14411a52ea0f3162c1af1563acee67e07a92fd962acd7a7fe51b5831318e1177

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32b791822e21dacfd7f825dc89c26784.html
Size

1KB
MD5

32b791822e21dacfd7f825dc89c26784
SHA1

7a5c7c227531111ce09c37c5d44a9e3702f3f8ca
SHA256

14411a52ea0f3162c1af1563acee67e07a92fd962acd7a7fe51b5831318e1177
SHA512

216a40a35f4b10ec7e8b66ae1a48267ed2378e0a0e4f31069e26b1e7456e5928246ea2577eebb7a8a78115271e546c3b653486983b23abc08a599bed2b7f8159

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a9612b9eb9c07ad403c0cf26a9b320fafba8841159c5c05ae4a2d34565de6d58000000000e800000000200002000000025c8705469bd23087366c8db63e1d3c11e5d98d233c78b7a27a6c59355239bc8900000004aea0d495e70fd5f9ba63a0e64477ac80c035c9c3c302eee6256d34d5afadaa4caed9a51e5a96ffd38b54d34babac5a13d0cb575c768f49023cb60ad6799ce039ca085738ef94f78c9c15c44a99b2597e32043a9bf32c3be79e33f2ea35910c319166c239fa3e7119dc4e65addb0b5b71e9e049d70f23ce3366ce11d82d9062f69fb56685077ed2a4f5f787de3af493d40000000a7986f9a82ff23526fb58201b41cfb1d005662a2ecd3621b788b30f5e80de34d528bfe00e4f80854a46980dfcf8ccad5b5dcbcafa6057bb754925ab9b4c2701b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409983825"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a903f95f32ac1afb22f62131affaeb333b77ff4c5360c318925fdd5bc86b80a0000000000e800000000200002000000013cd72dd1669c130c78f416b9a8e1d3bd2f7cf90de8a60b7bf8abd0f8d4da4f020000000febc56b6dc9718105fe403cf10632cf29590585ebf3ad0408f5dc2a36f01c34b400000009cfcd1304a067d88beb09adb7b101059d2612b5bc641020954802d105a70278a8a63a135edf3941033a455504f3fa035388f42d8722ce3766cb658cb8edc9788	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08a0a870a3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B21CE8A1-A5FD-11EE-839C-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2360	2116	iexplore.exe	28
PID 2116 wrote to memory of 2360	2116	iexplore.exe	28
PID 2116 wrote to memory of 2360	2116	iexplore.exe	28
PID 2116 wrote to memory of 2360	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32b791822e21dacfd7f825dc89c26784.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f3bdfa77c359f04452b7769916c145

SHA1
953d2396f35151c3033a2252a1993312e74213a5

SHA256
408569b678fea2d53d3d8904214750869653c97336cf8d020ea3ab0ffbbae026

SHA512
5e1badeb8ac93b02373568deb9c44221327ed9750885854f34d0b08aa33d0121665e76dd5e0dc9aef50c7f2c3cd35e9ea99cef9b9d68b7afac90437316ee5adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd75488852dc6f6a5e1a93651dab034

SHA1
b24e29a93e4183c99400f47bd35d69bd84a4d6a9

SHA256
1b23d94696a5b165723d28713eacf8daab41df06b21cac20d484b91fe43e9bde

SHA512
378d63b537754f3c238e41362455c0cf8ef134550fe93cb94cc911b798251c12d43f07684aec77b5fc65ccdb657e5079884ce97cd39daa2fc5d7c44afa046a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79f3f18dff58f9263876838540764b03

SHA1
1ccdd3f2fffab435f84403b29f70ee2ffc62a07d

SHA256
9ff1e793d7628f5345e9fd003febacceb26352ed68068ccf052a7883b820159a

SHA512
1215cd50e8c55ddad39b595a296f34306162846ba949aeeded1448973d5b017d1cce225bda1bd6a1f69437221ddec8e7fd73cd8d5cb2b184e42e0ff8e769bb82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f36e58a8eef1dd8fcad75b90abdbb73

SHA1
99b1e292e5c120f4eeb6babc88705085f82beec1

SHA256
3e33d86eacf8710063e3d213490b268f5043287eb302871fd385dec1be5882b1

SHA512
bb6d2a6cd3811a4a900284f9e54c38323a0c968e736fc8dff75bc65dba8496944113f09a6a34583abf3a531f9faab58f49d7fbcd8d56a71545c915e7069a6256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbe55094c5a57bbe3b51ee9807172005

SHA1
38cd99e9421a7382a74defb09554a4d19223b8d0

SHA256
cdf68758f9f594ab1fae901147483c3c5109761863cb98d1d397215f8015da9b

SHA512
66630bbbc49aa7ff3c1c31d79b3f46334a0cfd52df7dde7b0203b6e70b25d8bf7a1760fa1964ed09964973b7fa1d57d39a885cb13a414406f7781fbaa8e7ddb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8241637e167e398b35f23c6a9efcf71

SHA1
943cbbc3b5db76ba9e50f1d0cb47b3c0ea200240

SHA256
2255a582ab0b96f5eaa393ad4b645e63be170f69641a08f71b59d4d063d9a704

SHA512
51efc048519148a5b9682f2500e6f0cf7a619e0a696115a19a2b2a2a99ea6740bea5e24bb18a6aa9900d41819b8f1b742607438f909f1fae078fd639ec97b262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0feb1ce793658ea4486c7e2c455bff66

SHA1
fa42071457a2c1a822d9ceae8ad315c866ced064

SHA256
c83dcffe8f7dc7541e260269e83f6e45f15984abc16faeddc4fce0d8bcdc1db8

SHA512
5ca7de8e4ca7788e1ad88b11478f5e4df68beb636bdf7e0db7769637921781ae0a09f3f99bb908fdc2b18e5108a507b2a53679719117e2ee0609fa6634e8a050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3adc18b6bff07bfa3d51db93934afaa7

SHA1
3787e35643a176f5716a2d7c2c4b0812f35ce188

SHA256
490c1b595fc365542e89a63fb4010ba8ac7c3e4bfa9e7af6584ab4e90dd45221

SHA512
f2cadda727c06c8c1a68e09c78513c4adb91fa29cd497112e76f8ab33e8864deca4484af593fa8fa9a31ed2c8935e90ee54584f1bfbb42dc0af384fdddd98e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b86a639d852184861d996a288cfce880

SHA1
dc3baadb3deac8151ab47e4d85093ba96e040218

SHA256
17e568df17696db9f83ca8fe1a176319b58ad9a494129b27925c130cfb45db7f

SHA512
7d2d1b05b9986bda00ba403fabacf2dc30049cc9636e086809466d4e191ce91e8ef0749804a0a25f49e9b11cb5133050f34791e022b596ea99238dc2bfca8c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc94830dc134fcf3eceb4e4b2595dc0

SHA1
1b3685269671bef207ad98ee96f2aa94921d6bce

SHA256
268add7fa6d3e68e892e04865af1672c2bf28fb36a5fc0979f5ffab25d617a16

SHA512
f6ad29a74723919c96c5b8173ac3859227b729c8b07ac1c8d2a1a3cf368623612be595faa05f0a91078aecbc2fde55ac8031c6fd25ac7dcf445bfd43c99580be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e8ae0c07b73396602473ef83de6180b

SHA1
a75cd1dbfdb6e4eab381c21584de92360c8853d8

SHA256
a6092fde643c00ef45755863bd03eab38e78c3ca17104c3ca8ab337f39eca3a9

SHA512
61a64f2831d4356355a15b99c3231b04fe5c59f2145ee1d978d36f6cab04013c37bb1e8d7977201b98e7b9a522b157bbb1d9a6c1480a27fb0233d993ef6e42b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a062d9ba30b281a0cede3f3142144c

SHA1
40675cc2bae547d6b454077b7140eace18ec223d

SHA256
997d8e167ba95cb88267f755940aa55c44801d38064f23f2a18cb9ad77e7851a

SHA512
9ba0648b992921f1a5f2e04e5a2543fd74191811a958408f2326b5fd8f2232c2f99732addf9e3e4353206f6acefffa545531b683de9ea93e6879dd8108f724da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f43e27635368e009840816f2cdf00b8

SHA1
1a8f9c14d8991f3e78f79350885b3d0b9f6855a2

SHA256
9d8350d0301378719e2eb372f0b558ea8878da6745f83c48e1da531ea7ad2af4

SHA512
6270bcd570ba71e13cdb52b6c08b44b405d4a710c12fe7fbfde2491115c80d7f5dfdbb51d79a12139650cd1c6b6f7d25a393ee4564f6fffc4d14df6a7bb8ff23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DCB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FB3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit