3537a59718a65a3f8e436da0e44ee80d5854430f713437aa5f94bb9316d5a942

Analysis

max time kernel
137s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b31556289f888100316dd214fe3929c5.html
Size

2KB
MD5

b31556289f888100316dd214fe3929c5
SHA1

005682b94edf2f733b6a0450baf7fb7690139927
SHA256

3537a59718a65a3f8e436da0e44ee80d5854430f713437aa5f94bb9316d5a942
SHA512

0dd456ef03beb8b197dcbaf9642535af69b7571710ca397bcd6e4270947181804ccb1a90a8ff3c4030fcf70bc1dabbd604ec55c6d597077e1a82808d4279a8e3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a1b9f2f334da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409424369"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DCB6AC1-A0E7-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000dec9faf49f6a3d03da73788f7a9ded9fdf43f3ec87a3f4f1df5fd9e05b87fac000000000e8000000002000020000000fc831d1ab14d71cda633b0581a989fbe25fb3501f5a442b00574a8e5a175a18320000000f5317bb57db259164c38adb2bfa672e5658832c940992521519f91cb58116cf64000000041bd10f892b82df122d1394b97ce82222c249d8955397ed7680291c5c6f3657e2ff5ddc75c7247941fbf52569916930be4dfaa5c581aacb47d4d23febf530b1d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000579087425aa97527cc1f7bc5399b4da88843e23edc6aedbc91afb7355682f22b000000000e8000000002000020000000447d619333806aa03b44eb40bc15c0c94ced4a56920bb51273b45c818e59d21a90000000e29d49fbb6aa9f53dd20960229e4b5ff3953b7bb09b0ad15ec62a76ed5e719fce11000b25c89849eef29237189836edcbaa10098304a94db32561c1e835603ca63ab2c5561d7d6c36fe915e3e0f6f3185c404dad44cb9f9d997702031b63efd5f6c399ac88f81fabf96eb0ff007f32fafb24f965f2422e1852f35931743b125800f7e49679b4b808442697c6b5a6bd4640000000fc49a883e1485039f320c6f79164f84f38a1e01f919835963969745a1666b2619c9c4380a52fbb2a6fef86b8fc3a1e2f12dbc1713978d46b8bc3ec62d04f8143	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	iexplore.exe
1988	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2420	1988	iexplore.exe	28
PID 1988 wrote to memory of 2420	1988	iexplore.exe	28
PID 1988 wrote to memory of 2420	1988	iexplore.exe	28
PID 1988 wrote to memory of 2420	1988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b31556289f888100316dd214fe3929c5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b8d1d3510c67570bb15b91ebf7ef0b0

SHA1
f5a3aa828dc78bfb9be40bee504ba9c1ba7ed835

SHA256
5c15cf3c0d64994ba67c387a5c9774c1fefc9344d0946b776895e95fa83a6608

SHA512
5c9b1920fcda78a802c69047b46bae4678dc165a92221f02df144bc2939babfd664f36d0c94af7648bbaac2dee3c9d3b4b23402d9ff6c7f13e25541508bf5bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40765f83444efddc5c310c478542ee1e

SHA1
cbe9ba0fc7e4b3dfded435f238f4578721397bec

SHA256
cf7d90ad07150a674e21448435672fa3a456e0431e630dffd0dcca125afc0258

SHA512
abc5cd8f8533a27867aa237801f80508eaa4974fbaf9104d7fc1e82e52c2bb91e7ed03dd64a256a4578068c2d6803085cc488accab380586dc4938babea1dafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12f4ac3855f82f2e808c6b3477eabeee

SHA1
258998a420c9d18ce09910ddde81911be7ec1135

SHA256
28033c457befd48f65d01e1488c1aa2926b43425514684e015b42693330d1cde

SHA512
ee60f02bbb4b521a96c215bb8c3e752f1525a74be59a4ec522e55b4c20f0e9f604f811654d9b806e828f0a94ee8f5dbd443c219df8ebe81217c07e8c585de8dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64267c5a49c079dc7a02e6dc8fd45b61

SHA1
fef64199da72af251ddf33bac6b5374ae11f17fe

SHA256
58dabd97261a34a6ef1a559daba12a468a8ca91eabfe870201cceb89507cce1c

SHA512
efcd30a4835ecae1395b2f83bb98658b271ac51ff93b26c9bd8d9f71f6ae9440aae265b6076e2a663746540af6eaf7468d25151410cc34ba76b8c728ce206064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f7d4fb293eb10c3d92048073b70c65d

SHA1
40fd3e560b5b8e355685b5f79a19e071b1031853

SHA256
fd7571f39360322a4c4c941f24798a62f03cd32b908029bac6b0edb1b5fdcc19

SHA512
695bf6329b23837bc82d6c0a5f4d542e10c2363237f2d74d3586a583925f9506b393450cf6343324830b804e91e4776cfe716c31b6e7545b3e4490d4dffd97f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1a09b28ea8ef61f281a39b973510c38

SHA1
60737114eadd9184f87c4af483b18abb8471d3ee

SHA256
afbc8880cebd0bf5a0f539ed62382ff254b9c925ea25d4b6b4c3e533fc4ea1d1

SHA512
77d9fa4d6d8d0611fc99d93e105c43e12291894d596297d9f4a2fd92f8cbbc3f2b66642d37fd62ffa12df898b72f63c36a02366f261f55982c07ce1c35aa3715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac2e0cbf46f916c64623697571a80c7c

SHA1
f5b1e84858fddbdd28e552c11666330253a723a0

SHA256
f37ea534773398c0f3d951f8914186df3193221c29881979b9e47fbe17ff5259

SHA512
35ab7b4c879da17990784e0ecce30c79d73e6698a86a009cfa5411b6df783bd9ad88ba3e5fc55c7f0cbc2b09b19527e2791484d1c9982b179c83e1563228f002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f2d5030b89690849626b2d4c2fb92ce

SHA1
10638e414fe3f07496bb3273867b917e8ba95ac7

SHA256
a88d582fd63b8459c645ca82e83fc2ff8d4d961e800cdc1f35d3daf543867111

SHA512
a8a2b161444e0fcca14f451a41c579805168d8c980299296da4d7bf6988201b8380d35dfacdc49ea37798dfa88abd8501686714f318444f9bdefc2ffe77d451b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b10a9c767b4a00321df675fcaa7c575

SHA1
35a98f7df015723548605eb53469932b17b27363

SHA256
41df119e0ca91571a47178df9ecbb25ea2c8febc010e23f44fa66c6f356c7930

SHA512
47d53a44ea2aea10856b5e5286d31725098c1177868148544f39dbbbb08b8d34b7b1d99cbde8016b0f3ead06a754d6d818db01c9a9dad8e0a99e1833c3d55b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53cf26f97ee159edfce650514a2bdf74

SHA1
44efe677dac275f9d9f59d9eb4ece99938dcb870

SHA256
867e41a645e39c29e9c30a8b8b8a68e3e322cc56f28330335037d24a943e853b

SHA512
ede8b1a461cbd7ad5745d6f3cb938c3868b09972ccca7c632710af8c5720717a9d24c649b4a69590d62f4e7e2901b719271dd7124cc55d7874c2946f91d95a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6de79ced148306a2988e867d4060d1b7

SHA1
537a1ee20941e598c8679b78bff44bcc56b22858

SHA256
f08843982052f7ccf8ca9988d9d6ac77bac8695f900e273f69954f3b1b92995a

SHA512
3da13829c709ee627eb30b641ac01f59552dbafa4f28ea42a8098a37f3e58f16f556c528a1181ef32e56fbd5c2957022fd7aa88f4f646aeb3382b0f164d81767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
758b30696e5316b2382b77b099498064

SHA1
6c1c6e9fbbb2648c1d611a85559a348bb1fac344

SHA256
451bf2241787fc1bffbb8ce0bfa63372f9229e960e621e760e2df57b0d26871a

SHA512
c6f9e3660968426ae2ad816cc0c0ddccd1799c2d1b53677bd81612f1fa2988b0e963686e9c12d1b0aa077c33d199f6b5894dbac54f7ae0e55f448107d049743a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eaf9192ad160cd2406a673c7ca827b7

SHA1
cda0cfe7c22f865a9b5b81c49bf4cf297e1f277d

SHA256
5843ec31f44a44a583b77b92106695e0eac3049d8c7b99000c03d6030fbab5b9

SHA512
f43900bc36d40e2bd10abb8e77012c67035447b995f462f2d9dd6e2a66aa1c3cc33c00f25919e96245474597e0fc3145c53b27c6ea7113d978278f3fb06500e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb15cb8580d8f5cf2e7f5340f00f4181

SHA1
2a6e85ae1b25a1b6b296d30362da7ebc304f1ae5

SHA256
057694cf3fd1da7a7422b968a84141b86c0604995a19b015e8b8a28c83efb03f

SHA512
89f9099fe4fad2efa2b8bab1d6e439c078e306662ec5ccb7f5fe577b1775d33e57b55bae3b37f2ca5552ccf05588c744feee4c47d6ea33a1f7cc76ad3b337198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf5b28dff081029f3e83026b7249d99c

SHA1
fe6e3f3214ba2c0329918fa1b915f3422c577ef4

SHA256
bf20165910acaedcaa5b840d1c609178a962a688e3d38d285699e5789e4d9678

SHA512
27161503f8a6c2d25e54ba05ac9b504763349a03045c31d4e17d2ca48be1c5f110467c789520a3530401d9f650a197ab81082b28c5a80e0a028c6c88f2525823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcc49fa2de468f9b56f000964875b7b9

SHA1
5c539f699d406aa5e92275f94b04e01adf997812

SHA256
b1d53375a33b757d44e8d07075f3d4f2939d6f324d9cd799f80ca8c6939a6f18

SHA512
cf4c689aad77c8af6bd40cd0dee90cbc9e770e1ee897ac9a0c07c0e74a256fdf65a84015700be772e25fb4f7c1f4976865cad4d0ddedf6033b01f9186db40064

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC8DE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC99C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit