f167b2ee20939b39d43cf0389b21195ac20aeb73bd14f972ec7ce663f33c8f94

Analysis

max time kernel
133s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

661575caac5037ab12a1bd812facf19e.html
Size

14KB
MD5

661575caac5037ab12a1bd812facf19e
SHA1

8540d1c5e9d01bbe10145f6ebdf1c29ef2db086a
SHA256

f167b2ee20939b39d43cf0389b21195ac20aeb73bd14f972ec7ce663f33c8f94
SHA512

3a1f1cdcd8fa9f0ee829ec77f19ed490986dceefbf85164c8e7bbb4c4e05b17a141588acd3248f3653d53beafdee34f0d2504a6403ff4699b77e838228c126e7
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vgmlKt6DvE:aioWD/ZmXg8SZQtmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BF58CC1-B649-11EE-A7EB-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000df0c26374e5e569c89ddb93aacbb22f028400a827e4f4040e28d791c979958b1000000000e8000000002000020000000a421c3a3d66c0f83bf7922313cbc7239492979196cb892f1dba0a660e55728de200000001b0e9199c659d410778a2da00a838d6034b9af41b701d91599b93daf927fdfdb400000001637f7925897cce237da5db78c557c45a74b3276e8ec6be4045674dcb7bcccf799ca7f783ef7812b56b82707aaefad859929e5d09b9cbfadb036d09f36412071	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ad2d11564ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411775485"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000088e9e02591979bd25793fb91bc92f82570cbffaf7c31579413c3289f703179d0000000000e80000000020000200000004d1473acdc82ac8fffec9517b4e52c50770424f3881e26ef14578001502c97f9900000005c4768795a41120ae414c54986bf6354eb57d5d91b79f4b0751143cf547dbbdb789b106a931fb418baa3f629c961ea07072db891290131ce1e885a53060f1722168ad09211fbfddf2df08ab1d6975795e3258e4cd0d2c4bd17036c6aaa680c0c88ee2d3d63d37c0250065e2f3657e0afcda87cdc1231a570ab7c17e1d1dd263210968eb1dbb0579be181c0d66b940b604000000082f9ced8c9ef090aa7f1438bb3e11030d180f7615fd0214450685ad438de7899eb56a37e9aef3a7d61d7fc913741c8377b85817413c5be310f058a29c9e74dc9	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1436	iexplore.exe
1436	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2408	1436	iexplore.exe	28
PID 1436 wrote to memory of 2408	1436	iexplore.exe	28
PID 1436 wrote to memory of 2408	1436	iexplore.exe	28
PID 1436 wrote to memory of 2408	1436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\661575caac5037ab12a1bd812facf19e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5907737f27452f6af07c6df1cc1406e9

SHA1
65f011fc5267d0e8b94b7d02efb608e2fe98bcc4

SHA256
139d0e44526c6f4fa1495c44ee40cc963196b3dfab35659df8e83eca1947ff3d

SHA512
00416086d56a21321b0ecf819558eb278ea8e16698ab360387c39e9765ea533fd49084de6f5f7c5a7a6ffeccd0672ec9a0ede41d545d6c8f423b341827edda6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8697264c154a5fcc8e8a9f922a72ba

SHA1
3438530218266f57c184e18a84a321749c084ed9

SHA256
e73b0eb8cd29e62af66e5c69fe4c15d27b2dd73f45451f7ac1049b4c1e03ee7c

SHA512
87ecd89afe6d134fe4be63413af7daac545f0f0d91b480ea3e86d02ecfcba650822b07e23c99a741e453e2c78a8e44f7c6d7397863b4d01cdf07729d7c23415f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86823e8420d80c2e287acde721b4d2f0

SHA1
9a6f36706e25b57530a5149da3502dc95aad836a

SHA256
5fa94c06eb5d4ae3982bf64f217f7b13dc182a55fc8094701b64028a8c4c6f7f

SHA512
f7932b065a374d744ff532fbf228915217fca582a428f35caaac3234b3b0a2730542246b174b434a17556da2ea60763662a3fba0e1488f127b3e2f84cd646bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c080a6a2a4da7b1d70185bf0f1fcdee

SHA1
a0d36e42774193d2610a1b524879f8a90af56e35

SHA256
90cff074db0c46d4821e3c1549e78e0f841e85939582ebf0dd22136b6ac8fb6f

SHA512
f92df3048209698d46d5746039333bfee16e5f7e05442aba75ab0378df0137ad118b7ba14a51ca2a0d817fcd10672278d9e2d4b7c88d0af8a2431a22d79b01b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00d71c45bcc928f7d114178e7d211d7b

SHA1
0b71d0085bbe4801b9b8a69a54911ac727f1f8a5

SHA256
1ccc25f659c7a32bb3e8ca12ec89ecb6decf93f2de75673ab351faa7c50bbf59

SHA512
3d1e07b34c85abc8ac624fa9b89f2f3dec8c6a92557dd992fd6d04ed686b454aabbfd8225e0339a89023aa8fdd75da8159e5e9ee78c6de824571a22303669fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64947e70897dd94bb93f3ede7b425ca9

SHA1
b47ffea3aea9c19ad525eede943ab398c3852c87

SHA256
70f8774372f7ec0293321daa10745a1eaa565ba7fb34d6e3e15dd070d9f6a53d

SHA512
f2dcf5150ccf205d4d80f655414cc6b577e184acbe085b6de18ca192b6e964f702c97cfa864a61d4f3d6e42df34fa0b9d4887f326cac36582c3c3d4c8df43f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3bd26056a47dd3a1c388b3304f08e8c

SHA1
bd58c309ef6c51cee0c2cca406fd85c546fc6049

SHA256
d83abd7255a8bdd7e91dc20bde77bedc73e86d0bf5ffa7e7797194097b19463c

SHA512
a8e9c484421510f8444a9069bdcd72bc1a9b30f87917101304410962bebdbc69b42b6ad3681ab271b88b90dbcb15be0a03565132ab716cbcd5eec967497ca4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85fc8598d47ee2bf9a10d943269b9abc

SHA1
d7be57da31eec396cf6d32817a774af3fc93badc

SHA256
5ee3376e69706b12d99590d859291d04a07bc860c4882aa7aef72021976b0d58

SHA512
1c5f321b7f76b646a469618baae5da6b50cf8a97d760aaa821b669671cf78ffd7f267d8ef629228781777e2529f0b43420d93941644fb13b6d3a10f02d40c9b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab0397e3d8848a39d85d40e9ae7cc0c

SHA1
2eb604c7531a593b214f1001d8d2c2a0e4c9d6d9

SHA256
2eef8e0a15cc510486d10f2dece3b20160cf7fb1dd0de047f70d206498b70ab8

SHA512
13a4e4befa61ce474324445b5f9448316b49551cb5ac944365c951edaf2179dfdd8c59b2e88827a6ffb90dc649fcffc98b3920d0a25d70839d9c5e087c217561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deba7c91f8c4c5361a27fb4c20766b78

SHA1
f72cdad42641f6b9452e24af6c76741faf3efe84

SHA256
ebd523c32e503ae1419e3011fd91e10191213b93f7fe004a06fa19659ed45024

SHA512
b2b4a6a8b7925616acd12d13fded5c4ff871692891163d7c775f931b8ce7d981df282ec9af1689c016e7987404b825bf65d1303b55d0e1ce5e93f731312fdef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FFE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar607E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit