ef3aba3660ed37e1980270eb216cd454ef526cab45f86af3442a42a90461d269

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a476869ac0b65167449d5b05d78bd2f.html
Size

19KB
MD5

7a476869ac0b65167449d5b05d78bd2f
SHA1

13adce4e6841db2d3dbe1fdd0451bf644d731e46
SHA256

ef3aba3660ed37e1980270eb216cd454ef526cab45f86af3442a42a90461d269
SHA512

ec3d84b01ed11c352802e2107a5b87f64c6ffef9cb2d5cf2daa7390b34450330f6ab52b39f29ecd440c39501273a0f6a3eadd8bc1ad6f12549ffa203ceb75074
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIO4izUnjBhSE82qDB8:SIMd0I5nO9H5svSHxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C773681-BD11-11EE-9305-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412521062"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2364	1876	iexplore.exe	28
PID 1876 wrote to memory of 2364	1876	iexplore.exe	28
PID 1876 wrote to memory of 2364	1876	iexplore.exe	28
PID 1876 wrote to memory of 2364	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a476869ac0b65167449d5b05d78bd2f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b1c4977682eee901d0355c21b1be80

SHA1
2d05e5f7876652d646ac75041d1cbb3f920e1b50

SHA256
5556e9ab62b5d6119fa9b0ce63ecb05790701848b5acc676b513165c5acd6fb7

SHA512
565dbfd83ca3574936745cf71c590b88f574730b8e65b04fe7fc15714ab2081f16100d7415532baeaf8d339d36b54cd30a3801e80d3327b2d2e24db9019135c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91de0c664987e64f8c247c3b4604275a

SHA1
567e2c2ce73ac0e0bce33ece3ab5e4ddd7940dc0

SHA256
ed4030e2a6cbef44fae1c2274d5bccce28178f33796f5b416ff790152b4bc9f0

SHA512
fd92305d55fda9779cba896693ef55184808503554d233877d42b6fde944369dfa5588bb689444b28afffae4c72a6357203a50e8237f182e08e9682533f9ef13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5caaa8124184ce676da328fa6efb9d57

SHA1
3be2deff353baa7479246d3db8a0c5c6786e3e8f

SHA256
bd611449d8c3363bc24b01817bc6c30f6f7cdd9ebc377bbf19baa12238c2a342

SHA512
c8976928ecbd469a58251413c1a5d6d2277f2861104c4aa8593a94b4db2de976e920ac1f5d0078d5125ed05b213cf00ebc694d847e3b4791b54a475b151cfd26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a330e3fc424d64697a818814c11a231f

SHA1
6f6eb0014532570999d9574e742e08f27a317506

SHA256
e03ce49d1f72516684052f1ff7208ddb1b87d954ef325eed7634034b7a9039b8

SHA512
f1e32e1038e83e753ac222d5f40e539343dcba4fe6265b2ce0d3ccafd45de250320ed16bc4f384a873d2739e12b0cf416b778d58b040a06844451ca22e6ee44e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dddfe7e3ea936c44ef3d932dac66452

SHA1
a264178693caa8a372d9dcda6bc77b8c76e55b0e

SHA256
6a992a396b020a4191ece7c5e871fc964dff5c0f5d395ce782e5be347ca15df9

SHA512
27b113e7299af3db1535c33a8239008a9c896479c434ecfd3fa2b43f8831c60af9448ce266ae5c6d5aa8cc53f16f7024a7b5a21d7833be54b637eec30680b316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
574f7bfd32ef8a2c97d3613e73a5ba11

SHA1
4dca1fc14af0cf509a8b6d18723ec62dd5de1200

SHA256
1c64830a5b03cfa282f41b281dc0ca67f7db329bdb9291e0a3833cfff2d45773

SHA512
fea89648d294278f2e87d34d1ddc88f5c9cb7d89b9fdcc0aefeb5c9a45f5c1a45995e5b10017cdc94d63cb429cb9067031a0b69c810768f49a9c7ed2bec3308a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4fe9e50e2d898919e6379484ea948bd

SHA1
fc59a088022c79de73c367ec5616d955f6f6357d

SHA256
17b5e7d9f4130e02a4c525ead094a378271cbc3680d1be9d9ce12f1519ff5b76

SHA512
59ecbcdc7606ee067e62ed7ba1a8a136df0840538df100e80e32ad5ccdcf7e30b5489525e74a9ec0f22a9905d6115f64caab8d9307e30652095d55103413a9f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e056843e7e02530ec51451eae4eabb7

SHA1
a957fe97dc282088efd2753d8ae69dbfc5e53dfd

SHA256
470f8f2ba391dd746b5c6402581399b57525b5d9afbe92e7009d08697e5f8f5c

SHA512
404c0da582625c988d25bd77f2ac0a9474e6e22bac99cf813134936e803c39fb8d43793c10311d147540fde36606ad99bba41b9f61fb1a39e16004c0d402303c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cb4331c66ce3e78eafb11f0fa39537f

SHA1
38e5fabc3b5703e151f387bbd22b341e498d5e98

SHA256
444b286c610d1871308623562090a18e9780546e0d89f0a76e0f294522891ca9

SHA512
365eaf169883a4b0e510f841b20902361ea8df2e35c99d270352d70321fb3de3fd51179c26c647e68676756c7cf66e8b69b0b01100b2507e913c9d8e0f78e599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05cb08e53660803102b1eb6596efe667

SHA1
c55f422a14f0712322e70d098b832883e37b5219

SHA256
f5ead66deabc8b470de7ede595796c2bfacec969c6a094a3f547c8897b46ded3

SHA512
bfed79847f58086bda425db7bd45c03ca58ed1c7004d86e2733228309f6d30604de8a92c252f892e5ca0135e89eb89c93b217469892ad907d18bc5baa7895423

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81F.tmp

Filesize
14KB

MD5
0de4a17d11d93e53109bb011953bb360

SHA1
0df706f8e2b131bd876d58ee2d7483aed90749fe

SHA256
fb39b7a8782fbda16d232d361d50c72592421574cc80a6d54d8c4651d7a505af

SHA512
c2e6965b16c29cdba26ec20fa7833c3c315ccd86853252f97b87270e489df1e994f2ef2a06e627c670fe07a0e446403bd4762430ccd216c9ae9cdea1c4173aac

Download Submit