e8c051407ada7114329cc29ce4dc15e514c65a44d7894bebf4acab6d47f92edb

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fc3adc84c376432b36710fef90fe3d4.html
Size

12KB
MD5

3fc3adc84c376432b36710fef90fe3d4
SHA1

1f4876585b2d9c717a190c983cdeafac053b0e66
SHA256

e8c051407ada7114329cc29ce4dc15e514c65a44d7894bebf4acab6d47f92edb
SHA512

bdcd245f086a0c1577edbc8362b03e069cf8bd55597535ec172db3288fb78777829d2ae33e85bd1ba01dde2014abcfa058632d0fde20e5be053622e53bdefc39
SSDEEP

192:b7PliPyRAUWYVkx5kInwM8HfePYyCANHFQdBm+tGW:bbpWYVkx5XnNRCANHFQdBXAW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b43dd4713ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410028195"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000521c0f261a6d6b0a46987a276f8ded034a674d9a7ce3e324385532b3c13e009b000000000e80000000020000200000001860a4b5b5ddadbf71a9f2803999139b5f8c8eba5ded881ae58236c72e7b2ddf2000000006fa6f21695b5b91ee82bf8da8cfea47f05b36ed17d99d0011531f4b5a0f76ce4000000077429379160ea39d2706e94cc25861cb83c74d3aac7af213f4ee9115f95cad2e2aa068ab54bbbbc4d7ea12e20d531f2ef231d65dd85fa28c448e91889dd4cb79	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000946769b14cd8178f4115ea035a95783d14162f8f0f4474738d718bd8d02d5953000000000e8000000002000020000000fa6f0dc6dbdc4f0fc9ebd786109e0d1e4fa744fb3ed632d1dffe24bd277eae349000000022e6d15c1ee179c59f7f60d6539821bb0efe6a0b3e70249c63c467b31016c2c27bdd749622668122a273dcd8565902bfa253d375c03d4c36b952c970c6f4ae5f9e2d263303fd99d760021fc1e971f9cc40ff4bd6f3961f45f46bc5b6fb70751bd9cbad5a0c82015f32fc766d9be25dcd578211bd4fed44e83436ddbd2c05153259c98c30437615f0aad9559cf7b2c1f040000000f11d8437f8629086bfe27c771c68377faf486f6a92310c70b86f936602edbdd23bd9ece5e65f4659fc05411d508407d225ff1dff4539a14d91a2abf1eb30fea2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD03D011-A664-11EE-9159-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2696	2664	iexplore.exe	28
PID 2664 wrote to memory of 2696	2664	iexplore.exe	28
PID 2664 wrote to memory of 2696	2664	iexplore.exe	28
PID 2664 wrote to memory of 2696	2664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fc3adc84c376432b36710fef90fe3d4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d34c7daf8670d8ce8d2eb3b67274c62

SHA1
d2a60b11e3aa847c5442e8b7f6a7a799e9d64867

SHA256
3cc1e5ffc8bad8c2a030ae6bd62822092af5fb7a3befffa5944b80dffc59c27d

SHA512
0fceeba4e1433b52d0f628424224c1b62ac020cad76d39d00cad72c1062eae418222cc52b682ab3b8e3b9667983dcaa323e92df1f924e0454f3c6f9d7796a251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e7024c5539c28ae1d8bcc19b50dac32

SHA1
e789dedf9b13c24eeef43e0e67aff80d3e24a2ee

SHA256
b4c9c4a4e44beff0689cd75dfd5a6bcdd43441b83021602986e143e738018be7

SHA512
eebca0336d5162e9f8a9ee2626dad2ec1f8b1710162c4f76dc8112b56f0ab68cdebe04750997eed98f8b4fde05cfe6df7485f224a93fc6ef25ca90164b55b271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f95cf8034cc868b8562a37c96ecdd141

SHA1
62da11cfb57cd21c79e8cf1794872e4a9f115909

SHA256
54c88f127dcf308b991071de3015efcf9982785e0c20d57dbcf34d261f4f1ced

SHA512
67fd191090061e023abc4d0b73761d39badf66d18f5f8f8b74c3da2e3fd7b215baecb7ba6d41fa35c6fdd23448871da388b1ab2f5dc95b94eb325c936c74fd2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e1bebbb9173ccb3587949246f172de

SHA1
bee53e850bff2c8bf8cff46bacd08ba921bed25b

SHA256
3e8be7339c035e9cb8137098cc34eef8bdc9a782118166c4e4122ec03b6a6601

SHA512
b2f481a8fb598cd3f479a3123d71790df6b5f7c05b27dd41b3f85291794c86ebb4ec9779e744f706d9a57c81b8347d3c5441d4188cb3befee65504657ec5ff23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8feafdd0f353cf0ccb69727bf34ef26

SHA1
94c38b4c489ed6d9d0bea49be1cf7b2462749a01

SHA256
80cac4b7990349e6a1ccc43bf5eb2f22347c99c034e5b7c5f6756a96ae7b10fa

SHA512
9bce1437e4f56925006286547c45f7b1d88a00944093a9db5eb1337dd24f3fec6aaa23ab19baccc6dc21f3969c7a3497ed7b26297a4b98f37b96df62659ef70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ba43791dd8c5fc14ae69fab415dfa1

SHA1
67ee6120e4173edaf857965165d765a408018c02

SHA256
d095a1b33ea9d78cc7fcb6267600b556fc31e8c8fe932af1a27ffe61acbdf0fc

SHA512
e7a5017cc0c51bb8e8d7abcc507801cc3b8c6281f99ca63b6ecba44b3e2d0cec9b81ca1a9e35672a979847cf8c80593cfabb1baaba21528eb29f637d888b4f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3596edf948169896ee7e81cb0c501300

SHA1
90977cbcba5c52237560b512d537fc50986f1006

SHA256
768728c3089f8a38b06ff31435f8ea904353926abc944fc6d46a23ce02872df4

SHA512
3b41eab8c99bd2387418e101c7736ad7a2eafa725782387f5cbbd659cbb0282facb1e4a26994d78664e85d5c0232c9132e97781bf40cf75637d134c9bce9373a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3132d7c6e6050c9332c3b6d86a2bef

SHA1
be879e5abac4f58080b9d90bc15cd49073d0e200

SHA256
b24768067e1046ab0102def4937296ef299859462cdbd2915ad58d507235085d

SHA512
b4d0c55558a002e083f777cce913419034a1ccb0944c669c993f1a0b5020702f4120d8e18a15dc900d6442a4b488248818b077c538ca29dc1397ea62d2e8e6d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe76fdb79038655f721566e34935803a

SHA1
3b09f2260f6fc8b87f147c234f0f527082982d05

SHA256
98a66420fe894bf7b5a1b49c170797c09f2a73b220c0c6836fd1c9d1cacf0e59

SHA512
45d297901438713909c231c15a99ce43f0d68ece2a66974c7eadb926c13960b3be9ced46f0e68996c37c7872f5364252eb8ac0a9f0f184a5f121e168fb65f9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d89a4b0c5e9e870045304ec0a4d0a56

SHA1
18aa5ec96f38d85b5e8411ee2bf4bb639335a933

SHA256
c2e364cff758fb6ca24af02d7efe82554a7e600473613dfd1a4ee4e68adee0c9

SHA512
61ca3cfa8ce7aeedfed962d18e5661e1fc495ccedf0cd75eb114e938674a16391f006f8ba32d3a41fefc90d21cddbbe869d1b398d587da7a1a2d815121c060d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9cfa7036a92197339e1ec2d39108fe7

SHA1
735fe9ecb4cd072960e50c9f459c061a759bfae4

SHA256
94c52785ab7d4e0dda53b55f6e680a4d37195da3489199360d91ee75b912936d

SHA512
464e2ebe834955444628a2ab1005037017c25c9315dc4d0de839ea7356d5a08bcdf9a9336b4779c1d7d67cc8245ecc93a0688ce2ca6dc9c54fab96a5bf59fd78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A7E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA895.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit