e238a419134a0c20c9253c16c25200d5b5d172ef60735c3839f56c5f836f1978

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

035b403e77c6f00cba399fc432de93ef.html
Size

24KB
MD5

035b403e77c6f00cba399fc432de93ef
SHA1

e041af3e423856741c0c1bff75c3a5f8cf525d44
SHA256

e238a419134a0c20c9253c16c25200d5b5d172ef60735c3839f56c5f836f1978
SHA512

e10ee04fe3f51f3ac9c1bfbd9ba2bbbdab7240dcad98e3e0da12ea8c36f7e12d3764448beb89f18ea3de9a91fb92b31bb030ebce7647109e412da09b91418e37
SSDEEP

192:6TVjoxmAb5nonQjLn3PV+QunQiemnFnQOkrnfpdnQTbnhnQOkRo7XJo+EwrEvMSK:6pjogYV+2Ir/r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409670372"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00a4dba3037da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fe6dca990f0c5b6abc0c5ba08d72c4b03f79fa1e0f4713cf09931b008d7cdad5000000000e800000000200002000000057a0e22bf514204a7a704bdbf4adee29f8fe1c2de24acbfebecb3cac7fcae35e90000000201886e552ba5a3a9faeac3eb58a5d1ae5466fceb3ecb66581d9498199739b6aafea786f592cedb83d5d603f5b4241701a660227716ab5e897fcc466336fbc8e6d0242a0361dfd40aea2f1c0791b6cb0757ae482fc3f1bbae944c18bbfe9dc5cb6aaba6a4998124d18666dd79860645fda25f7416b4f215f4933e7c83c3a83f599e96fec98ca8599c05dffb7f7bd525340000000034b531f6e6502b79f16949fd24775a863fc49c389b935584cb830546c3be098e43f84e2a201090a11a78562f429e75377f2783c2b62d9b439be9f273a347298	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E25F7691-A323-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000dcbfa8b3efbaa85ddcbc17ec13d7a1d85e7d10df72dfbaa76b954099eb019c60000000000e8000000002000020000000411a976fd081475bf84ee78c80fb700faa9761f5ccd22c0d25251b09cfc52b4520000000ce88296af15996917e3038d58ee66aa8fe168a0b63e025f7b3d29e8929874a2e400000001b5e7fb6c860d9695d6740bba3699eea174955f2bea1daa7605ed83bc5f4e9b4570b7777340ff42a330a46894651282aaf58510c83260a447d8e5d914a90ac8a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
812	iexplore.exe
812	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\035b403e77c6f00cba399fc432de93ef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc8a8d733b694241b86f798a51e25c19

SHA1
460b7156246dec736101918f421b75e034eced7f

SHA256
7de5ddda8425883b64c0e8cb15444b6573234ce00fea338af81469ee2cc092ba

SHA512
e391f5d63c139fe0235e58839bfb8143a7afd0116edefd39f3bfcd1d4e5c77baa701366a95f8f7d69182b3e0e212536133979ab266d48cebbab13a866ebe2edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a1f8eef08e9e11dd0299e0dc003b56b

SHA1
9c6d25a7434fee4035799eb32f3af3c7df8fc027

SHA256
f906d442172f71a42878ec073b6ad7e411640f5e55dd2b3933a494a7d930289e

SHA512
8d521e13eb49b208ea693fca280058b68da73715171f20b312e69b10e2d880cedeaa2982f12851376bca83cafea663e803b85af39bda008eaec997525eb6d38d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd5af7c3b4cdef38c44fdaef4b0d7b94

SHA1
35b2246e9cf59ca5a4dde4a228bb2be12336ab17

SHA256
7db563252db03142702b61a20a789a458a8a5501e97adac931668dc7d9fe70e9

SHA512
3dbbbf559c1a6f15323a406233b8809266929c051866628d3986c3c36eb163d179c997e690f01d404e6505553caff7465c9204ce5ef93f64fc61c7ffa5d8265c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd4b0b3f1dfb42c75f45f1b903a1fb3c

SHA1
2d007c24ef76a3a04ff0a0a1675a0d7d05765377

SHA256
71db628d5931793165736eb1cb9135cd9229ed65acd4625c6fbdfe20a704eaab

SHA512
44efaa7ca398cc59e8caaf6eaac5de52c76bb8d47c72457337f0ae220c349aaa9b935cde64413be2e2649d3e110e89aa5577c70a788b15d12bf0304deaaf0e45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f91d209ba58122cdd17755b693385e0f

SHA1
9312eaabe9e60c1de88b730d98072a723b73e31b

SHA256
8e30c0f4f92ee99c3cf92a5ca546593efe3800b0743dbae4080060ef6a7aad9a

SHA512
144ad20faab68e654f72b624e8cf2a10c223a99a062a7648ffaf27b65597adff928a1d042b4a59cf3d275b46f6ce69151fb81cd9a0015d8a779af28acc124968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad10fa6c521fd1a2735b187794aec7af

SHA1
af2a032dd33c3d5884abc622d06380314bb0f5c8

SHA256
c9c40f8449eabe67877dab271e114ca23a16dc9e38dc49ebcb9ee94486c84b50

SHA512
c745478bc964c77253f83c203b71dd779097062c181c08ee91ca84320548312980a777d1af4a7f8385cef42b9c48ef72a2a131d2ea46cff5584bc757e8bf0a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f5f6ac5e42a3f8237ffc1c73aefa49

SHA1
178de99f3f95f23d1d4b7dbd36b087e2dcec6c57

SHA256
83ef4c0d4dd233ac7bb691d2cfa11aca9146f0b797d801137efa7fd0533a6801

SHA512
e08f0624125c740d0df3c24e7507198b558afb757efc6914ea65dd2237c49fd70b97d604d4a5b57674fafaddb5d67aaa951e9d8428add4c8096816dfd559cf18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7abc815d3bc6aa0426c74b8b66af9ad

SHA1
554ccd6a9366bc772515b9c5dc33e634f4f38fee

SHA256
06e7d508fa8b14640cd6dde65cc3ef00dd2f651f22b67d61f088e5becdef5e81

SHA512
fcc73044542a3119e54b3dc21fe3f9fd9d882e5426f421ce1a493cf527b11480207a3274d66835f2ab8c79c201268788c8ba47c55cbcc7524c204156554ebe65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58782c1c738ac79c7b3cb056dbbec993

SHA1
bfff92c7ca7a2ad4d4eb0a112546e6b3847e4877

SHA256
51d3b14851c7710135df6619f1a53971fab47ff605793bd33aa58d8df35a2f65

SHA512
354d6051fa7573207ab3474f05b64a2d0adf22f80b2bca51f8fc92436bfe8282b4ba2cea7d1425070220df502565a2c2bde45114da4b5108f26f3d3afa6145a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a757827b2a900f3c139d05dc64e61ac

SHA1
a4053b55181ba4727c1f72b7886a63e579295ab1

SHA256
075811da57276a9ac04213c80729585c3adba9d2d39ed534b0de45ebd49a9518

SHA512
da1a4cdddf977be7fbb30345c88f9f6dfe6a780e2fd70045ba8db0929e2719218c2341cfdcc669313f368d99aba1524669a7522f5d33b73d8ba7d30c9012b702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67915c350febb0b157a8f562ec629b7a

SHA1
0633675e473af1c9226063349924181a09a24779

SHA256
a0263aa06e592d89730857e1862f31277106908a08382f3e64b5f22adfa4319c

SHA512
a6693dd6cfdca34a81a6d09230e053d499ad6269cb99a89ac107adbe447d41fc08df72ee992a97204bacd5c96169b908e16868fbd5fad59429c2a3782a68821e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518ef6b24d3cd6f5ec64e9aea3801ea1

SHA1
e6819beec9736f71fad2af9806d645a4c14d2406

SHA256
842f2229ee4eb70e4e2ed77758a3f733f306731bdc263b1f4d7b336884ad9b9e

SHA512
779f5dc36f2de1b79b3c55096797be3b12b17f106829337ae815f796f1a1952c56732090d9bb3fd137e9fe128c100063b36b741d4dc007be8c528d1d137715be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f39aa56862c968049806b4fa1cdfa4

SHA1
78d7e0864f03ec4f82d92d8441f905a481e49cd1

SHA256
e3a547e07fbb020ac3a3bfded2c9db118da949f718c7cb52f53140ecca518761

SHA512
e3e45670ac960dc018d1bf6b7ebb7598d7a06f7cbbc3e7a70146efd4931f2fd5afbee907425e37ce0e73569a686f797da21ce47abef21b94b7496795f964721b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB5F9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBACD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit