f5df5e4978e16ef8338e9630095d2807a31edd5c1f98352065c3e3070cdd54fe

Analysis

max time kernel
13s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b9bdc2adbb61a517c2b7c70d2136693.html
Size

895B
MD5

3b9bdc2adbb61a517c2b7c70d2136693
SHA1

984796b18ec7cb0a2a5c3bfd262d586522ef77c5
SHA256

f5df5e4978e16ef8338e9630095d2807a31edd5c1f98352065c3e3070cdd54fe
SHA512

b292b63517391c2ecb9b516cfc9e7dbfc972257d0fb29a3da6a1222b7d7c8f90764910e25bd3f26060f9fe0907b5742dc0e45177beccfd5ca5f5613869930671

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D244051-B016-11EE-B432-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b9bdc2adbb61a517c2b7c70d2136693.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9bba55e51d3166eab3d7c60289918d2

SHA1
7bbe6ffdf7413509f35913489c1399d9c351adf4

SHA256
6a68dc0826c0b7e2f98dab5ff27ffa04c6e356ae9bb95b1f50dd6aaf9c4b3c67

SHA512
bd074a776c8ab0bbc65998ea9e3097e208b6abd20ba761c62a8f040af4d493562501072b7945cc6320cf7fab85f989b5e0e209250deaee2005a2d7178885fcd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaf5335a8dc8d668d718a8a2ed49605b

SHA1
9725f49acd945824b47bc33acc3de04cfa911dd0

SHA256
d5cf85fce52ac2d34f5d611d3dcccd31bdd55fbc9454f2bcf799e6deb5a0a1db

SHA512
76c3dca62a38559736895cf06090355df420c0abd465d9455513190b5ec87ddd921ddbbe886785595bedc245907283eeee3150ed24057f63d82139bf8effe68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7042830616c683aab50c31e00cd42c7

SHA1
2074c56da8a5f4cb9fce6fe89b9d33de98b6e506

SHA256
c544dff36d949999ec348119c39a0ba52dbb1a3858fd0d104f944cbbc6191897

SHA512
50410520ec1612b1e2e03bd8a784d527bff0ce0b9c82aebdd2aeac832bfaedc8584ceee31b7453b041f745ac52218e02bcd0a3195b8b53f6cb568ea6f9103421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fb7577e5c6d66da63707b346852ce1b

SHA1
df56167ec16c51010fc72520277bb1d88b050f74

SHA256
f5dac6ecb3fc230d859903a346ec1361612b5a7f096222c6b15f30083452e0b3

SHA512
724bfdc264f46d5e8d778f49266f52c258ba7f68d2d051ca7e4c3da2524d401aa11af79ddefcd895c3f97bd041b136c1b43298b4c9c55e556b4473ace81a0581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38bb474be8c99d79cb62702c0434ab4d

SHA1
58f418d003eeb19b846982a80546a503a374b02a

SHA256
e48c1dc8e5ff1b4bc0f6aaa434abe4c3cb1a9897e2bf92dbaa12ea028e4f19a8

SHA512
b742be28c92549fc86dcebbb032f8034ea7767582c1e4147b8f290f4d9b0e1c64a9884d39b87a5688008991ae9d4454c05ed30979ba9c3b7e4c1ed21b1e99f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99eb563dd5e9e5f5a8e36b158d9adf16

SHA1
f785359d166a1c2538b93669ca3a6a30bcdef6d1

SHA256
bf95c6b81c8e53831d373c97cd6417b40aa3cc9eebd626a1e4e115e0b243a67d

SHA512
6e55873498dcca8a10ace06d142d857c84ab94c5f997b8ae2ab5a4b0fa8f54a2b4b7c0b8e570c76bfa2c144182f32e151cd1fcb2a24d4029008d80d382ffb38d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8da16eafa3b84e201ea8fe0906d5ad2

SHA1
9e4065b4b133fd93122feebcad520e58e1428552

SHA256
01159de86a05412f385acc2087a95e27ae182fedb82143883a4bbe94b13240f3

SHA512
cc0408b44af7a49beaa159e76277ebcc41a986b03d265f9a3d257afe8f4cdff6744b4b390113f1910ffed8ac0c219b2b18b50fc9a00aad6ad895330feca02f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B81.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit