e2b0800f8d4d016f235407516494b025cf8a82742ed7e0828e5c3e559a66e216

Analysis

max time kernel
136s
max time network
176s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39d6266bdcf48d8d10f40474f52205ce.html
Size

23KB
MD5

39d6266bdcf48d8d10f40474f52205ce
SHA1

7efbd61c4528b2da49631fe3fd4f6c2b27d92ef7
SHA256

e2b0800f8d4d016f235407516494b025cf8a82742ed7e0828e5c3e559a66e216
SHA512

dc5d5560ff116c577c6ab26994c7f1bdcc058e99a7c5b04075629784237f20755e199aafe0abb0edab9fb0d685ded5f68dbe6e3445d58bc8f303ec2aa7d6d3de
SSDEEP

192:uW7Ab5n/kZQnQjxn5Q/PnQieeNn2EHnQOkEntp1nQTbnlnQICnQt0wMB+qnYnQ7n:7Q/IE5n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BCAE681-ABFF-11EE-83C2-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410644352"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2276	2664	iexplore.exe	28
PID 2664 wrote to memory of 2276	2664	iexplore.exe	28
PID 2664 wrote to memory of 2276	2664	iexplore.exe	28
PID 2664 wrote to memory of 2276	2664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39d6266bdcf48d8d10f40474f52205ce.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8247d9e3d7eaa76f861bb5240fc38a18

SHA1
10d781cf482a757ca1dac31e925026ace5a22475

SHA256
f36f75ada0e4b8f5869af687e60aa7765edffbda2d1759d8b827a072c448b17e

SHA512
e97450254b3ab471348b7fdc66fc7d176cc39706885eb8cd30ebd0e5f250902335ccda5b979fe81537bbf0ff3b8063c5fc8a77114adf066529cbeb90fa8163a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c386fff9625b2fb42efcb3c5dc8ac9

SHA1
615204bc8851ffa896d3552bad94c5f645f01b20

SHA256
3191c6aab8c7161c503fc97cec9e59693383b22409045a43b4319749d1183476

SHA512
c97b681a084c7dae0ffda65012779d7c0ad373b20496ff083c63801d095f0032f6e6ac92baf0cc5032c2ae700c8dcb53b2877d95962fe66447115772bda2d05c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32611c2acae79e27fcdbcefe58fafbf8

SHA1
445ab27286195c3b3e3d4c1b165aac35afbf94fb

SHA256
c761eed3dcfcb4a686c6b35469d799df861afd902cf4d18348a240b05bf1479f

SHA512
3f6c6d844c364c61a21ffe296278b03aaf2e2921933d6f0f6eab0aa28ab9526e6a67e4454ccc45d8e5f6520be1a3b78733624fe75dede6298f2305939e2c217d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e026934ba9595ce9a0dc0fd322da4ad1

SHA1
c9ccda405c92e02b94f6a80b7e8bbc4c3a60c4ff

SHA256
55284ea91dead3befde58f6ee4195c5d7792184262f5dc8cada8b33e172dcfd3

SHA512
51073bd090b188df625e88ee1d458e2dbd64b678f362a7ec393ed24444a29c2a4ca25de12cb185e06f40ff1a507669a284359de88c8c9c1f2a528c74e58dd29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0128da2970408e23e8f0f496a38f7558

SHA1
91e8d33465e5f82949f40a287534db209462006d

SHA256
3f9d73dd4f392e14e70511249de2882f597c6a47cbe5c7b1ee932233263ab2fd

SHA512
12e604c74edeeda2205b41ac1fa1890112e49ff17ab389e4e9f748332e24c99496e5df5d5fbb3e28be85579b31959d8ac690a96e165306342396b2da91e7be24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8facd8c12a6733d2c59690a88e2b29d7

SHA1
6027b19c18228d143d9411b30c5f6ee7e7040135

SHA256
5f06160de711704a17923f47728377c4d9cc6b0c34a74733d559e03cd1196fcb

SHA512
ba9c1db522958f1ff941454f4d1a256627ba907654d84335335109612d4ba6aec8ffb6b39b7736228762c5851e5389c4518ca00fa7a05d305619db7ef027e199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d7e69eccff38e058cd5377bc5b7e93

SHA1
ba810372552f8dfd0fba37c7042065248b3346e3

SHA256
de74f41279d956823a595d832c4902b5dc61cd22ccf131b438ddf65cf3f0521d

SHA512
58786270236f3b2d491e2795156de667e3fb2d47adb2b5043730a9436ec642e1de7b4d1798b22feb893a5b55877bfefaa7f80c29989129392c4256fa01fdf5bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bcec2d91136357830e61e187504279a

SHA1
1e0533ce2229b4dffb0ceea07a523bc826652261

SHA256
42db346889302191c8357329ddd1ff1683718c3853c517adf975e954ed3bd0de

SHA512
59800bc1abd4b1c882f98ca82b8a9d2e74432d4ad133af02384addf9920f6d051219e47cda76a333c335c44ead72d05b7aca05c2bb0881f4460d10155e887b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e58b3da558191a0106e999f7e270c81f

SHA1
b649b3dbac827186c683b3322ec44859336e22f1

SHA256
f365861ead7c2711144450ef4b890fe6d9ed99e118804c064849851bc6b261a6

SHA512
92a11a183f77146fc5ba288da10166dd08bd3f79311e7c923acbb0ed20f2f371fcfed200954059c76cb9a76ffea77e4c88a27c1b40dfeaa6995cd75e8b53b28d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC65.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD33.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit