42855d1a87492f210b0e2344d31795f8b7424c1c1adf983aa74b2597139034574707

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit