d7c080b124bf1f567f820e1c7be93d3757cc789f18d206b3aa96f4e0b31606d5

Analysis

max time kernel
164s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b3f918640df78e6269ce192737b90cf.html
Size

117KB
MD5

2b3f918640df78e6269ce192737b90cf
SHA1

34935f6b117ee312ebe1a3a341ce1f558677839b
SHA256

d7c080b124bf1f567f820e1c7be93d3757cc789f18d206b3aa96f4e0b31606d5
SHA512

839edf38faff374bd49ceaf811b3eef298924be1472eb16cece22182dfa00986436f0b13ac8a58d1bbfab06d7f7ed8628b7d61b7724ac867030026bc1c265878
SSDEEP

3072:j/dpt5x6eCLwkuE2MUcjvG8rMw57/4bcwLxVEe:j/dpt5x6eCLwkuE2kI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000009ce4b5b30f6944a1f6d5cacc1ac19f7bbf726889a9296a05b31c7cf6f99564c9000000000e80000000020000200000007e34d444154dc95f54688399a2a61a3ced12d5a72716b49e6caac2d94e37081b200000008ab99996950e152b31e0832d6f6146d162d2eab880607ebfd81ac95dfcc5a45e4000000095c836aa4a5f9d72805166ca99db121169a6c9604a0fe3ead6ec4c87278d1dcaebff4bdd1b64a2ec0e338666621d02b3c6097d7da49b0704c37b3d6b99419322	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ffe2150d5d592974d01834e50ca7dc735d8067f864455cd5ccb2f30159de622f000000000e800000000200002000000090fadcad6e42f492cf91f87e51d7af7284f3bbccdebac20d2bc2387c36d24bcf90000000abca6d4b24151cbbc92f2ab384ffb8fe3bdcdecce4a2ff22258e954b394befe3f9ae3ac09afe362dc701a07b35ca6237f0b089f14dd0425386835ff88af501897865d4e33a94d9f9e1265e895fbfab32d9144574b4273bbaaf0febcbb11a8a1469534a137afee219ae95eb47c26ce1b64097e9a0dc7a364a476360566e798a048773b49a8a62722e75a0ab4cca17163d40000000b878a1508d3135b8edaf9eea0d34b37b7e8b6894ec41c6e4c3280ecd09a5af252739a2d7f5c3db42a06ea83c9b60554905406621bb9aa39a4b0ca11de014d3ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCDFBD71-A955-11EE-9776-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508a26ab623dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410351501"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2472	iexplore.exe
2472	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2124	2472	iexplore.exe	18
PID 2472 wrote to memory of 2124	2472	iexplore.exe	18
PID 2472 wrote to memory of 2124	2472	iexplore.exe	18
PID 2472 wrote to memory of 2124	2472	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b3f918640df78e6269ce192737b90cf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7e5c858697cbc326048ec6892a4575f

SHA1
20a8108a6035cee55bcf30fc3ae8f79b0817fdd0

SHA256
7718b2a229b246ac31c8b659072e3a39d8be66df10e6db5d4f6de7a541df3691

SHA512
c505ed84577efa36247914f23e766af6c4c8c95f097d725c9a5bcb6fe7b9fd78ae339d6495e4713be90bf58d7b63875d7fac20d2f5586a55a462484a351b792a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d70a4ba04bb88c90f290d2e1020a3d

SHA1
0c62e09e206b28500eb2ac2c0c689543d28cd608

SHA256
bd0c550040bea841e94aa909c887e34059771359125321a556b490554d2a5d55

SHA512
4fa42431c28dd83593289f030fee7dc43e190a6544fb1b749aa5b76f63b7da7b600e6c788b16b7a035fb24857a9f9d9a408339805a1b74bb12918c189cd80397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
919e86f568b6b102a8c95a863bc5a767

SHA1
cdbd99fc0e2e2067e48d055a392a31592a8a7ee5

SHA256
281443a2ba5bf1fb98a89a81398939edea9c604fac5327a351af003be06d950a

SHA512
c08d7e3bb6dccd30d7c463ccc44660b6a4cab834e6d8af953be74f6c566b6f9bf31c933e082d2c4b0626bf0066f7303392c43c44e0315a29e5f8e4224c94c687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
137dab07af445cf25115931ff2653ca4

SHA1
a75db70f1d1bd2016c31bc2b29829c11a11ae3a2

SHA256
29888d2deaeef9f1919e2947e208f79a9b1cf8a46548c163fd2dfdd41b38a7c9

SHA512
0c949a53e4313b41214d165ebfec5a78eddbf8545de98023086d2dfcc0c1201add42e5a235c5e47b4106b379284b18689a6eb42eb28efd76cb8992cdb8cdc834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cbf5f83349258ae1335a9e7ea3e35ac

SHA1
78dd8ba370f70255f0f767984c3f3df66c35997e

SHA256
1a41e810a8e3f69f3078282d82c6b2d47276284bd8ce65488658e7a0feb387e6

SHA512
f3888f93cfe05bd16f8b6311ba91b996729b54f4b0e4b1c83d7a330aefd322a633585825852294be90f829fba748b7c9a3a3c4ee5d8b9361560ae54ff42d36cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a4603213414871f37c26353af8d9306

SHA1
307317c7072fa9a7156772f16ca9ea897dab4389

SHA256
b676e51722fc28bd48b73d8af4d3d418f75438bbe33877287f080facbc81304f

SHA512
975e14322458e95faaf789474a912613db8d3e74843e2504e735f6eedc322917c2d115e7e405ded2ccf4805254faf4ebbc9ac340a23544b612d5f834a3061e24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc3aa766559d7ce5cf9ebf17bd9a3a83

SHA1
758094bd15190c8b40083cbe41913197cf5c6df2

SHA256
e2e64813cf307026a33b36bec2404a9a4e8c614c025041ffeff7c12219d749f0

SHA512
d07d3a2c3d19520667daceee84ebccb7945ca596253de574da2aa9598e95dcb9ce4a2b89223088579edccbeb6e19d58dcebc32f0248fc5deacd017a4898fe704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\cb=gapi[2].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit