4bc16ca2cf85dd77314c07f36fd006f309013a03f2071e76af9e0367041f603f

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3032bd2407435966aca6ac059c710e43.html
Size

3KB
MD5

3032bd2407435966aca6ac059c710e43
SHA1

512cea155eda235c677ae7991c389c59ceee4ee6
SHA256

4bc16ca2cf85dd77314c07f36fd006f309013a03f2071e76af9e0367041f603f
SHA512

7efb533467135d90df9cd71cee61bbe477d77a4aecfa1715c5b064891b94bb534c8f2e9cb793b77dce4177a589717533ecfdb75cc63bc1bdb71e5de4e1795db1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409976408"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E1A6AD1-A5EC-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000004581903e581b238934b09c25654bf857268f38c97c67f320a7945b234e975fc1000000000e800000000200002000000090fd0d2272a277ba3c9aea23494d5579794f78ae0993f72cf52b98b518e316f7200000002f48e95a4c9cf7ee1868ca4851700e14ecd1bc2b660fade3d15b82b91409e0394000000068f05d5aab6b70568445c3b17b2380469afbc5024163e83fed540a4cd390e7135a97a5391f8b23eab9484df829115a8e49543edc62cea79273cdd831d57d18ff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b047a742f939da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000025096eb54fe33b01298eda2ff9d569377ce843e701ae6ad4d6d775360b11a9bb000000000e8000000002000020000000362c0952be1309b6176c484e4524a332d99b6f963465bde7d529e79c49e1b1d2900000000118030d7118b73bbbf5c7e6365dd8bf6d262a7b93b2c70333b2ea0cb90f17c98fa78d99c5735362dc654cf4c8a747abd708fdd16f1ed21cb387b7280e0563b4785ae2b98e8bcf6048c99c7bbc2915b1235f2a786aac001e309f9926d4fa994152639203928f37505912876b21bfdd4b44f344939b75ef0ff92a6d80c06ca7afbc5e9f112d36ef0b228e48c01777c7f640000000e8fdcc511b49a44153234457b6cf398b4bfc17acb4db8cd7607f07813ad6a2611cd844c0ab409720d19697bfea7ee025a931b90fd48ca0323f22103d056c6db3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2356	2248	iexplore.exe	28
PID 2248 wrote to memory of 2356	2248	iexplore.exe	28
PID 2248 wrote to memory of 2356	2248	iexplore.exe	28
PID 2248 wrote to memory of 2356	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3032bd2407435966aca6ac059c710e43.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
334bfb60cfb0056a589f5b5a0da4a556

SHA1
69d8c94bf105cd16b4570ee10c23074715d63fc9

SHA256
7e824194baab2ce15cb5420307f15e7b027094454187d5c73ebb4d398deb80e5

SHA512
2d6a00cdb2e18693b596e7e391eb4a3a1366f5dcafa4dc62466fe90b0e06e0f642f94634d26209d61aa0d7ae35af431d40649078990956ba83918cdc76e25aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e6c0902f79a2295a34403a120d8b0c8

SHA1
498a9b86105a02852241d24d9824089bddfb29ba

SHA256
f3b4875ca39ff0e2065cd8bdb1f5170b7572d090588ca7c582577598dfd68eef

SHA512
00c0642607ce00292350fbfc7a5bb7e69f6f68cab7d26848f758ae2e892523a3128896be408c4ae164f26e1e627a7b29cf56347097bb35faf480d16e3fbf7a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af93468ebe52d7a7641ccbdd24966981

SHA1
8b19761a68bcc0f4bbf8f9614ef3ecf8fa2634bf

SHA256
a07bf52e11134237a11856ad6dd8a8d93177eb112fc8b4c35297f8b0e79ddfb1

SHA512
c783fce23178bc7e605693583253472536f4369cd2316a6c2452f6d2f3b7ed6d3087411af4f49062a79e2a00fef84962e13c47da0e0d31c483333a6a53c372ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d3b005b564c72091dba53fbeea26c8a

SHA1
58df2fe1603ad7ed7fe4c4b486cac7db40acb090

SHA256
00ac835c64bd4d11fc3196669ceedbe0f720f4e7bef7fc73a8efed42db22a86a

SHA512
67e92492efdd092d12565d35809862e0e64503e4078a37afa6689cb570f2dc5a6d5923a6149aca44ed5292963dda94a7a68c2c68a7ab166cbcb410488168fd25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ed5c2713cb4ca7926a50d2ca4b2d4a3

SHA1
c5809723f3fbc388610203b4023d6ea880d26efc

SHA256
8700b0af01ec9a2a507ae8b492fa496be4240f06d577a9308cb4a3dc2f405af7

SHA512
f250179aca8526b2b6533edcd386f2f9c4cb5e908e8206350a1786e69454f5ffe002f7eafd7defa430f94abc253a58e06cd67af5d23caaaa813509166bef60f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94f17f5ea11abbed70c6410fb5005904

SHA1
87e59bda1087b6ce76bd72cbed3464fbee0ae2d4

SHA256
56297130796583a200e778d4dbfb46c8a4b4b15cb0af2e00d8d5520f88cfaa2a

SHA512
72f992a1aeec3203b41c8f3dd10c323b2c7611d8dda7c46cb2e4099346c6e607fd89fa6cb212ae85eca69df64fa182855b5e4846ec7935f032a15da93c7c11dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54c51e9726235fd6fd60ed5f8c01e751

SHA1
1a074259a294c4d29771edc133679bd9204239ea

SHA256
d02efa179ca545d387e7b830c3cdcc5276f1fea29a29cb1c2fc0e5bd9eeb0045

SHA512
6bac63456b608087616cac53cc512f0e386ac30c533efcbc63a69cce1c73d5221a5109679fd1abc402e5fa7ec7223a7465ced0feab45cb8ba23f5191e6c327b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1bae51af091ab52bad41acbd0d121b6

SHA1
db4bfa7add3f3cbc5551cd22543410d84482b740

SHA256
775469dec5837738e0b47a353e0569f8e710e52e6d4ce241b09050bd9aaa4ed4

SHA512
4bbd74ef31a1d520f98adf2afe17f4714284652c44af9e49937b481d28ecc33e58fd95cdc18f1b233cfffd559fa2cfb5b6d5e6ca6c12934c969f36f11f14c2da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a756927563d067cdb901962fd2790d48

SHA1
d3151cbc7905a1711e097251949abfb0476e66cb

SHA256
97cbbd00d141bcc3ae17cabd0f332b73986c2608b1e3bc23aea69438e06d79ff

SHA512
f2b513df53b87b15c22fd1c2de75db4d21b53f10c09e8d0105cd87e58f897cdefa514d30b49345b0e9c4ebf3ad495d1d1538d52b920b21876309eedf89911e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0ce7d481699894993def82f9f2f40eb

SHA1
fd520a72a245db3e2b3d74b4e32a86d1a59d7fe4

SHA256
d7513d4e89082674973845a48fcbd8908a18959b16001bf3ac5ef8496a33b2c7

SHA512
c7d43d381f56badfd99e6086755388e5a88e338fb789ca8a76c2db9e5074ab22be659877f697834c85edfd3e4a6d3880cf6a172e82972aa85cc59785fffabcb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a08bdb47cde0fbb53e8db42c5f6d0c9d

SHA1
6bbfd33834c58e5670880eed9c647c9ad333d665

SHA256
ddae57ee6fd48252d075bed13f3d37734481dbd76ce8faa75edc94209c5b0e20

SHA512
e8ac151d50be2e8114f265e53dde3774efeceb5e6e77e34a8a0e395143f49694a2479ddfdfbf09859c0096592231f39631c453f1e7d7585e42d45f43a3c7475f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c27dfc16c6a6b3f3b7744b19093e2c6

SHA1
571cbd272fd2b69189e9acb2e6e57f8dadcd672e

SHA256
6db5ad1d594585b3d478da2208c5f19bb7fdd4eabd9db672cfc032a9b9bdc629

SHA512
ea789ec52b7f39fdf885c09bdb4074979a6e1d72e81fffedce5e699d59389868b227b2e6f18810f8ef8209e248b9821655fed5b2f39ea17011ca7c23db213cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db06906dffef95f07480e180b55ad1a7

SHA1
59116a1277a0c9dd0f0dd6b326b56883cbcc564c

SHA256
9a7ae80ab8b12207785a5f5771f8b257e4f9105ab8fffe86fd77bbe2f9b67cc0

SHA512
ebd84c0d1b5c31b729a7728d2d0410af5bcb3eaa4bd7fd16d64c5feac7f102a667f07fd530f49e0f9a1c2c7f53b883290f63f0fbe9ee92743d5d6ae63f445417

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C61.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CD1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit