fa17873f87f998e5c0fa0d5eb695d16b8ed12de96ee7e035829234d6f42fded2

Analysis

max time kernel
120s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa1ba530e2cc2bb499f4a0da1409842e.html
Size

12KB
MD5

aa1ba530e2cc2bb499f4a0da1409842e
SHA1

a0b4eda360d4a4cca4e7e3f71e2415ac1e5c7eae
SHA256

fa17873f87f998e5c0fa0d5eb695d16b8ed12de96ee7e035829234d6f42fded2
SHA512

eb3431558ff657a3851a0347d9745e91c01f7a47d7f33316c21a2bd2761514637983bf6ae30396d8a1f0d2a9c10a1dc722f349f08dcb9b48031e5e5614ac8982
SSDEEP

384:sglIcAdNVhj+V/gcgB/Z3n1wWda0bAguLZ:WdQgzJ/AxLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E599741-D5B0-11EE-B499-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415228382"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3052	2140	iexplore.exe	28
PID 2140 wrote to memory of 3052	2140	iexplore.exe	28
PID 2140 wrote to memory of 3052	2140	iexplore.exe	28
PID 2140 wrote to memory of 3052	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa1ba530e2cc2bb499f4a0da1409842e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d2ea9874e5965486bf3baf760f1c56

SHA1
975870589ed352e4cb4ce2e6d31f8658f98ecabc

SHA256
7f25e62d79ca8e6a347bb38e87649a91ebaa8e37205d81ef5e49bcd0c94d50c1

SHA512
a15f526240c6844299f6824fe85928630c0b00e6443f8e6c83a7f24356343565a2c0302c1a5700ec3cef29f1925a7c9c9f194ca9deab27d7196a580a0b979448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d18b2262b6e5f0159327b551b2930d28

SHA1
97e8610d54ef557d157c3d3780072ad5eda7a743

SHA256
bb1fb16c13788b5b687bb3cd25549d3ed6a67cb4a55c0c2c051dfd08727a8c42

SHA512
42f0f28e86f80cd65fbb5bd941c6a6c4a627f6babaec1f50f3bf98aac787a2b97caf22e3bb6ac6f3089c18f746fbbf794f7695cc5029cb13f68e368fae2bb679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3165406cd733af379d89fed0920e18c6

SHA1
a0cb94eac17679707ba0c1be60d3a689b645e58d

SHA256
4e666e7d793f6df6ce69af79692b3068b3a1ab15bde1d37c9412082c26b6960d

SHA512
4fbf12c8e0d8028ba57ae34745c217e328b938e7facffbd30f853f9e0c8fe206b0e47a4099ac72fb0a1d40e647287d301075f3601d76c0728f944ea178526daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76648865a17642f5b2d3e228bd908102

SHA1
8802db5399fbabd01822c89893f51caf156d14cb

SHA256
32e13c823825514de99c2a297657cd851177169652994f62d100636c796b3f61

SHA512
2c730fe9be53da46386a137969904adcef22bd31ae860d9be0b3fc79de97948621c56f6c2f7106ab601103a84fbd991e6f5a4379b57a55e02b838ad2e587054c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae40dd03268b4ea741b3b40404aa0017

SHA1
7ed7cebe25ed5267aa76f82e08a49bcc582748f7

SHA256
15f96babcbdb25199cfae87fe52e8379f8f159ec40b1869f294d73ac7c9770b1

SHA512
3ba75d5fbfd4dd1512c0079683346d4a96c4a5de0525cdf8549c77657817be8ee5d85ca27a87b05716455db589a753eba947ecc69ee6f0998b35c13fe4f6cce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43875b6f0cb855e63ef8731534c15e96

SHA1
e221c092e6173624adda44d7f2bfb1f51997c9a0

SHA256
5709f78f39230ddd3d64069ad1c8475547de603619aba6f4e97da29aaee55672

SHA512
113d6c3d665dcf98772fc772176d0779ffb0a3ffcdad1758698781d5dd20886587ddb84979085ff98812fbfbfffdd7dbf44c7deea815236d7bd6bc7843a54e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec44d2adeadb14b09a611272a28f7054

SHA1
e8738fc1739f5556978a6fffcbd3e1020acf844d

SHA256
5322fb406f966d22ec5272399dc22ae3be8c128296fee741bcfd4562b1e807e6

SHA512
aeada306cd9134cbde53c3c11632a0bf3e7d3aa8ba611528aead40859b95d4f64f6c63805b6242e52a3472d79c83c992ab1d733e1bfc816922745e3678c9ae3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a77e05424fc287e5f7cc1db13add1a52

SHA1
e91ca1f9e0aea0f6dff2a890c3233e44aad5de37

SHA256
0e5240dc57658740c8c8becfe2cb2965ad5a9a5c0f49f91dd13de5b875d5980d

SHA512
a73ecd9ab8873b209f6c6152cdc5ac41e15ad02d8cb46c1783fc557eeb08cc37cc907fac06c939caa04b4110b066f4508143675ff5808fbce65797e8f76e80f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab674C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77E2.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7806.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit