e3721d8fb4100015435531cfc736d105c8a816cc6ed7dbb774a377498221c2de

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0267b868978c3d6d4def5b6e099e587f.html
Size

7KB
MD5

0267b868978c3d6d4def5b6e099e587f
SHA1

5792d766d145f5a0bd96cb024ecd1cc88150e108
SHA256

e3721d8fb4100015435531cfc736d105c8a816cc6ed7dbb774a377498221c2de
SHA512

02eaaaea5b960cbd8e0672d851903c8cb29064e8411b88ce6085ef8f6723904b71d1da4d05fa7f412321edfb2524dd3e3af0df8da38a412c24420e17805bd623
SSDEEP

96:uzVs+ux73qLLY1k9o84d12ef7CSTUFzfiZcEZ7ru7f:csz73qAYS/db76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000611ba8cf27e215c9c0c6c543ff4ab9f1fd0934291aa840691cd7300a522e2bcc000000000e8000000002000020000000881f94f8c8fd22b072c4d3f62c8ff71a8b606c085f2db25b653f6ee2df0f8152200000009eda9d64ab465fb51a4bb7ec6a67c7809748e7d3a8f9acd61149fc302b50064c40000000efdd0050fcb85ab549ae310a8f30598b2c9415d8400b65df2c9fd9a9f3681354066681720ace6d3a4dcf59b0314034be4e561972a72d6d2c022811da2f529b32	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C503C371-A28E-11EE-BC40-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409606332"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b53db4e2cf09279c2d1475aee05ffbf8afda89e8ba562f43c72ef3512073a732000000000e8000000002000020000000da7f2f9cd14343be70530a7bfbbbc871f9f990efdd29358aaf9159b11c19741790000000f1941e046d70b9c997a953f94dc4f92fdbe79a7dc2a2c1b63c2a3885f731d997905ac475de917828373a43d53e84f6ee8352debf7cd918ae150f5b395867119915161c61f43e6c1cd421f5e158e302f3acd8475227a55f6f0ada786e7be35f57bf1b78bde83a513f5f4a7bd5117d363f13378db8203e3fce1972fc17ed59a371daa313e868ea8f61dea5982df9fe41af4000000027a00a7386a5eebd7c54a0cee849ee1423a0172e23277eaf488ba37ae31f49373df1942592dd2b0ffaf6abd25e36a1c1ffbeb00255aaf121ceeb78f383047cec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101ceb9e9b36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1472	iexplore.exe
1472	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0267b868978c3d6d4def5b6e099e587f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
216e6bafb1e3692331a6d2623e8435ef

SHA1
9e875786cab7853045d744c653a7761f90845120

SHA256
c4fb3a03b4d5552b2c5dec5bfd00b3b868b431c855b021d0d697e0cf3b02dc09

SHA512
eb1060cbed08fc65c75bd69953aaaaf6d8fdb09480040cacad09ac17365e34adddbe0bc55d3a95d4d8ce023bc17012ee27343f3536e230f01deda2ec60368b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ef809c4935650432cfe33cfb66383b

SHA1
3342ac473da4d57c02c3e2f5a8c7a8d08f231375

SHA256
846048a0f87c56ed66461a23cde812737cba05a629d80eaea737fe46f0583668

SHA512
6cd793450fa522b83eaf4057e6fd4d6b19d5fca25f0e90a4ba03b56247d0c0f7b6ffd39fed01e54340380de906f09d4f263df8033db5575900a0043fc4a45c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0836449ac025781f51e14899af382a4a

SHA1
b6510da31a22a882a53dd1646e729b9aad7bb913

SHA256
412e227c4251272856e995bb4ad203beffc94a0ee0d47ae05412a5ff85d05887

SHA512
ef0886e634a20faf311c7600540d956f1f736c789e02a59d83412bae271374ef10450099129edae2a76549bdffe38bd08c4db583ec730cf7f11c92879a1b706b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bd329b3b11dc890f79f4fbf238139d4

SHA1
dd569b6a294a8b3f7f4bbc047324c3f251eff5fd

SHA256
91bcb18f027d3688be4861aa1f395947da7919fb7ed33b21cab1340a02357359

SHA512
62cfbfe871cea48c48aa7618895c7ed190980ebc956a277beda977e5e1817a6d4150a4c9061ff676599a887938a1bcd3146966ac0250af96f9bc37ad81af20bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ad8b032201c52f2d3f8b5ed5dcc9f3c

SHA1
107b51fd8b86c17f926343671b444557cb207426

SHA256
7bdc6c4ca4171a4d299939e4d9f5868bfe0f51f38dc17df3cdb9540deccb0c55

SHA512
d9b6ddb1d33e061c3e46b072a8914098ed238a6747af857d6f71adfe6d6c7990264bc34a641f863ab4bd078d1cd5e36319cf588fbfe980db18b41c9eda866e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db403c860bc2e17b712bbbe408802283

SHA1
fa6d051ba034ac37cd0fd7235de93ee37e47caa8

SHA256
da8914b3c8e82a836b4ebeaf77238f22c97ab06c3c6f66360e6fa456c1b13d3a

SHA512
3b71953462bfc1190ec5d5d96354896ff43df6436aa63c28122490e0aed09613d69d9121ec379a2ffdcd8d427307b81a49ac3dfed773e7df93a4d0aa280126b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ad4ec11ea883c63aea4f5ed490b01ce

SHA1
57656aa8b74de143740bccb81019e3f412bcbdc5

SHA256
eaf32bd43319f4e80236c294f11eb3bc0a9eaf6ff6e8615cf4bf62d44ef6c1d3

SHA512
4d5ebba713b7a04cb1bac9a3cb72c584595cae46c05200dba11a1a49e6d829dc678009c3fcfe52972451bd017efe2a8fae71b747de2b09fb92549568b82c565c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5ae7a197284220bbce2a7c5f15d9dd8

SHA1
99c93e5be231dd6bb0f25f2cae061604f6a9c3aa

SHA256
a88d583f5f235dbca259cb494678da021145f646d267f5a667d58398f6808798

SHA512
9362007cf919f83df81b075e7f2dd795f43f007d462dafb4f2691044077cf2d00bdc597cdcd1d0782ca9249fe006f795bbd165c374e6550c6d6907181c636b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f32f5900e432404739180963c94ce57

SHA1
709501820b1b9fc9e1038af40312a56814f7f1d2

SHA256
5321c1717216fd5ded75efc136b9d49916923c9582a139ca6dc4cb293a56ef06

SHA512
d85e7ccf14b4017b92e4ee548ab3e3859a2cae19000b0fde6a6ba24145ad57ce96a7e74a42b8a9e02f22022f6414f2920149797a8202bef1dbde580d5274d532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82cc38fd99cf40ed19a7cdbc376d82cb

SHA1
e50a0dbf17d33912e58afcdd675871fe01d45e2e

SHA256
bb0144bdfc49e18076b501bc0e77e9c2858d10b1a019d0020318a283d740ed01

SHA512
06b64eb110daa7de154678aae34c8ad703a56c367a577c31e154773584a46ee7b0b6a94553a15ef7d1ba531b90f7cba3f14c7b0edc19b88475ae78ade57676dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEBC8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarECF4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit