e0c44bca27346f7a6ce47b72c5bd7dd351d185f220ebb292f78692fe6b109d83

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03cfd3503eb3cad7bb190b0c41fbcd56.html
Size

31KB
MD5

03cfd3503eb3cad7bb190b0c41fbcd56
SHA1

0ef05e5e6acd24fa2ef7c1cfc3620f116a5abac4
SHA256

e0c44bca27346f7a6ce47b72c5bd7dd351d185f220ebb292f78692fe6b109d83
SHA512

7494d81e83d27d91d77f92cb12f2db65fe84f506995dc106a5e697df77d7e53bdcc1a0ce999142695fc3c0a031abfa2940fd44055523464a5e213f73147bb650
SSDEEP

768:Zcd9QZBC7mOdM4HpC5I9nC4TtVfw3wkwlUKwPd:gQZBCCOdr0IxCYtdw3wkwOKwPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c7672488b6ef294f57ba499d8cff496e049ad1b452bbc6bb1333010ccc06161e000000000e8000000002000020000000635fbf318bc6281bbbccf97bb2f7d079b92e9a7062161dfd6bf360fcacf8787e20000000c244d032867f2b8c8991646320f3874f19c9adae05fdc861de798a6d5d41d2bd4000000062e3ddef9a5b1e9615d8850aa147ba681528800431fc67f7aaf2cdf32ae64320c512e8761eacdec52c4addf9758071fddf206c8de6ccca3ee0873b3528aa77f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6703D371-A435-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502a34554238da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009445086f1b3fb7507dcfe41220d5a49e72a95b65b849d816bfcd5133a36d901e000000000e8000000002000020000000fcc8560e565072ac95459bf9f5b9d86e5c7d0d70a0e7c443c9e013fceac6f16390000000482470505be57b12baa460335daa4524270ff390b3df250c63dee71d25e677887c6ca89c99835cb075c0ad59965921e69a0805ed7c9548ce3be54bc91ff17733c2a84182b9718046d311f208eefaded3fe42b3e7783962e1332a4fb34ec44ce9bf36f7b38e93a05f958749e59ef9ed875e03552ccee604a935d10fa8e11ba1b73d1f06487b5f0ba775013329b8110bee400000004e996984d9878efa470235a0a7f8ca85a550b0fb0d5ddfaaaa5e3f3079b63013e99698caa91bddb0fa34aa15aff71d9ba2dce56f12ef0b0db971247a7bf37eec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409787847"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28
PID 2856 wrote to memory of 2796	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03cfd3503eb3cad7bb190b0c41fbcd56.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0705b31d6fd6715fd6818f44e9d672d

SHA1
a8d5190b514d598b063da1e41a8e2cccd11f2101

SHA256
8b8d24be8bbf8fe3e81abb359d4bf90dc655203410a5827249ee265bbfe020de

SHA512
819c8f4a616467cbdab6d7f6e0c6ee83669088a7ddb5f7890703fa3b92571dd98bd34db6f5d9a47162571976b5be78e38d3fbaef79ce2a80e61cfdaedc4c5140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30c9626971d1f20d3f0606d33abb0e6f

SHA1
a3b62dc8328904e569cf907adbfa406d46448ff2

SHA256
12640c1fe9512049beee91e778eccc96d2b304838c50d596fc36edb85e115dcf

SHA512
49a314bb8061ac365e0e4e100d4db374d2dcc4d6da0531f3bd2682a24913ed0e198913002ae3da1af5d62f5bf5cdefde24bae2c9293f56c59a465f7f26c1a06d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3fa6eae21acb88e1ae8357529305306

SHA1
b351ffcfd489b9ce088be4a094029762816050a8

SHA256
c4502c6c252397558497251283ea40cbe835bb63d777b92e01b90d0663a7a702

SHA512
6b9dd6da848dfcc4563de16b4b907a8b9945c78d881f39d5cc82cfc4bcdbd751a52ceb7553a1e8dcd001c066fee454d4d7ae4d8f8e37ce73bbee91252d7f865e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1ef8fdc33d9ad2bced00ec9d894d42d

SHA1
9b46815b2dd9fd3485874ec6c3fd9e1433d006d5

SHA256
1f59f3263e2962115cae0a0273f849d760857477de703fc9a32b392e15647fc9

SHA512
5261a8af8b0d5ea381828a4e2d00ab3ef82ff297ad4992cce3c241ef56e205758c6cfb0c3b99bcd26bb5e0e2a142338a0bca6952b7580de2f29770a6b56f2e18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
397f784bc86d925bd6abdf4bc479d36d

SHA1
07e90736b783968623cbb326cb0f35277f25b66f

SHA256
826f7bbadb6d8d8839ffb7725888dcd15d9a42f55ea87d21527331193df18aac

SHA512
aa1da84924e53d910b9f1cb0ac8d7518b6f58766645cd4121195fced4576887b75b47403514406ba9cf801b51dd477d696848a59024917fae97fe5a33d4cea71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1064afb52ebc2b77ff9e1e954da7a82

SHA1
8d435b75a895fab6aa3c2ef6efcbd1f3e5bd7180

SHA256
3532eb1f056521b9c95b8ac2acceb14b5ddb7d87ba6b574582f8c16d755fdca0

SHA512
bc4481cef25e3b841d1a138741dd515116e0d464c6c9f614841a64b6741ae817370d72f3ed484977f74e857498d1dd3c06bf479d57f62ebf4055a87cc8a8f74e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ae0add03c5e155250750a9115879a43

SHA1
e853d1ea6907f5e970637a7152b534a626bf5c33

SHA256
7c0a8857fa7a59ad2a9469cf11701d53aadc1c0de9c8566dab316bbc0cbd72f2

SHA512
21b9e9f2233e81f923335bc7e8c599413a0a25ff15feab8b96a07d010387ea71cd9b5af4d6c0dafea8ddeb1f90660b2c1822d7592e6433da4e99f27bdfb86605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2ce0c4e6ebfd93e50e7991997bcea1e

SHA1
00dbf425f37216506d8082771ae591a9ca69e0de

SHA256
2dc075cdb4e448594977cab6116ba5c70fac9bd76b3776f371df12d67e230871

SHA512
c1c7a5945b7ff029b04710b2773703a7b1a2acddec607bc8962c7c9927cfa4457dc5fe0378470d5927a753cf08dbd7813884d9218b0de0b9ebf21fce772628cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
427f3843b3bbfdaf61dddc66c02510d7

SHA1
2b928e559e98ee4fdef2b121c401002ce97dc27f

SHA256
c26be5d6b20db54707f8d7c57b4b8d7d0e0585077262f2b9f8da113ea4f77ce9

SHA512
c5223962704e225dbd2a18bc6cdfbb5114c60be2cc445299829d8aacb7b827c8f350aaac9fc9695bee39d400bc4561c62ddc09c4ecffa066d60743bd03b358a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968470b2cde62f1c48bfd84ab999baec

SHA1
0642fca08afe2dbc701b8cee2d48f16a114addcb

SHA256
02b3fc3baaaa3ab1df4593cc3fe10c93371f45c06d7dee3fb346780b2863675d

SHA512
7e8cfcf163c4f875f55ab68873fc7b6b61a0894826b69e09cff151bff5f8220e31f6a87bea90f65052ba69c4026b2760f19297dcca3791062901931bbe09979a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
794ea5547b93a74fe66f178ee50946e3

SHA1
b06a7eb383fbfbf950bc4309f82fd295f119e982

SHA256
41a0d10e0520c7e18f6cfeec7c8ad1896158beef218fb7c527a62c06e2a03662

SHA512
2d01e9ee5775682321357d5e22828009c5a03a860644d7712d62028b66dd58eb88c770bf2e18ac597a602764be2a5072e53fcd8b6ae312550cefa0689b34fded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
680dd885b0da023186fc85de1f4a6a36

SHA1
b25074d6c3ee96fb788c782fe70e0d876521f15b

SHA256
f49f8dc9e316c486b1cde9184c7dc8abe56185e7392512b5662993b71c021b2f

SHA512
dc2b2f130c56b29cd017e50da4df1404b6cfffdd6eb847c66c550efada405ed572444e0cefc577b9b06e5e9ee2da5ec52de2aea81efea042ef2f97a257d89ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
735cd7aa4d2d3471bfe4c1d5663922eb

SHA1
bea26f8053b8924b9712d553c387af804d098620

SHA256
77d2b455e13d12898c920b0a72d25309203409562202e1e22f82bbddd5dddbfb

SHA512
85e547d7dce3c5c4af54de80f7bbcc2fe8404fdabfab08ad64ab7aaa5f75f8d9093f13e89d7a63d47f966ad1175e0ca366af8d5c838b8648106e8c30c3004e31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ea592a3389fc3b33df60a92dbf5bae

SHA1
4c953dcf9fe029ae7887bf40a3e5c4b2cff7e780

SHA256
139cf7e96c6e211b8a09089fef0e1155b19de58a093360446678481ce23eecb9

SHA512
c156e5b02e944ee976c0bb561579165e6999ce78d04a0f1845a10e1ebc2a159fc0d0a0bdc8e2f039fe682a9b7289e816440906dc6367b8db5452688866d7007b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A67.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A98.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit