196552dec8b607194403501a2342e545b6ca270be87abc871caad11a058329d5

Analysis

max time kernel
122s
max time network
201s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b48b16a472c52353907fdcae42b2cc8.html
Size

1KB
MD5

2b48b16a472c52353907fdcae42b2cc8
SHA1

1636e4ad1a875584be4f11cd33b261ca4fa2f480
SHA256

196552dec8b607194403501a2342e545b6ca270be87abc871caad11a058329d5
SHA512

b2ef91df6ba0c15f11ea1664e45f0e1ff457226a46739e76acc9b7c0eea01b02ed55d2afc043afb13f6046f3754cad5a821c7887ef527f50895d2d025b8ff281

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D8E4AC1-A956-11EE-B735-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410351773"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2612	2632	iexplore.exe	30
PID 2632 wrote to memory of 2612	2632	iexplore.exe	30
PID 2632 wrote to memory of 2612	2632	iexplore.exe	30
PID 2632 wrote to memory of 2612	2632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b48b16a472c52353907fdcae42b2cc8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ad1827f74d79bed2038b5861f1123a8

SHA1
6c8435c5497316ce95370891e2bb8bde79cd4bea

SHA256
cc510f75f50649fdffaa20a81685ab99f9cb0c88ad3012e2d4bd121de1174fd6

SHA512
e25f04c2a6725f32de17eed94b92ed8740e461fac3a121f836c465eb99aa9de8f741dbc6c0d4e6faedb6e6a2c219821654063608861dcdb1b56af8984d6fc5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
511b2eef67bcc10d713ed29e3443dc00

SHA1
dd393dfd1642fdc7f471d57ab10855c85fdd8752

SHA256
7e1acd01d77b3caee85b65416ed8ad9c86cd08924609d61c481330fee1ddbba3

SHA512
63b55787f9837bd88501afd94a4f23910d4367e7e8f8b38d0bac0b659586098f0ea4b3666f5181aa09806279d05f2e0c46c1a30b343b31aa2271b1e5251cc80f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac605c848ab4daf482e137548d5ca585

SHA1
d0351591f942e6b391ca6c0151b8feaf707b81b1

SHA256
6cd7bde12492b6401551a18b5978d598695001e63997ecdc6a7ebdadc53e35ee

SHA512
85f2fef3ac74c6b9cb04611d6c6bf3737107fce10a7082d9312f3c27d076a94619745909ebaf3973b5efbd84cfca6599177b10a8428a4186cfb0c4230c085813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c2b50b6269ac13dfcbbf1486314b1c0

SHA1
9d1de27b0722c833152937c276122df4039355ec

SHA256
c1e5b24c7d67e48305a3a2b58d954a40ed299123b747dc3424621d1b0e1e7a55

SHA512
aa575769f0fe7dc6f5a74e75a48a7fb81f221610d386e816e11195da9c60d1f037e47a43688370e1dbdb05dc23c0f909785e548dca40402e35f54b834a07af8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd55042535c7fdfc1ca6c54631d6e70

SHA1
75275f1c81da1668f8562e46d0c5322ca0730b48

SHA256
4422c15cad6303345835d30889941a5b8125d49cd2bb72e909c7085821ee8ae7

SHA512
e42fd21cae1d73537a70b2689b4b08615aa8ad2308c3bfd7e82f3cab2b3c7aabb2e8b8abfa832714d6b77ddbafadac6a768ec1a8338978f21f76fe8d1cf145d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a033f5055f6c1850dad8bd4905f8c25

SHA1
56da6abc8a69dc96860b7dd39a4e51ecf624438a

SHA256
77d1d1016c7053800acf73ff7959b1b41dec8b14b8bc93fcbf554102e156e31d

SHA512
0ec435d0be0a079397a3ee7cc98ddb62fccc2993807b2abaacca522774a1be89ab4bfb3d63c5746350104ccc71ba705445fba4d1515b87d31e4f68a4b7c97910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09ffaba64e1877f3668949b2ea935886

SHA1
c55c5fefef5bad0e14a67a048f1ab13279d267b8

SHA256
ba43f6901314b458c610ef0942475f785c3965a0230c1296bcfd44a8a5a05f58

SHA512
6e983d916ed14078c29c99d5afa38dc7ab815e5bf6e3f169e7df40552e34b1b6581a7b91259fdaa0cd33f891eea166f11f9b0ad7af1ac485e5030abf68acd6a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f08a246eae537bc62e9b74ada1ca9904

SHA1
3ca7a1af2fefcf59616ef23ff7e219e77468c803

SHA256
e29967d133a39e3c1dae0dd0126d1a33f0600a99a85e833d2df304d75b8c1ff8

SHA512
16cc1fa1d40e27bc95bd88b218cb44be517c49d3358dc255c6211509f783303b118b98d1b80656860c2ad9a61fd0baedfa99eb5906245bc0dad5eeb56573a7ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
180045eb6b31c4225c947bb7dff3e7c9

SHA1
33739a8e4619805952576144afbd4337883a62af

SHA256
55ab96b4c379255046b8e0cfedd26caea0f867d2f6aa0f11d6e97bb73bde5ed4

SHA512
11623684d02ae834678d24e61d5156876dbc498b983f43f626e86cd900a81a24edc739c1825d96713513f63a8f5029c36976f5bf2c9bdfeba32ce8f3c70c21e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E03.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42C0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit