9972d1cdf8ae32ceaf0e9931af2ef7f09c77f68812e6f849522c2dcac1d2bc2a

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73270c344091bf9d65ed2ee394958aa7.html
Size

72KB
MD5

73270c344091bf9d65ed2ee394958aa7
SHA1

1eaf9731e99c6ed7c93c14f5c854702d70f51bed
SHA256

9972d1cdf8ae32ceaf0e9931af2ef7f09c77f68812e6f849522c2dcac1d2bc2a
SHA512

80a1282da0f54b4c71d4993807b62df47c717842d270d11b5c0f35a0ada5678c312c9e47e102f7377605bfcaf1939bb399d72c6cb0a0b400a59fafa782feb723
SSDEEP

1536:M5LbvGfC1A/rGrpAJ9DxtlxJoybmvtNYtyOyLVO+/HTwR1uptbvDgJiDfJewVJqm:M5LbvGfC1A/rGrpAJ9DxtlxJoybmvtNH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412301121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1412BAD1-BB11-11EE-9569-6A53A263E8F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2924	1044	iexplore.exe	28
PID 1044 wrote to memory of 2924	1044	iexplore.exe	28
PID 1044 wrote to memory of 2924	1044	iexplore.exe	28
PID 1044 wrote to memory of 2924	1044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73270c344091bf9d65ed2ee394958aa7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d049b6f29c3ab8f9648ec57dcb7858b

SHA1
417212b2e46eb0324cb876a290f486ba32c0411e

SHA256
75a1a6c646451d6a2bb5c5b1d2af8aceff8d3657ab8b10881386c6e0147868e3

SHA512
a2a06491b1f8fef9616b2e6a748ba4015561542d895179a1b7023773014ad14922befab03e240467aaf8707ba84d099cbe9a000d349af8b302091c2bac33396f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b787746aba5aadaac9a0c582aa4b645

SHA1
c43d1c3a488bcabc39aa8c2f4e6023a5f3499aa5

SHA256
f18caf82c6dda8b64d09bace2265ddd18fe0f879f180b44e88c2dd774c336e71

SHA512
9cc37c220f39cde5ad822bafd95b83038fc738b3ee6920a63bf95eaec1ba575e3db78f65b5a0be8301a28082ea6c4581b749ab280f4241bcda5f5a2d460d1cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2e23d7b85d914c9939e9256bc72f3ec

SHA1
d33d2447581b78530232f23f148a94cc6dff0563

SHA256
d190e8e0966b79d5aba42a9324fdd9ab42e2a20fdb60d7bda515fa479c4064f0

SHA512
e21e9487e821cd2f123c197f9485423e1f6ef48bd4b59f8aed9c3ede2046fad08e38318317cff567909b00cd24f8caa85bc0f2a43c055a026e454acb9ee10d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d5c8100bd285fa16b7b8a17af55e312

SHA1
8c9939e96daf558fae4fc06caea31d1505c5bf01

SHA256
8bfe16b1c63bb498ae59269bb74db38ac12e0ef8403a7b69923ff4e237dfc621

SHA512
145d06ebb6d3d2ebea4755ab334b1517f0800d4d52eb68e2f7a143636747cb50ce1163ab0051983fe91c0d06e5c156e577b0180bee2c9fcb526e6b7325916ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a2b82e1b2a11862641260a570d8731a

SHA1
7bb158ed40deef35900728e8973511ee3d954cca

SHA256
9b91c639f135ba572979cb0347883776f3128098c8deb61bfb7c7b82e91a609d

SHA512
f431207f8c86f3ca6036916444a9935885dedfd83a6cefdeb57467e1eaf1c2e8380174ac0416c3fa4a268a7d3bf0e5a415b58720fbfae33b9819994ae655a2b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ca8406ef78271df53d6c1e5fdd9c022

SHA1
e1448b2cd0f121ae14472787bc08f24f9264a482

SHA256
ff37eaa0153c00a6624fc8cadbe720d25e92f832cbda7cb041d44586eda475be

SHA512
c98693effd9baeb1eb470edf6e1b980e4a82e903bdfb49b1be2d4f5730c12916be2da9c58cd31004b350ddc13ab9ec1b9e1e209ed8e3cd4ca4f51a3dd4b48be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5baa84a787faff96cba09283e33d566

SHA1
873b8caf0fc33e09e7a58151311377c1ed93bd8e

SHA256
16b4fbdfaa38c6ca2e3f70e136a598716465c7552dbeca8e90841ebcfbb83156

SHA512
7f8c3d4b3e4fefc0cdb6d995383fd414caceb279db1ce844824c2a296a50f6fe099b6a3eff8dd0c6a24948ba4087ae99c395f6a836cfd00d29d3341b15c6c563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d589a08706151531c3de5ca47d7f1c

SHA1
1c80cf17771cc3224a303fe4c0e39549eb898318

SHA256
de1c88926d6264994870e1001a4cdb926e4623201bbde56fc263c534e81393c9

SHA512
83713bb7a4ec719b49a9f924b9332e5cd32279fe4a036921dea19a1f8782d4de7a6890dd862dc7789eeb5ec839629d1a06a673548a1d51c2fd0f3cdec5a562f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
357fee2b3dd43b724428d63a89ebe9ca

SHA1
1939971192c86a49d908c3eed32be3c388eb1b62

SHA256
51313483d65c7424c1c9898a16febb4d0124174b1e16cd5b1abafde3d2fcddf8

SHA512
fca25b058550f3c8140f0600f5c8693de3386acefd3dafc87fc844b22fb61da126af3270b6c049d07a621fae714b0c4270992f916f89fd3e671de4c95b280265

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4250.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42EF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit