e6485405ab702b7cee2bd92f31cf3a1870e7526487f7f168138251385ee49e6f

Analysis

max time kernel
133s
max time network
152s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de5b123b9843113710de6111be7092f5.html
Size

11KB
MD5

de5b123b9843113710de6111be7092f5
SHA1

0174ccc311c1c935a1ea5cc421d9e693b1dc89af
SHA256

e6485405ab702b7cee2bd92f31cf3a1870e7526487f7f168138251385ee49e6f
SHA512

dc74a4d824c721c7f5885c37ed60bd8b6a3be86f634851d4d88255f7b56be90d26e9441cd914a60fca1bfb1c4d78fcb903a6198f6ad2aed62539ec18f0c7ed3b
SSDEEP

192:2ValIsr0r57M4wxalT8Iw/w1wvqLkt1cB9euBuLbdU8d:salIcIQ4wxatw/gqcB9eguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C94F5491-EABD-11EE-9FF1-6A779E657078} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417543006"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2268	2908	iexplore.exe	28
PID 2908 wrote to memory of 2268	2908	iexplore.exe	28
PID 2908 wrote to memory of 2268	2908	iexplore.exe	28
PID 2908 wrote to memory of 2268	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de5b123b9843113710de6111be7092f5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95afb97e40f7294897ae6df7375b3483

SHA1
746633a98e4886c42e40d629c3b881f6d2d6b406

SHA256
d6a267ae0736d5fd7d7bde67c49c66d353c0e65a1bc9bb0e9417a7688e5c077c

SHA512
24a950d48ab6ded1e8d6dd5d1c6d5f083f9a0719567411285d79c77816b830d4a12856374194fee3d42016a9df03a564a8693bf9515c8957441efb0ecdd4b49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2135fe900bfef659419bbf013d757f90

SHA1
7931967e7df8e1c123c33d2e5382508a41339f12

SHA256
54da8c7c0b53c010c19f1898f5121a104d66a0ef9cad30d0ef0aeaf3e0de0829

SHA512
7c2b2a44fed3e222738e9fecedcf4fed723932d510582e2df8bd5084810dfc103b482c59da92418b453972667cf081c50b32c636239ca315050ebb764d736f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a65b416c49815c04db2cb2aa4f11bab7

SHA1
ddec09cb3c45b9a4eff28c7722f34cbc707c1035

SHA256
6c36b5280c139e4ca93873ce096c71c85893025ee32706f168b7c42f9fdcd93a

SHA512
a87241b8b5c8404d495f2e9a45ca3350c04a2ec51c15a71735e1cc1158e337220164fbbb2fce112d36348dc43c295955daa646478af0a047d46c470c956c4bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cac584df7d055271a0011ef1323e5e2

SHA1
01540863423153761d7118e2daecea44cfb6dc0c

SHA256
cf635f582703edda4a64b877d56316a5a860a2f25c86390859750c40aeb72f8f

SHA512
33af98c21c678a62f836664237c8708f2353daa4e480c20a611ce3cefdc80164d4fe766e048a7764b41c9a146a2633018de1063fcc59c2d72743625a5702e255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd4dff23d549a088656466c1ca8ec0b4

SHA1
20193489b037b972b7ff9df53c6f6f1f2c7c5bbd

SHA256
20b8da7cf76be7583284bc106699c8bd8f7b0b1558b5b499eb7007b5f0eb6db7

SHA512
e3e1539f5a8049bfbbe461409d37a86754fcb0e1a30f34803e906da97734111d235d4a0e2e102be94179dacc6a561a71ae9ebffd95ee64ba56d00d44f0594ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a4511b872b3451de338fd9556422fd2

SHA1
66e28843eeff3a67e8d21207202983afd19cca65

SHA256
a24f108121d06ac0ec0ad0d50f1a49b59463d70dd79c187f398577c866f76240

SHA512
552a444493395d6411289b7a1fb7d525b38ee989d259bdda79b6728b2a6fa7f997905e508ded4fa424dc9c1baf40f6a4298e389552b352fd6cbe4be6f1f69223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c369123cbf259bf0ceae40240b152f2

SHA1
bba8c7fb28af5e11e8efdd0e14900bc6bdbec04e

SHA256
bb0032377c38beca1adeb95fcf7c361675da637ed3557da00066bad2141bffd6

SHA512
18fd252ded8834981b846e19e15365837cb9b086fd8bc88cfac11e15fd727e87980ea98349b49d9e0de8df7cf8b14d7faa1be792e824f9e41e00c562f32c0084

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab365E.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B31.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit