e418cc8bb30df74eade9f532cca9d21d8d22b5adc6b6cc2d1b5017da2657f95b

Analysis

max time kernel
65s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a3f90dcfd3fe12d26ecc088f594d385.html
Size

52KB
MD5

0a3f90dcfd3fe12d26ecc088f594d385
SHA1

4df87b278e010955a71ccc9b902da2e47b4a78fa
SHA256

e418cc8bb30df74eade9f532cca9d21d8d22b5adc6b6cc2d1b5017da2657f95b
SHA512

fb9abc2869265aab734f64b20bbbb94da6084dd3d96d328f2b96e459adbcca546b438c84b6ad2cc8300fadba4b99ae2fc0e8f09fda22169c38c9d0940d1d9da3
SSDEEP

768:MFkiJmzxk027m1ZahauaZioBV5t1AfReLkrvF3Sq/uPpmY/kGrIFr/mIKUpujtkz:MFkjNHcauaZXTSQIt/0mkk9V/myutn74

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ff39c8be582e6b1e411755aa5eb89647c0ccd8433b40a13c4aa14aef2f832862000000000e8000000002000020000000774b63fe54f5f63fd1f9cc187b28b31bbeb2f6617c79e3e0d2c73c32d04a3e9790000000ecaaa88aa58b049aea312dd0d38fdd5f0b07a262c9041ea5d73189d0a84929efc922b204b85a0272ddf374fc8da0b6083a7c6510f56d400d925a92a5e1a258a8ba98d6c18e5c6d49f35d28e106a03ac0b88a694f347369df327ed46b15bb36af68f1a05e96f246d69ea01bb6d268443485822377b691c1d91890d96e6de4dd7dfa4b88541795391a3c6050eae8f88b8d40000000bb8d4ce89d2289689f8d30e32b4dee3502784a548101b268516b493080fa9b4ee5b9b3bd057e853525bacc1429f07ec93490e1ab93f47d42ce553855b494e7fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61782AD1-A48C-11EE-AF58-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000c31a8830bcf0a798dabf6ffd19b314891dc8b1f570ee629930cb20b9ad5c428c000000000e8000000002000020000000ca417f0fd97ce27ef1d87fad2a4c933fc5f57010308ac28356830ce1b80bf96d20000000348630ca4e2d3bf07949b1feb6e6091159b9290db830b16701a66d3ab0c3068e40000000523f919c042844e44ca70bc895d16e560d3f6a551f0a8cefe612e65fbe9acfcec1af50df65bc247b57e1f9ae4420745a12113328ea02b852277206cbda6054cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e89c389938da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2436	1792	iexplore.exe	15
PID 1792 wrote to memory of 2436	1792	iexplore.exe	15
PID 1792 wrote to memory of 2436	1792	iexplore.exe	15
PID 1792 wrote to memory of 2436	1792	iexplore.exe	15

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a3f90dcfd3fe12d26ecc088f594d385.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2b49822a57a65c33dd8fc1cfa5a0592

SHA1
333a8b1602d0b3db656e99269e5f115d0e28c70f

SHA256
712766ef1bdf6d7eea789c72e9dbd76c62e6b1689e993f380ca82bd627741418

SHA512
0cdbd3e224bbe0dee6c625ac568556287a7c94cd28d2bd7327e16cd8da313a92dc02918cfc03cae704f08c7a0d861168ffce43991d62cb54dca94104b6a0615a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cfaccc9db66015e3a2a2b0f31cd3e3f

SHA1
ab28597c3597ef1f1344a8fb410b18b352280a7f

SHA256
9a0a1e6472a8bd85ed51721626b58f9f9b5961ebc6c5115875e08daf1d09a3fd

SHA512
a3659b20b6008245dfa1075e6566fa9afcc203e930f75a254993d8ccdf14d9f9e8feafdabe9afabbf0904cff4fec5d896782dd6465804a485f63a85daf693e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a32afc393e9602420e7400c878cbf995

SHA1
33b609a11eb3a72602aa657162be167b4ecd56e8

SHA256
783c30647319e8b497e85c02b4db646c42eb8f685747e939034c0996ea4956cf

SHA512
179040563e7e735d06c20eb731c3475d034b1af875a64a91ce88def71dfaa0845fcbb6f481fae7d44e59daf95719cd8224c46d88feab5df26531085f21b18186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119e22b210023c058c5ad92979bbea19

SHA1
f11908ad65b4e3e03180cf0a59521c8aac4a8da1

SHA256
363c06a124cf19d88f1efb7d9f26780bf8ec16ae011e9137f6d5c23162365c41

SHA512
8c920f4841327f4ded0137aa37da984add94775d7a82bee5287069203d3af26f37b8b78917c3863808fa72ab1ebf801d1e259aab7a0b2c2612b0d8d042ecef30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ac729d3dac20b933d9fcaa25c3284f1

SHA1
0d82f1283392b49ca94d3c262eda21256d1237e2

SHA256
ba2b21c06c842bfaace4643e88f89e1439d140d4727b70f1bac12f8805632673

SHA512
79bf70d56c2aea2c3d47714d6279622ee2e7049c19b5ce6197ab8f007f2e6f070b480d48d20c9a9345d63558b925acf2252f72848ed8292a168422720124b79b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b74e6e96fa9fc43577a72197f87259

SHA1
fc02743d89d24e443a28d9c994c61be55e90e2df

SHA256
57f15eab2198dd8bc59d4397143ca994330dac30e76e1923e21fd286dbe2f64e

SHA512
32804e09f4aea11185f33f1fddfa284bbeefb1dbffff69a036891fd993de0843c0b7b6eec6035e98881aac6e7e2e22a6b6c83d044fcbb106ed2ad1cf555bcb42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13102c91128e71f6e453446aee503083

SHA1
ee8eef00d5ae8faf5f753714b9384406e043a3a7

SHA256
48d0182c5589f6d6143332c18938f35a8e969424745e5c2c8931fab3baa2cced

SHA512
01fd77401d40e075649f7962db8b57eef4f482d346065c48aebcad74c2f38ce9b166b2dfb409d1c35496e38b4107082f412aee91310ab1c9d33058a39eb6062a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
001665d452655b0002917d194d655f64

SHA1
418c151d14c0f8b097602be61115e6b17e41b9fe

SHA256
602e097f8a6dbead2608cfbfbb3278b4ccafaa2120b1de411c486ab7cdd454b5

SHA512
2a6e11afd50125d46cd98556c5d42f76afc09d640d15dbd969922551343b5cef9e2bdca9c8bc322b36f0c7a628e6f9d907f2c1e36d8723f119d531f09ee209d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7b085a09636711c7e94ad96d075d8df

SHA1
7147f3957e1bb46d756e89b86158e74007ad0577

SHA256
81e6ceb9900e4dc90f4bb724c26f7f6031a3ac724655b4178578cd8b082b9d2c

SHA512
e85010f6808476ae9896925ee8cb88cc89647e1da5bd2edde20e57b90a5e2cc0a0f60abba121eaad56df5c7d34f3f74360655c6a71e53af61f5df468958db8e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51108cfe26473ba4fbb86e7119037e41

SHA1
21626dadf85841789880f0796715221474012626

SHA256
3ec7815ded9952e90572ffa013525bcfd34fd079ee68236c2f455ea47064ce6a

SHA512
e92e6029d1b2ffe1dff62f8700e484af2784f36bf6a4ab39eec41a07e3738e015861bf5c616fb5d029aae6b344098f62cfa92055c4b4d7abb9836a39c5e73249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e1a9de2826d0d1780d32de9f2d718c8

SHA1
db5725a32be2f8558e80004b60615c5f761b8b33

SHA256
f17b6d28a7f3aa066fb1d32eea79233f0fdbc481e0171c106b60a44cc7e30927

SHA512
e9b6e3f13d902068c0b7a1438a2d71d694bd8506f047c4821708b5226bf2678fd04fc8b2fc974231a478b4337f9155f25c5ff6c5bc4c14fd009b044f3f6e6822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9624d4429f407e90e198d95cd9bc1ab2

SHA1
472da122b50beb7ecab1417d9f89e2c810fdc22c

SHA256
12c8d3811f6e3fec3f1c6408f22a47f5e71c8362458d964e314f5f1548a9a775

SHA512
f16af9cfd8ce300f46448fca7f8cdc849593a7e541566b3a00b939cea862bb32df5d9d1dd74d3716125e26f54983dece0fe58a226ac123123c1f02609c79c08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df7fc852ad1b696f9d9dd3afad114285

SHA1
9c0f647629191e1e7af6b826a66b7aa35f356191

SHA256
54674104358d8aa7d54055b0a6013e8825b9acf47fcee0eb71c568b90beb575b

SHA512
3208451008d9542174a8a63ceeab8bb09e4c6b8c345cf8b70366bb3ab84598eeb57a2ce6c620decb95f03c5aa2e681e236ba75819fb4c1afbb2c0c4d84797eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd0b96167f5353078b9a1f5849352ea3

SHA1
a26520097aab319c7ee9e692146a5f3d31bb9b17

SHA256
c458e44af96a1996d83b27fe1ab1755f18d4c91ddf9de05002b990da07ede61c

SHA512
4a422c3172cff0543b25b3777e3b937b1cbdabbd712dec525d09a2dead3230564b1e2fbff21ee1d563ba334cd9551969f15677cb1575d4a0815f49ea8c299261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ebc32822a29d881cab3dabd0071351

SHA1
f4371ef1048aa2f777809e39652450ac99096d2e

SHA256
ecde1672bb245cfeed42edcf118976b543c89d1ae0b93b0d6b30ffed622fadcb

SHA512
b7d61bce8cb31cf4c843433cc8ed5fd7711ff32ab9333e5488c81a300ce9bddcd7ac209f92f6f555755db72549718910cf8d3ead8ca9639bd0ed2b46c33b342f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BFA.tmp

Filesize
22KB

MD5
9a3ff0b951bc9b05421810bef67fc5af

SHA1
157f97cfc9c3fcd29c466563e32ef4cc0da01279

SHA256
15d30eae73617921954bd0b0d5b67ff6bec8b75c25731fb7be4e028f03b0f9a9

SHA512
d79532975a7413645c72b42ba584a4e533f5266042a5d94027d4db2c010fb17c78d926f1a8ea552c48ad2bbd8db5b5d4f9e731316ddcf4df64529eb511ecb52e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C6A.tmp

Filesize
11KB

MD5
76f08fd4ec8a2c686264f26e1d4a863a

SHA1
1d677366579102957d8f56ccf6c5e9192ffeea0c

SHA256
f7e623b3104a2b24ecaf4dfba4b38797880dc6c8992dafb85544e3d128b37a55

SHA512
db1158cddd1f333bd74e698b9218d9967df47e07c253e9c345844fc59c68118bccb2dfc4e5692d8afae1c7ba6a910bc48ebd46190b054f11a03c748ffb0e4119

Download Submit