59aaa7a7c653162ee3edb10995cdd23524b541ca2df0af73f8a23bd3f5d2a1ad

Analysis

max time kernel
149s
max time network
174s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87e23f7869b6096dc658bc0905a10fa1.html
Size

19KB
MD5

87e23f7869b6096dc658bc0905a10fa1
SHA1

603077fc4186abcf10debac6f0c3b09fbdecd27e
SHA256

59aaa7a7c653162ee3edb10995cdd23524b541ca2df0af73f8a23bd3f5d2a1ad
SHA512

bed2f2f5d984c889f336c3a9490038673cdc1993a05b7abb78b08d33f5fd3f50fe23f9d62b5533195cc9ac2c807ac8db6071a47f36ce28958f42ef847a6875f7
SSDEEP

384:TVBrIU1s01BULTMmDPRmeXeIioYPalLSvhPpj:/rb1s02lLuPh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A479A01-C155-11EE-8AC5-6E556AB52A45} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412990102"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2848	1728	iexplore.exe	28
PID 1728 wrote to memory of 2848	1728	iexplore.exe	28
PID 1728 wrote to memory of 2848	1728	iexplore.exe	28
PID 1728 wrote to memory of 2848	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87e23f7869b6096dc658bc0905a10fa1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd07aa39262ad141e7efa03edd01e00c

SHA1
7358607610abe00be52e466f47ee112a4c887d8a

SHA256
acdf7c5d7322571372c4c8b45b710df49f8aab42cc5fbc3d76296544f1353c0b

SHA512
0b16673299aa5deeef7714a9abdbfe9ad04c84535de9f57d82260f94e12582f09ce2887f01a9b8c1142737c8b936e768cfb26376a799d77f2451d002b63cdb88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
344cac8860c5716eaad04983d5ca7e8c

SHA1
b261a17d4ec36dac131e69fad7c67dde2a0ef354

SHA256
bd4bd1ba1cf3c9d3bdbaed998ca3aa78de4095b7bf8ef47d46e4808eb56fe754

SHA512
b8bb22be84636d0716d601cde3f40679099049b3559371f7daa4659a3ead4d3431ea8095dfbeff7f1ca8aa5c7a8d74b3f9792379a12403da66563bb89ff1b47a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34622d24f4abf2b26d1ca198d0e58b66

SHA1
0fd9b882d24ce3aa319ed19342e2f4e70acaf61c

SHA256
9f60a02eb732ed7e27f1aa55fd708e6c21cebc212c98dbe1e8940d47037181eb

SHA512
60b61e07e4f03855a60967f093e1343200e2026ff5ad4e7adc1a2ba014eaf95b31398b851a06bbcd1a69149d604212852c5098591bd0cfab90df11d13e3dc348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efd67e76a9be95f2cb032725a920ea07

SHA1
3fc3e59f46c7dce2f4d3a3c4b8ae9e7dfdbc5e9e

SHA256
2c42306c7e3407bc3f2180295d5983971a446afc167e5ae11c1dc626671dd859

SHA512
560d89bbb36769bad00e09e73dc07a4ca2458bb4b49c844f1b6bd490a8170041469b887666e55ea6887ffe0efec0bdaccf10261713404e04d2c31a6268b74346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ed9c6ca3838cc148ac2a13a7f410f6c

SHA1
12de0c7ade88919480368afd8c1f7d849b0dc3e2

SHA256
f012321210429921badab1c10caa5e7bea8dffcea3aecc0d25b4d08d5438589e

SHA512
b3073230703a437b061092b592553912a9598649b294423e9914324a94051ecaca67530f2c134abf63c0bb4eb1b9e6f816fcd505e40e79ac8635f4ba4c96423f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
715363bce0ca0983d1e052a8aaf8b26e

SHA1
6b42358d60ca9a4dbe5186631f3a216fcd02987e

SHA256
bed0cb8cd9e1c6386770b9d18a425aca49c68ba145d9dc23c244f452806dea1a

SHA512
139282e2a9f10d45b3d99aaf51c2395a8a96124babe81a4a7e61f2042eaebcea5ffb847d584a163410e57b7e94a37b5edbf42dfd682769c0fbf6bcde1a582948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4368034b35d8adafce276bc0bb2c9701

SHA1
58d5b31d2352c9dca21ffe386d4c9b58fb715a38

SHA256
df6781b436bd099d4a5fc5c4b2b2629e8d713c0b5d551f66d7311288ec2cc830

SHA512
f485fa99a9e249f8837cf06225da0e05a6741b871296331611744d24245f95aed5f42971003afb20c6a5701eb39a48f200e10a6cfac18c220ef9a970d5f4b893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4cba611a5b92de9c4034e6627d5b706

SHA1
8b79f2381b6ba65099e470582f768b29d99b8e99

SHA256
0b451f971935ad82075c2ae2a1230dd80d2fe1ea015b74f74ca9eff25266dd9e

SHA512
62c50bf90cb67af835abaa188c0f4f66f59daa2ec62b0512251f21e68e544cae61a7a565910cf347bbc6663994912d786bcc0acf474786aee0c395dad04e11af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be14746da8978c34a41823052e3e4e22

SHA1
56b4db4612d6cae203585dc7c0c1e7b5f64365a4

SHA256
0c93e76ec4a7271bcc5b948ecfbbb91f16730097bbb07f3d0f34ac5ac3b216cf

SHA512
26b9c913f87681c8d79d476d8eae2f0147ad55fcf6e43d4496d1883ac2093b8b1da4ac38625be1d7b32ce5a79f06ddb995c87d97213e0e313b2f0fda16f94bf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4fd4ab61eb6d9321fe026ae89197bf

SHA1
2dc6b443dcd502475145741c78febda76ce33fa8

SHA256
b3d9f79382c0378fc1b9b545102163ee3e3e4769338aef45b011b79f12ff82c0

SHA512
2beb11396c81a8d8ad4a1d87194b21a4713651f5a40c556ff447ac7a6989ea7c5713971173f47de25125060f5ba14a7901e380cd7b881895a54b9907a8faa03c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37b25aaddaf711b5cef7167dc8d4e647

SHA1
798b17826ed9d964176dcf4e7424bd960ccdf173

SHA256
187a1435c84d94e604897637c24ee0d5a95566d1e44ad2278908a6d585ffa8ee

SHA512
061e69c33f4123d305dc02dc37ac0f5e0268181ff561a044e45c3bde608e7995122ac61808f92e3613297d539735c2e0d3aea11ef97c2172cf8ed6456808de27

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC60D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD889.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit