c857e3c36974a7d0dc878db904c73836ca8e92fff78074ca07c56a34483a7d8c

Analysis

max time kernel
151s
max time network
163s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8bbd2fa3683378875d259408a88dff95.html
Size

104KB
MD5

8bbd2fa3683378875d259408a88dff95
SHA1

eed621d6669b308730870d1ba265d78a5574e726
SHA256

c857e3c36974a7d0dc878db904c73836ca8e92fff78074ca07c56a34483a7d8c
SHA512

10add917f026b0c2c1b472e20115857092b7579f2ae44dbe425cb96260659550776045e6ca7dc6a5aff0ef354aa985b47089f4cf280bbb6ef9a3742409b6bb47
SSDEEP

768:C2h7meJskOWzOw5PS1wdvlCBo1BvjlUuS5euJXxCyGsaMWHS+uqzr7SMMCpW:C2hjFOcO8SeRuKzPSMMCpW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413106923"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BED0AA1-C265-11EE-890B-76B33C18F4CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2692	2088	iexplore.exe	28
PID 2088 wrote to memory of 2692	2088	iexplore.exe	28
PID 2088 wrote to memory of 2692	2088	iexplore.exe	28
PID 2088 wrote to memory of 2692	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bbd2fa3683378875d259408a88dff95.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
dc301f467160085b458201daee26f96e

SHA1
a85f1ef4e28d985877f3f10b0825ad3dc3a494cc

SHA256
f7aaf524c3e32053ff489085e2da8b930c0c1cfb05032c7a5775bd9285b901e0

SHA512
c8c87fb3e04671d52a03ed77fce10312759c9eeb2ca79a11e8362a05574bb47ec629fdf3ff84fbb86c25d7adf518f88df7865b62b316ba13b03e22294c78e356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c868ba47d495098199c38f1f272fd9cd

SHA1
559bd04c7cebb380808b8130af83342505c092d7

SHA256
880d04577453542d65f28557a43fef194d8d08e09f5980eefba112f7110a551c

SHA512
13f323c8f268a17079747fbd192e188c0a86f11ee42ca4bd4a9727d302bfecff99292692bef8e7846611e80ce77694c7ea4bb376284bd65729dd0b64e3b4aaec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
865e1029972643e1f065296394f6d7f2

SHA1
2263c56e670258bed235b2d8304e412cfb00d050

SHA256
eab645ca89562e949626e0791b2dcacb0753a19424f2aaefd77745bf868e7a4b

SHA512
a6f027f16921dff06acdc6f190856db76c4ecd1aae4dd83ad442911d70cfe10e220c91892c3277b7c1caf9baf7fa489340b98672041176f824dafb6edb2b66de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef7c8a40b83d2b8072b318d96366f424

SHA1
302dedc81f1cedfb2cdd4fcab67dc33c78c4341b

SHA256
728a769d05c8544e7469a64cea9a69e917595322743b15baeb87f50533fe936b

SHA512
ae61e9b52bd08e1f685dfab606f5a347ee35edcb748ddd10983a4cb598b0a8da5d8ad95e866c7eb121d3a226c25aa624e8f9f04f316973d71186764f8ceb6421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6b44ba887b406370f38a20b421858c6

SHA1
3058660b53955cee58fc40b704e7008bad519ffe

SHA256
1bc50f6d7d6942619e390d01676678a8418c563bf00ad6f60b261186e88645fd

SHA512
e91b1ccfc872c151b6c4b7e3240d8e628492c9699a8c0bbc45fc4d60bcde6435d712ce60689911d33bcdb55990d25c3be29aa54695a5a1226a57e85fb69d6274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b4921d66cbd5672d56c77378e56b6a2

SHA1
003dac9a2f380412c78ee97513d7f62cfa5e7511

SHA256
14952f05dac9f21b42be1df455510433a899c1654a8d135e0186c341ff1d010b

SHA512
f4440ac359bdf81710703c0d3289e8c422224c4f6a1c7ffbf24bc8f4c61c4571752c0dc801102abc41b153a9f8eebc5665e289f6a6bf00a077f66843d7c7a544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c92a487fd9cc8a6f6a67a300a5b1298c

SHA1
d976e440c26c4b2e60eeeab610a5252bcb842a6c

SHA256
8f1d6ddd08ee280e74677a130dacb16adf5f1824bf6eb45318fcaa8d3e747d79

SHA512
a01ffca57173ef9f175cd7738760e803736a9feff029266dc46bfd9672edfd1d01f093970b0a173d913f988ab9c9dcafe48123d222c14aee82e5bf0d7506b526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a5831f8bcbcd7d88a03848862f3cebf

SHA1
1bb22058f087869a2aecdb33380f65364e1e93ca

SHA256
8aecc9dbf52254e9e80e8e2b8d967666e6f091c99f1ecccb30d380e12877cca8

SHA512
cf39df284cdeaf0f5d1922c129a75ad2bc7148f54332de345715bb0f08c94726d616968cff7a92fb57f0267063b15030264172a33c9b095c6fc4196d2b560293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f02322bb080f6053a73fc665bea482c4

SHA1
a6b6b2622e949ae838f79ae64ec27594d070060d

SHA256
bff783522cc774f892b8f5dcf8ad013df1a6bfde5b0b94a94cf1cc2214cbec50

SHA512
618f093f136a7e089723f8c8a2be09353f13da44d8abe98e263edd4119451884c7c6d877108e2367c691e304528d6c7cbbde1a7615d9d3dbbfc291491b019e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
862276903603e290443b48a424f7824a

SHA1
2f811f88ba69e0edae61c5f2f1ccac90dc23fc68

SHA256
134eafba68c0b3a85f6631e126e84a678a53efd3993498d2a79644bb31a17a0d

SHA512
1cbfdc81ce9d9691df0a8b99e3fbc731b08f851be3c886bd8b758838dc6d2325fb243cecbe23d45b564e64772dbeed794a9dada21d474b7483220b7a9dcaec46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6a8f3936d6ddfe33869e2c9dce3cff9d

SHA1
9c28821fb9a130c1a66c0325bdec00a3e9e0f80c

SHA256
e6b921cc19ccbcfc991a8d8240f3725a35a2d0604e20a57bd4279e1dd1692fa1

SHA512
d3377976d5beab5f9c108dbac7a0e2fe8bb908c5d4c88ca86b1846385b5e99b5ce56626fd1cfa6b1e259be236e4d9f0a3ed35daa55e8e2799a9e2dedfc790e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab760C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar764E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit