eeeb2a0151b50b0d5cedf923f37f7ffab12f5462478dbbfccc14b173d43ba6ef

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78a3ac6f32a72eb065ad68b51e8c4c44.html
Size

19KB
MD5

78a3ac6f32a72eb065ad68b51e8c4c44
SHA1

4341c7a6899bbe425cc816dd58c99e0bf69817a5
SHA256

eeeb2a0151b50b0d5cedf923f37f7ffab12f5462478dbbfccc14b173d43ba6ef
SHA512

8adde03f51fd68c75b55a91efd78799a68a89d6f2be0ef64a9548554c813f02a8af7a71f0fc142d5c409af98d8b867d4137104b5efa86115e05a7e603b2180b2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIP43zUnjBhtX82qDB8:SIMd0I5nvH5svtsxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38E36D11-BCA0-11EE-AEE7-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412472551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2300	2148	iexplore.exe	28
PID 2148 wrote to memory of 2300	2148	iexplore.exe	28
PID 2148 wrote to memory of 2300	2148	iexplore.exe	28
PID 2148 wrote to memory of 2300	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78a3ac6f32a72eb065ad68b51e8c4c44.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce7d8002c056c1c99f06d197aae96751

SHA1
193cf9549bde7fcc05576f8ca596997223df1e31

SHA256
84e4b9cee5968af07aa379139d67ce454b74754192db23f5edc761c41fbb8488

SHA512
d9b2327cfceb9ae1ce8ba2df3bbafbd024680bae66cfb677bd64a489b33e8f33edb0e85806734cb65f8849d9e54663f1ae93a57c1a532439dbf6ca7c3fcb63b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cd747949dd711f2fa815cebba95878d

SHA1
c8b1a26670bcab3327df820d013565be859914b4

SHA256
9f1b427630b1dc707d149e518a68e92a772299311c4efc4f6df0fc241bf1ce4e

SHA512
1b1336041dce36ef642404cf355efe5c4a0c10811f984fd21ea391149d922432e6e54c5aad83856b99ec735cc753530fb4133d385b610e60f4579e365caaaf04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c6a753ac3c8404f6ace9fb7620428ff

SHA1
56e2fc221962f59fab0c29d733a25105b0c7bf5f

SHA256
f3f6655f09f028a47cf71d3dae5ebac4a4f1bc88b4d3eb1bc814ddeeb0bf12cf

SHA512
64813843ac8f0d1f8213752a3e2b0bb07551ef3d04bea22ea8412e9d7142c266b36b2f90f0bca94c39fa2ba80aa1fbdfb4dd97d548cf23a771a9b2895dd8ac0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74743cbaf1d9680e6659ce0de519f367

SHA1
8396310a96b68160bd2e9d7286ef9344bac6c4a2

SHA256
bf332c30967da1ecfad23c9870adbbca06e8c3c9d9626cf3aef2e0502bbde1bf

SHA512
5e7f843f4f96a8d7b94413c6b9389169c4d9cb756e4409bd30937888bc8001c3329bb0e0ecba1f6159153d542c9c2c991e69a2ad1be8aaafbf991369e3fefa1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3cac1df302500cdd2ef480b36f6603a

SHA1
e119f2473150f631cdb3140d7a9c7227748a8810

SHA256
bab53de25446adf46f6c3fc7eb6e90fbf04a3641a9c50da825042d870330577d

SHA512
f695db7d0ee4782838fff114b3a7159643b7bfdd7dee1b269da1c8b52ce1b7207f5389ade22e048f2ea96759d212de8472ebba8e0d11cce82f7bb8ecc039ca00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1669d28ef9c3963960119642d5453a4

SHA1
7dd17d6e3d883bc6444591a3bde09ab5b98cd3e8

SHA256
840308dcba568cea02e1e973f312b19d7e33f317abeda8819d44a5c705b147da

SHA512
49580d3dd553dc596e56bb48f7a853ea2f7fac2af69976383252d4dd226e34bae29b054aa0696745d3fc99c26a1f39d5c95e9ea888211b3beb4e4e04309dd4e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05ec55268e87c6197322c1e489d0bf7

SHA1
41586c2305f5dfab3f29645687166b91ab8f336f

SHA256
1aba470c1bbc0157829911d11756d51dc64a3eea052c8557d6b93fa65c673bb2

SHA512
dcdacc9409a57d8742ed80dc4d2ec5944fbc690b2acc5366ca4f0d40ff8b88f74c0d9953a8fb8c89bca13d798b320138ad5143df1761c2bc1cc6d6472d87ed23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd1587bc3738a817e23bdda1b65b7f7

SHA1
469e8b229d9674ae522d2a1404f4153f1962256b

SHA256
b5c728a4c55c5b8b3d0d012c72d5101b3b354eb389d62f52fa79975ed090701a

SHA512
6108dd72f7e0828eade5ff876344dc2aed81c8e18f1ef3866e991352c0891c3a68dc53ce88519a97125d96f178372c6c2223beee724d05c15b17a642ff1b7707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab9aec684d597ff8bd562832958b456

SHA1
ffe1d61724b268a8aad1740b3b4d61878856bd10

SHA256
1e4a53c56ddbcfe81f8de65c624409f19b0f20a020da945badce6732a7e1a62b

SHA512
00ed14c03c071c1eaba4545f3d5ed556dae9530e0103c3695bce09d29ff08230248103472e31639b532cf6e71fa597f858e3235344b5e92ea582c438e61e7108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1287051f2e4984e2dcfb929b57462d4e

SHA1
1b84d5ecfa626a2d178b41596dbc51fd7075926a

SHA256
824b343b3e5320568c840d39c4504fa7b49cc19be364eaba1a6beb06828f50fd

SHA512
4ea1a4fdb63ceb04d0549ee65a0db863cbedfcb5b96499e09bbd82c9278015eb8832a755f6ba627b83f5295347bf44a72641972ef97bf9bbea50173c803fd3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cb3343bb5a993780e2ae83f2c8fce2b

SHA1
5c4d827104c06704674247ce737fdafe1e0c8fbd

SHA256
117f89adcc674941bc5d46ed3d4402fd4cffe632dac5857d1f4c2f1fe0f97dfc

SHA512
990eff8a3535276a323297ded759401559d3249d15fb7fe5fc2df3436e3dc55fe76a8b17e6d9bd16a91debf6993d238b76befeacb4158e2d2416fb8013b0db6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12c54d16e47e8399b2f90d26801760ad

SHA1
ab8b1cfd9f95eeb2dc571285de7e01c3ebde819c

SHA256
e338a0b90e8e4dc49cef6c1acf963b573be53e5e54e4bb7827f02c278a88143f

SHA512
02fcb7ba29fa363ffc2677e5b1eeb30f30d3c28d02754dddb56901f541342be3e2d8d6a9b2d0b86289173daa67903fc241f5606c17f0a6cbd911cf07b6c171b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab583E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar584F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit