3e0a75bb0af4f0318ad0c81e94e94f956bdddd639df6c43964d7677c28e81614

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

238fcd0295e8e7cef850dadeea19b3ae.html
Size

2KB
MD5

238fcd0295e8e7cef850dadeea19b3ae
SHA1

7323bba026360c9609b695e32b07842719a9b3aa
SHA256

3e0a75bb0af4f0318ad0c81e94e94f956bdddd639df6c43964d7677c28e81614
SHA512

85dfff94e054f2f5e67d4e809bd0cb423c1ca5c2d60cf58476a992d9967b9bcef569d4c19bec4c9b3ddb81fd27abf1464f352992e5360859a0bbb402d70f7413

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409929474"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04bcdee8b39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000158cc7a468db2330b5be075bd86548f87f2fbab9a34dcd6faff6542209aed503000000000e8000000002000020000000d367ef0fe43d3d3ea6b4e7381563fe3519b1846823955a76cc6d66175db4029690000000d764b9da1795200eb34ac542630125a2fdf9ce802dd52e05c96dbd35b738c6791540f6a277a29bb8148ecef47babf073141a6089db6a1f65080c6ee2b7d91906d2d5d4f72d703bb297f312b2f4418858695f39a24bd6b7dffd98044aab5ff159c82df3f8d58df3d16aa287199be1d22da3d764b4cb37f7f03f5ed5374ce2666f2f4b2d1aaac6f4455fc8f4922da94a9e40000000c040222f9cffeb29cb7caa4a1020438d89edd85be79dec9b0e6257ccb7ac7efea86480e4d0adce18a8a408784d0789201d449ed5471452db02d1709a9125ca11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000616c7d3afcfd363829ae706015e1d471a9e590adc5eb920646a8899f9fac4826000000000e8000000002000020000000c06465378a8d013c3766fc6e6b0b9d167606ccf5057331ae4a953bdf7efc11c520000000633e0096cfbb04463ef332b2c5ac1606a002109b78f904bde8c3cead755376c1400000006c9cea6b2d2a68fc3f13fafa96fcae614eed74a62982221db264111d424cf13d952199b5ea189a2b466b92db40d865b1fceef4f57f548c7eb608f2610e639fab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{197C24E1-A57F-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2316	2000	iexplore.exe	28
PID 2000 wrote to memory of 2316	2000	iexplore.exe	28
PID 2000 wrote to memory of 2316	2000	iexplore.exe	28
PID 2000 wrote to memory of 2316	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\238fcd0295e8e7cef850dadeea19b3ae.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea28661e7258d5977b0e9535670f458e

SHA1
0c3f9c82b3cef5eec8f103e33434b00e24930ae9

SHA256
4f4aa8a2e7df7ad93143eda6c58d983aac6f889142cbb7ea0567830af8041e55

SHA512
bfba24fd6010b743673b94a23f5254259de8f9f394145e59785d17eefea14fb1a69aea01ef7cfd7b1c2210922bdcc3c7ce05bbb983635a4270e240be4c8560d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80e7483882e87708a14c2fb4e48b1d95

SHA1
d8dbf3848c793d2c74af837ba8b5ea8c66d1fc69

SHA256
2fef4b6c9547d82c943456ec80561b2f8556d81d1b95d8f4eff61d18dde29f91

SHA512
addd88526baea14c1e4e81ce3cc925df3c66350f865e1bf5135d87a86b187b13ab574ace7caea281c431e9ae097b286bcce65df5473e74ca6bc68f4bf1239eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f444c6017fda72e72c2263a99336c641

SHA1
b6374676d7b300f0a8d6b0ba9a4d51ba8a985826

SHA256
e114c3efeca0001d19e0da60b5f722e0819f2808847c99b69c3a6ddf61f18b07

SHA512
e252e679cf570880880f078b8ef02c9f0b4cd3af43a7f9df3e61a557ad6ad6cfe6cf4ff15318d11f4723b71e16617e62c28136ba06a5d59f25541ae6140554bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165073b7a1df24301338833108cd2aa8

SHA1
646deb6214c35c0a73af11956c70dd09fdddedca

SHA256
1744deecdbc210120a18960256e0e5b15ee90aff1b74a42ffe9028a6eb277329

SHA512
7c784cec4aa75796573a27bc49a8f084dbb241fea53ff24a99900212b6d0fd9ba9f63b2e6c21242c7a7cd1adb636a314e9843e323983f0711ab8b9c6025da2b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb8ba2163ca9a2e466e4a3c9eb90892

SHA1
6f266f5b462fa3b2f4cbff629d2b12ea972f5b4c

SHA256
dbe06133d7d43ad3712c1462984bde21781641e856ab8dc23718f95c60b5b8c9

SHA512
20add3a7bc3a376e0635a34bfd1606abc4d0b5b790a82c642e9d771dfe942a60dc1198dd843f172bb42024a1c61468aa4ecdf55adeb9de8f3d6792646810b00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6bdc41320ac71d6820a0595f854a020

SHA1
6bc40da1515422ae19170412730a1e911c3433b0

SHA256
e7cc712906eea1fb11e6fe98293ac2e34c811d385e2fc17b27016378d604b366

SHA512
662ceb4211f6653d5dc9ec21fc51f0786682f9e902239c064787aa675c0466bf63aa852c20cc6a9a36d2329691edf5f9a0f1c13451fb86a067cccdefe1da8248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b96b4fe637c5ab3c360ef1babc8f61f

SHA1
6bd054e00ef2611e86f56298fb07bfec90038470

SHA256
191501502d14304686b8fc8d7ce34d739e75713a34c58f9f10f2e3e1f3941859

SHA512
53a21226e1c26c717045f9e79b1688509ebb20fe233da34b1bf11e6f432926c88ca33fc18d6fb862bb48ef4256972b82047d02219ac659f0333796bbe708595c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f83ea809e1d2725405f1d0acd11c59b

SHA1
ec158e9d458aea50dd852abfeb6837ee382ed00e

SHA256
fa86c797d9ca39cebb219155b453dfed1fd2d4c0691400f152416b93f60b508f

SHA512
813175f2bccbac264e0d0e19984af001474e0bb90cac7cb13ea6862f2397a6c4b475c3adff7cfa686cb87f50ac160b7958b3c55a8d0c607ea0cce6d8550ddd9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8613.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AC8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit