e890fc315e808707287a9eed248a42992b21ce54509e580b2a8c17cae761ec72

Analysis

max time kernel
139s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32ed9aaf9f07797cffa71848b01b92ef.html
Size

90KB
MD5

32ed9aaf9f07797cffa71848b01b92ef
SHA1

4a7af8249b231d6c8e15a69ec6a5228cb2b3c373
SHA256

e890fc315e808707287a9eed248a42992b21ce54509e580b2a8c17cae761ec72
SHA512

c78993ab9327636d4a57792caedcb15811152c1058c898a852a9e9c007b68b052c30ca6be6f003243a3d532ef3e3398dff68989a8e03d69219799566390096e1
SSDEEP

1536:fGOrV46BCQDrdaC0DVOeWvlLPccaw6E6ukJ+lHQLQBkrJgo6KaOPMTD19DfbAkHq:sweWNpI45Us5IHlyr/fLN8fX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000bdb179b806aff60adc4ab91f28114a3fec4bdf130d21b21cf2a949ed9d0ec83c000000000e8000000002000020000000b5c51a74c29f66ba6b2b821ae70e9efdf44e1ea50a1238cd09b774a77840d2052000000060dd81cc285822bdc7da1386cc002aff127936e9fad56c624d0a6f2f5281864140000000af79980ffbe7e52e625946382fdd21e96ad13d6a64732125a42e7d4b17d7242bd4dadb99451efbbdbe3b9d1e8fe3bf02b1b390e5c7aaff0365bd259632378bc2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C8FAB21-A5FF-11EE-92C4-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704922430c3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000048fc32cd28ba938209651fd28dc60c721ce33fd589194fc33ad320036b11d692000000000e8000000002000020000000e757158be46f0ba103f0a499cb7f6a9c8b5a8a5848ecf240e59229ffcda4364590000000c07a79f979a5185ba0af3ce7288f7a1c52287726ce52211b87a2bdf11f1e102556d1523f87986481ec4f6efcc94ddfb4364a0b388944a95ed62555e44d4d4841253a355727e92dac27461568ea97516c1f5a7a499aaebc03794c648f76fcc8ca3c34463ee78b8037d9eac19321c0d83e0f229938a0069ba80295dcde32acd2bef798f5b1872fa2f386c5f173dee6100040000000737f22a210200e40cb51e96071e766789fcbc7ac9ae2bf650df9877ed1003f4f70ff51209613bf237d6fc7b0db88f5711b3e2dcab4c334f1db2c026b5eb8f8a2	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409984490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2492	2188	iexplore.exe	28
PID 2188 wrote to memory of 2492	2188	iexplore.exe	28
PID 2188 wrote to memory of 2492	2188	iexplore.exe	28
PID 2188 wrote to memory of 2492	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32ed9aaf9f07797cffa71848b01b92ef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b69401e8cb711f5414266528d25ab795

SHA1
f31b9f4d908c10f7eb48c2862505251aa319c7e7

SHA256
99b2d47f9f230b809cca43c5a9bc829f81f449c143e3ee3857e383b0dc633707

SHA512
c79b62e7c2b090dda8ccc40d08c71b14d0bf862e1e92c6719a85522c32608a6e8153ef50b8552f70a87b0ea466ff5889513c60002762f0eb3863003cf8cd62bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fca3511c7031a3ed22bce02477a225b

SHA1
7c957626f7c4245676ff8ef4c9c47247486e676d

SHA256
29171794f4a0c807e432baeae0105ec175d277d5c6a52dc17b0b5904787ca0f9

SHA512
f1d4037e2dfb9ae9ebae2e5e31cc4df9f2f7dc4cf6e0de1d97688f486cbf4f45992fec6949bd8c2bb113f41527b8053456bf8344fe03c31912a4f00ca23da789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b45c590748e078567cb8f10651dad706

SHA1
17e443c5798e4966cfcc1f67064b35744e65dcf1

SHA256
c1304b8552f4c5445cfd41cc42d19a40701b9911318f9b6e886620ddae7abdec

SHA512
db11405c0fc6e00737dc63f4e163653d6d7afe38d10030fb96d0d919d287e564030f103f56667457725dd43e732d6ec2f3275320bc503b13b1c229572b451479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73829df6a2a32382ef0f1b25a8c0f362

SHA1
245d12d74129c2e45f765e25e33a54538bac48bc

SHA256
5ad660f08aedac167517e927b45895786707f42f6d0b3c1bc73d13a37c3978cf

SHA512
846ff73c84931a627f79cbf5280a9f6bf4fda870829f9034474865b4cbcb511a8da0139c0e7380c5a49c0342875850e8b99283fb8146e733fed0ea5456cb2aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e5dd3f04338ded84e447d102d444cbf

SHA1
1c9aa7dec87a56d9efd91f906df9d9a2311905d9

SHA256
2d60c198a9392cd43f3bd320c8fabcd278e2dbfe1d6c4e1d75d20a5a4125beb6

SHA512
5c063330d35afcd6510e28d4c337b60d43d15fdc3171520a95195f83eebf4f8708201654e1c5c4fab5b57d121387dc2ac073c07fea1f0aaa0869fecd5fa20e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa7770e3f3670f9a33af40b65130bb9

SHA1
b96c0c4c5b033421b7af9ca12eedaee86e87af28

SHA256
877925a10a3f3fd4a7d510ee09bfac5e37f373faf3fe0d317ecbef10b257c5d4

SHA512
7cfe539e3e669f4b02bbb5807fb37d04d8e9b9b99aea8a50b43e1ab7c528181c424092e48086443a9908f43f20b8cef1bbe95cd9441c07f1e8ecba37fda54923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0c20728807c9f8229acf611fc160cd8

SHA1
03e2faee158afbd2946634b473abeb0febb30554

SHA256
a903b3c42c14ef84f4033f6531d0db9bd0389f9320d1e062cb86efaa599c5285

SHA512
a83a17c8f6d3394e82402b9a6692a114c8e5720d7c6695e530c8293ad5cc47466d9603694d178019e955bc39472c36148bf00e2695953ab2bfddd338a067e650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b2018b134a3af5d9a5ab520286d007b

SHA1
aefd51cd73cce668f600c1adca7824de40fa9fe4

SHA256
81fdb353512cca5092e4dfcc2491e2fa320c644b73d32c690059efc6a65e6179

SHA512
bb3791b3c69de854e82150b1092503067b8a82a71ab3280c747e1062077e0da4eac8a75ca64074c416c0af8dad4324a13f289d871e0114e1847139edef621a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aa48753147f30e1e976538a1201b78f

SHA1
0011b7b46ef5a74e1d8062302b55fdde8db15d79

SHA256
6f3a01960c3e58e6464d3daaa888fa691513f72813cf992e88ea3a6c2198f519

SHA512
427d8903a4c6927d0db86a534969d9beff587b63edd6d617d98395d7a5fd4280b1771d66f039e1ffb2737e300c790673c808b1929a77e9910b2fe6ea58115ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CFF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F33.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit