e902ac3c05f10c977bd7a2bde0b5963d0ca93357943ba4f12dbff5d6d0a28e96

Analysis

max time kernel
119s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

752fa7ad69f82a98edfc52acabc7aae7.html
Size

11KB
MD5

752fa7ad69f82a98edfc52acabc7aae7
SHA1

3c645f1f80f3d6cec62faa75bf057e354c4a7ebb
SHA256

e902ac3c05f10c977bd7a2bde0b5963d0ca93357943ba4f12dbff5d6d0a28e96
SHA512

e6ac545d8f291d790ddca8c43579bd7a7b4c9bf08f494595a64c337daf7e0430b9ac68d7efc70bc89f808f8b90c7c8f258938ebf9d4d98e2694d9e2439741d7c
SSDEEP

192:2VSqlIsr03Ja8k/w1wvqyeB2NnbsC0HQ018LOXuBuLbdU8d:sSqlIcuJC/gceB2NnbsC0HQ08LOXguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9D870D1-BBAD-11EE-AFA1-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412368400"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\752fa7ad69f82a98edfc52acabc7aae7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f84403490f0cc732aeba61ee08faf3a4

SHA1
597d0729a799107962ee8ce0a27dfdb0d8065206

SHA256
8e74bbf1bb5a65b361cf04de0cdf347adfbd1910cb307df3c5806cb1c6054071

SHA512
11e80d5feec3eb67c4e9e71831e0af3b2635e8e821bc21c01d123a087497c46f7728f22961c0c5360bb5247a05b95b00763bb4c423062148ade81266da75a433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4713eebf250055cf3222ce6ed629b17c

SHA1
3f80e2afe9542c6cd8fd58aaa18383962dc0efe3

SHA256
e1bac5fa3ac7c7a9a274fc80c80b3fca8d1cac8cb7d2f13c24c4d00a8ab00c07

SHA512
0b6d57117c6c59718566f0ab3b7b7b8f41db5193d4cac4b0870ef58801da19ecb7d6e4db746345efa9500e26af0d9835f595546b2228d409a2f1bd80f9dd67b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23c0e2b7c299099a690f180c467019f7

SHA1
11d7d8ed355f58f4608ae687bc81bcc0a93d9572

SHA256
a1829949384135aa9eb4a4f0ec730747a6bc9e7e4ec3cec2c2a3497e4dd426ac

SHA512
94c95ab818433bb11248a06fa035f0774a42aafc7d5c7075e606b6952ca8ed9497cd6a348507b7671615ea1d9315934991faa7cd2ec510f890cb598871eca3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc7e92d5fd133cafebf82c944711a5d8

SHA1
ba1634deb3a3788cf044de5e0079e564fbb3f57d

SHA256
088d453ef20bc60886657fda9b0430b7bccf7aaf9bcf286a8f06987504beb04f

SHA512
ba0fae0e81619a3da93f2f07e043bf04b44cb21df432b3539bdf5e6383a88df8013f304508d068b48e2f940337b602f429b25370e39458c581088b816fdfae74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c397ca599933d4c203e44e5e2546c23c

SHA1
b1f5c84ef5404147a1e0a8cabbad2afe23b69a0d

SHA256
a3a075618c3dcb51ff69001d90f2c45fffb5040547b03e2a159ed520e53662d4

SHA512
42e1d752bbae0ec67df4692b8a0ab0dbc0acbc6152bd6d8457a47f9d4ced6fa6965df3657162ea8f555e2482e5c4d58ebdd4e5078f75680bd38c9d61103f3f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37240f78eec6dcc50b6122dd50554733

SHA1
920cf3ff16cdfea1ca5b62e1036a453ab987ce09

SHA256
e427794ab99c95bcfa79c8b25a58565e77ac4173101a79e3e1abb1c50395425c

SHA512
23696bda1da7cc7c1bfc33da011ed5d66d7e1644a3e611b9639ac0f8bb42e3a054460382763a742f82e1a8402fb7d108940517e4523d8b99d0c26cba632205c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0c6b5f161501871e6e0fd6766fba173

SHA1
cfe83f2dc71ba255eadb012798467717fabba9d8

SHA256
a428933c3a546f9f6e70c0ebe3b32057713f7304d294d5f4c2511d95d5716046

SHA512
54e6f736cc30a696520814b13568595f98fcc08f8b73410fb2ef211844778427a4125f477b00a3a26b6f15b7b624b5fe981e0a9c33c0745d3c3dfb5afbdc3c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DFC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E6C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit