e85d214185f186e18b07eaca8acfa846b3fc86c518427df83295c2d1f72e4b9f

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f573e910600915840fa4518e1ea2e38.html
Size

42KB
MD5

3f573e910600915840fa4518e1ea2e38
SHA1

8268eeb99bc5394a00d518caffc50cc6dc295c2e
SHA256

e85d214185f186e18b07eaca8acfa846b3fc86c518427df83295c2d1f72e4b9f
SHA512

6a4f8d952a8b01642c2e21568df1c71b692651a9ff86b461cfeb1df51c3d4fc2c392a887069f0c01f3297bc0b06af24bbb64293e8d885eeafda9a41b81d49300
SSDEEP

768:Zcd9QZBC7mOdMU9pgaE3VfN5tlL6lEdaulgT5lhLpC5I9nC4pmzR8klozVi2/VAi:gQZBCCOdF0IxC0XAqhowBwow8/ZPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410026992"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e86c374acf6d4bd087b3a67c378bfba2de03ec41046f129df2680080c0b55eba000000000e80000000020000200000003fe921a2f06c5f4d4c9f786392905999d387ce54a2bbec6836147d695443fdd12000000012ea5215575bef6956c6b4f2c3a4918308ec56ee0fc102aa2a2cb8224e88b3c2400000005db05058ff178445076d81a166b90646d46376b03493a779790ef37ae941f962bbe73209ffea9cc50b6eea8aae4b23c1aa7f36fd5c97452c669fba08f0de0f1c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901f7a2d6f3ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000eb8ab837c63b15540752ba141f41a81ef199f367f54a6d46d04b0247e3cc064b000000000e80000000020000200000000cfb9694fa1a68cfba8fdf1cd842d983939a33655f7d7526914c52894a47e449900000002a13b9ce4b96280763db20ee88e984e7e1be7b94fb710bea61831b5bc82247ecd7dc28dd3a7bfc82a629766a76afdc91f34459ca8fae31344cc999c167c46a35c8039ff87ff7c1138b160cf22741f718952bc289f8773eb6a4bdf92b1daf22807192f6884730821b3b2111e1542b649276653bea51807ce4d2ffe88bef2cee5f0851f0514767e81f64704ccffaaa02a440000000bba9bc70d34b2dd76f8903b7f99bf6d5d80c7d82075076f6c0ef4b67a9b1c9f492bbc237b8584980c6afe2736f9b045fac71791c465e38dde59b43bbf0cb8344	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{334CB901-A662-11EE-95CA-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2540	1928	iexplore.exe	28
PID 1928 wrote to memory of 2540	1928	iexplore.exe	28
PID 1928 wrote to memory of 2540	1928	iexplore.exe	28
PID 1928 wrote to memory of 2540	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f573e910600915840fa4518e1ea2e38.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9ead7bf31a5ed65127e7e8b14c8388

SHA1
2748b0738e1d9aeaaaa4be22e7f12c6ca162750c

SHA256
f057cc7915357f28d5add7b89ec35927e78685f40165f6804a66275ffa219ed3

SHA512
5c8834e9babe48a1fc1b5f3e3e0b1bde0e7a1c7f5260ea7517acd240564057956ea0f6d538671191702c378f535f420d3b427eb9265d46cf0038ea75967efe2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7877e690ee2ccb891e3d4883517251bd

SHA1
2f1a31d7083d1b72eba32641983177a32cbd0848

SHA256
113768e2e0a063394e6f867c1253d7895989c073a245c9d196395cc592e0164e

SHA512
c3e50e79229d60a62800f3532c11e5c6f7d01ee043cd031a18e8890dde12af737095c03e48b8f96703e82e14085ca2341fd4f9dad22142f7154b13dd396856f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7500e452e617933664a128384da3b31

SHA1
236296a6e4ab3faa74ad45c7c2ccd2c6a292b83b

SHA256
a900b55c209bd15703a62dff27b436e2ba3849b64e34b96f47e4118c49c2eb34

SHA512
569a701cfe554b3b3aacf55d9349f4f4e8db8158ed56458c2a8acf4cf6bde5fbe32ee98729c8a4a60ae43e244b20bc24171800499df21e3c6c3279d4b80dd999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18bf949acd80b37bc65e58b66be1de78

SHA1
99c26141705a14576c9dedf21da2d6adfd96ce2c

SHA256
277300bfc26796822513e64f3e047430347b60332a70f8a3e92f8e9f62aab247

SHA512
5626206b09b9b7bb7322012db3b7022938d5182a6fc1b188931ed4425e6f149f5c3bedd5ddcf2e208d451cc4f3768b281dbd82d0b5b9cb9281a9bb7cfb7d8a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d95e2dc8f4efd643433f84bc2bf2caa1

SHA1
b97b6f77d013802a707197a365736bf385452c27

SHA256
1a0c8ed91e38e99ee21bc1e812f3750c8814ee8c5c513f49e49ae98fba911539

SHA512
372fe691e03d3159c9760afb1387e8c84c5c97fe07c7d4e75dd3b21eb1a3df4d768e9a9b471aa3b637049f5de6731e2e6c465f5e938d6dfa587d0e5a6fa77d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
643a2534b10a6e43728b25db7da3eed5

SHA1
1893e327c0658b8bf29727eb2bf15493e10f47fd

SHA256
f41d887fb71dec5052259213257d71e480f4b71c62d36ded2b49aa16f4ab00b4

SHA512
c7a1e1533220445abdd1a5519ea79d26d6d7869ff95e52f4756a4a30d35d1f6f23ee9d84bb609dcca925171a3d359e3fd745e852919208df203873453299b915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fed253bedb004dab5bfc3bbb3dae902

SHA1
8dae8db70a7700fdadd117969dd808718999cce7

SHA256
a7e2fab7fcc5a128b2750e9737b483c221f7242f20baa3c3e822f399c70d1e37

SHA512
b32f17f1620121c18729656c35397c4f9356e0e9515c9291a8d3706b0d125a8e67ee4f499a5445b0acf37418ba8503d4ea0f634dcad04ab35e5f757ccbba909c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba45314add2532c4d64a25e3475a96b

SHA1
40147bd7a7695f1d4610486389765081ee23b1c0

SHA256
655310f0f6bee916334af8b7d0be0df0f2ea881f626f219a4c6e32645b29c8be

SHA512
1f7bd9028ff33ad0455f77cb0eda4188cfc3606943dc57aa8f451742771b300a2c13f0252fcd1b8d6453edb9994d8232b6c640603c6a41339f657d4f631ef38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72d05350424759572d4f3ba22bfc1898

SHA1
61dbcb79d944f78e9ec553e3e7bb2b2cfde011c5

SHA256
809c709d624d46c9266a18cbecc4b400c4a3a976a53ce5c0e6bc53b4691f21d3

SHA512
b8481b601233d86f8e79d964bc4f9d905dab8f3bf7521a95d28bd882e998c57a4202323fccdd4faf689303177502620ecfb7976e4e02fd2474c144b3565b04d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
320f54891284d50f5a94662b9fafa844

SHA1
b0f9b3b53f2dc6d203aa13609fda56be6520e509

SHA256
63b0c63b2c48afbcc79dbfb617ccb27bc65cb9428d483a81515e0caa8b29d0eb

SHA512
03efbf434bee9c59b4c48eb0bb60e259f2202f9834358a1d33c9822594380cfd1d6326d7ec46c0433c77b8b7118ebbc30f081b096ade39ce7a5f029a2da29836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e82d04462ff623fe6867348b36f0ceb8

SHA1
2eef8588451bafcdba6ee169694def59c478cc71

SHA256
77e116c000db6897e0ef0ab61e0aed1f8d1415bef5002c9d21a76434b650a4af

SHA512
e85011695548aa78ea1afb31bf3bd8ec2dd965dd1e0213f2c89db945ca812e28952d63f41569540fcfb077c81531139760c8ff462aaa945db6776a783d652776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
322f11978639a25e3403f2d012d64b9e

SHA1
cc6e9ca642c69cc4ba2c78373fffe42eb5c642cb

SHA256
1e286da3798c0436c46c4c3a6ba96d263a0cfd3e689a56316a2ad2b464b3d3c9

SHA512
b3ebc630b12d9a699ac72e5d8fbc658d60159bb8e924857c919d9f3a8c9c0ef2c7de40a0e455af2aeaa552907bf1284efdc83d2036c963d9f2bd9cb90723ac64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79dcad3e0670c8a472380c6392068a8e

SHA1
2f546b724c2c9463f4a0bfc65ffcadd3ef21f61a

SHA256
e6664592640308a6222211859af610c06493ae32fc0364e9431897a737be0fcf

SHA512
093290b1e7214cc956b0c6b3de85978156f72dc252baa389c5925c6e6fa82b18ca9b3bc73089c15c8ae2b69b9e6c0036cb817075c5f2372535bebefb793a718a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbc8de76986868557144c4ce02bd0fa5

SHA1
3b8577bd14e359959207572a4a87c06aeda98006

SHA256
ff3e0346842197d973dbd85d685602716463df39efa55b31429f6ef1d856e7b0

SHA512
71da67df22be85302c8354ed161af0d724f4f19f800c9c4d4547aa641b15aae6224262c562f107b86bd8cb37f487f0222f299becfd1a26471735469c0d0f241d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f204ef570becae94ceca083d801b724

SHA1
43612bb8c1d46388047efea5405d4cd7e2584aaf

SHA256
1ab482c6ff09820d41cd82dc53fadaa04c72c1191962bbdc2d5905228aeb5f81

SHA512
0cc07a20eac8c5ac82d9c6ebe995df51412ef9452057d6f973780f437ca8fdfcd641806dfb1ce6d5fcf80919830a509e3159cec712e395abe5a6e8ad5385e8e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c49ba4a8ac5ba9c200ebf1bd6948fe84

SHA1
a1f4c67f9652f68006e5f1287f70bd099496a0bc

SHA256
3e8e8c9f309d0d95d4e47082652990f925e9f3116e9274aa844f21215aec80c0

SHA512
a2da57ff6ef72434e14c96c1db0f123b2dfb0477cb4bccc7a4a07be5e47795ca521733f67fb390a41eb863ca8b47fc2de59829ea69951000dcf1984e19fba6fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3367c487219dcbcf13d87054f77cb1af

SHA1
a7556b5b989077ac2624eb896968bcdfade8f94f

SHA256
096b25b89f215a97209e5012514a5c0571d75993f7069c0f1246bf5d5bd80084

SHA512
622b5cab12b52f2af1d758c46fb67bbae16c7e67a5ad40a4e8d80df969baf31792c3035069b38537aa3a885bdce91b8a0455db1032c0077dc65e035cb0f71762

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F5C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FFB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit