e71ba63e0c9c7ce44ccf76e5612b205c98f64ca2e39a168851e00f170bf29e72

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99c884ebcde735b03c92b36013dc55ef.html
Size

19KB
MD5

99c884ebcde735b03c92b36013dc55ef
SHA1

056f9327c50a4e0ccb2a4336d403ff35caa4e7f7
SHA256

e71ba63e0c9c7ce44ccf76e5612b205c98f64ca2e39a168851e00f170bf29e72
SHA512

953276d2b51513b68b9488803b886933744fb1cebef9cf60d3b1c1fed004743c0ea7d3956a6506b881653ff52aef6210036ef42440418994029ca134c03b291f
SSDEEP

384:nfnYdlIcv2xt0g4HkWGTHDU1TQ2PM/gbBLOXguLZ:0R0glExLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{204E97E1-CA9A-11EE-84BB-DECE4B73D784} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414009249"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1172	iexplore.exe
1172	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2416	1172	iexplore.exe	28
PID 1172 wrote to memory of 2416	1172	iexplore.exe	28
PID 1172 wrote to memory of 2416	1172	iexplore.exe	28
PID 1172 wrote to memory of 2416	1172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99c884ebcde735b03c92b36013dc55ef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43dca7939e4b9037d10eb469663995aa

SHA1
966f3724bd0eb75eba29f6b865908e36d6eef437

SHA256
74977c832d4d2613409a330b1464179078aed80c8deb1766468d302a68a6a696

SHA512
c5819d880b1e281d56fdcd44e1ffde555360a37b67175ad82128b61c321f599e8d6957772b2abee842d5511361bcb5a6fbc6219427408fc04ea0a8d0e551546f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed30df1d7a7bd02afcd03dfb6199411c

SHA1
e243e5ccf6589f25cbd8583d90a6e4ee3dfc4383

SHA256
5f6c2691368256aaf6499346e506e1a514c43c33b8a4411f9097bd99fda7fb68

SHA512
198eb5f21e1ed6d54e83262f1fe42e73a2137dbf87cc357b27e37bac14c44ed5fbaa01ba91d0fd174431f6cbe9873a136e7c7455cc99742c895db093904d2a34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1f840ad41bf13d5b79e1920ba206b2d

SHA1
ac586377f094d6e10a21a29d0eaaf599cbbd49ab

SHA256
b6c6d8b366be04ba2c730238c7f47938199da3ee2baddf1b35e0375f7deb2cef

SHA512
2a2f44a6fe3f3583ebee886a3e8580bad61c0a46220390829dbe793a30d5a5c876a493b415105d98a2f7972a47f2814ae9919a692285acf79e202bb1f2d75e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a333362628079fc6eae8c907f00e9079

SHA1
0f36092b98f4eb691b702fd1ff6d689927fc4d1b

SHA256
fa5816385ee394d61a3c9406538f454a0e5265f10df832bb915c0ea92fb00b09

SHA512
3861bc8b3a6a1fe2bb185eb3222ac432a341b8989ba92a89eef988502c94a640a280e2b1687cb111a5aaf2b96527657661414d91c23bb855cbb7eb62772dd1d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1467c72eeb6290c207518e089329c97d

SHA1
87d6ee77307330f74289397a553aaaa8734a6f31

SHA256
73b33dc4aea3e1f2e10f00c9df701b6da688a942defad8071f617b8b1ddf6849

SHA512
bd406f502c6f52e2c7e06654a81e82f2fa908680a62f38b6f6052e04ee2104ac503b70da76ce12f6ab846911748e5b194e2bb7a0e84e7242ba374ed8cc01943b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ff99574c9c3d332e575111f71a552e

SHA1
1e04f8350c9ee7b83d997326bb095af17c186005

SHA256
b7fc03f916ea4ee9cb0db9f2584aa2d163bda40e2fe5b9187566e2901b78f0eb

SHA512
0b76fc84aacada27ee667cae1bf55dffc1bbbd20a75cac584e4be221517c2b97a64cea7ec09fddc01283bda8547bf87cba4cbd399358bda0ee277f85c7bf4705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2334eeeeb4936e44518d7090a458a0f3

SHA1
25300e4eba807c0fe8a0e1836d8108933fe3c9d0

SHA256
34956c3cab1d705abdb828e44be8ec33631dc4047b5890b0f05a2ba018f302f8

SHA512
cf20624ea7e1ffeeff81603d6154b2cdcff25306e40d49e0101820cb32f3f4ae68bef0189b690eb40e64bcdd6a2c2a9002d7ab2b1f17b83fb7fb076d4d37067b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
841c4f90effc63c707afb2140074de28

SHA1
604c8b000621b3e2a1879140fe0813a0055bd0fb

SHA256
435b860eae6f29ebf14bab32c989bf3a3e411f226b92f2864b0b8ea1b807e4cf

SHA512
19ba4f20708704d7d0ebc3db3754e2f7efe5b88cf028832a9cacd29285a4d68547cd7a535dada13ff5b4bdd16c58ee28401ca19c3bfacdfd688d434b7a909a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c08b66dc53d38dbc78d7b046f705b2e9

SHA1
f303f15833ce791edebefb25de4fa742455e4f7c

SHA256
bb8c34ecb22bea2b30588c9061405fb4950c3fae4d3dd3f94a5a2d4ca2016486

SHA512
252e92716689b2c61d826e6a207c2557b058da682bc38f5383a5e838502f5375f0d31f283039002f61e7ab5a3ee103839e34b25fe88165d90235e4834f868eb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be7b96bdef369b465d3fa90b791703ee

SHA1
e0a2c00262ab037c25c38c35b56d68a494559805

SHA256
dccf21409d3deb44fde2706e8ca6115d32fd7b7d4a055902aadab0f18779ac95

SHA512
d827ab5c93a21636fad7d57bc61807b183d8fc1dbe0d3b51b4fc8dfc984cbdb551bfdd29c813dd87af10f3ebe220dfcaeb6e348b7b98cd9c5f7bf6724198c736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b2f20966fe1e016f000ea01de4237a

SHA1
18cc56442a6c21244ba0c27f35364af513d4761e

SHA256
bd25e4b2953d413918e3660c6721cca0915874a675ad928b25eb16f9693fac2e

SHA512
b2941d779682a8efa0f7e0ab472a94c1a5a115ec5f2c1052b6eccc78b1a7e6868c1c27a7164d5a259edd30d72a9ad8d9ccc21c17cd27a63f1151df664165bc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AAF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B3F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit