73cb9e00416375f534289c04f5232581138ec851c5af0163982e4be6bff159a6

Analysis

max time kernel
121s
max time network
179s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

378f0339396ac89c8846d81966b861b1.html
Size

17KB
MD5

378f0339396ac89c8846d81966b861b1
SHA1

bf6fb5b8d70d98486aeefe8644eea280c8ee7d62
SHA256

73cb9e00416375f534289c04f5232581138ec851c5af0163982e4be6bff159a6
SHA512

d2ea01dcc007b5b0b2b54e102cd8565bdadf62d27f3741c08e44bc0854289a37afa50865589c56971795245cc752109f4d2ea28a6d348f694784470a168f50f1
SSDEEP

384:P/9cLkTFhKUth0la8+C0FfQx51IZ7eKFhKUth0la8+C0F3rtxB:PlcLW54xU5V

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b4d4502c3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76817281-A61F-11EE-B331-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000412a879a8f4f9d35c5186cdfce4b770fc0070df55118c43bde31457f70544425000000000e8000000002000020000000299b08daf7c83ed4555cb49621a729f3175753054edfcd433a407ad6ad2eecf320000000728c1b10efcc3f9fce39539840223e9994a25589a7205805cbc08dbab06f870140000000c590f7b9e98584521dd222ae0249e512d4cf5ca4853d51926e11a361cb2faae20862a7ade7b30fa6e12656119919602d57c9f0bb4ce3ee2823c03d3c55f50d25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409998324"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000497cb53b3bea53490eb5102d66e08202eb64bc2d6c5b8852ba21df95b0a80ced000000000e800000000200002000000065a2b4a0835a249a5ec8e27d119cec604d7c31a2b4ea97a4d7cb7fd588a2126090000000439b90edf9013b43ff07f694261611a0b99189d180d6bfefee9bb5da349d0c35d00c3f3ec6c233cc218fb8708982974760d8addda974a5ad5a0e70b0d261aa55cb5a495917b793fe4d15e820d018402974d7ab5b15bb83356b84f01d24cc11afc19ea9e06ffc44f2b14462339c533a20bfc65a02cb39225f7d803da0d01c0600f77d7dd12ccca2fdbbdeb30244ec9bfa4000000001f952725bbba10d70af24a9cb019ca210aa1cf00996249bdec6f776596cfaff291c211ddb894624207dcba3664d81c76cb961e1d20a56a4f47755e7a99ccadb	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2752	2764	iexplore.exe	30
PID 2764 wrote to memory of 2752	2764	iexplore.exe	30
PID 2764 wrote to memory of 2752	2764	iexplore.exe	30
PID 2764 wrote to memory of 2752	2764	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\378f0339396ac89c8846d81966b861b1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0588914d1bec034b069ae62b60b6d278

SHA1
8ed6ece5cfd58e627c9bc99b0ef4f10ef15d8f96

SHA256
7c50c8b98edced816e4c4ce74dbde21d6bbdc73658d883106b3837b0f10f91e3

SHA512
fb6f636159f71e0781bf6c485c6b903377bb241bcbd68353a297327ac27200110377d385172cf59ead7b5564d18aa724d40a78eb660bb7dc7bd1926c6249202d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cee553f347b75131d8aff15be1bfa6d

SHA1
243206862e1a8e5aba0d02fbff6e780e8b386edc

SHA256
4ef05b7a8fe21bb449ae49ed34460650b1e70569a7a72f026885170382da3faf

SHA512
0537673bc702fedf11d2022c5609629113d370557010faf0ae75caa4228fd41ba7eb649c0d7495cec53bd462e70cbadd9a0e99338a99975b364c4eeb163d0c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3841aff4fad854c4a6f4f98cf57f735

SHA1
b3475678ff95d070775d3ce78dafd8a593ec1bb2

SHA256
5f7bfb73fcf2ec9e01004d8113f5dfcf7742995ec0a069e989126443bb36e5c6

SHA512
e55f87d03540519c4220c2a4aec1c648aa2fe156ba8a65d0414d79221c8e3d15ee94cb646443c4ac67b3e986d17a3bfb707df87dc75a6cd30145f993c115398f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71b5e47e0ca526e8239f82af018b90ec

SHA1
1e2bb77d707b6bd7e4910545f8f3185d010d4675

SHA256
f3b780dd389c1bf5c372329476ff53b8ef5fb4560acaa0a098fb182ae26c4a66

SHA512
b735272881c6c63571937e99edbd5e3b156854d127f27915ababf09eefea5455f380eeec271b8a224be85f7ce7066dd540269fd8f3f52a810e7248adcd7cdd69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a405b353a7d034e60e44c0ec1fa6ece

SHA1
00314ac84a18807ff63eab47dfa8f994cccfbbd7

SHA256
60a8ea4287274b1de0dea9b8ef14ae47a5b9c893465dae3660f47df2b53a48dd

SHA512
a943754d7a4dc998e56824b3fb1dc993786f4c0af14dfb2d9f3d198deb4ab2c8b055c703427b8acd1eb923c44b9635f16e9974b704c9f613ce15a91ea95ed8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54f5c732f1bf8678c50ff7e77ba0e342

SHA1
96986b4c4d311c7d4652955de2e09b0985592353

SHA256
0c587d16c72822f52d14082df7b510c9b00936892b2005337a0c191d6f9bc6ee

SHA512
b256b79bb3603011ae48bdc8943db0223c72a99e1c1677cd1a477cbb367feb8ad073bcaed3d3258eeb9b1835c3c5e50f84613a414bbd5aad813a6bef388de6ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0525107905800d1bbbf01a021b18cf40

SHA1
8f9f0aeba7de9786516f24d9315df377ac604db8

SHA256
828c932745b8635cf47ec9ffff937b114c57208a35f3e9b38abdacd91afa38fe

SHA512
550ac722630d427e578ceb96e772270ca0ed4aa38f27744d6f685b0025b1a4c16018421c80c8a0b24580a8ce4fafd685f7f7ed5332794d5a0d837a6dd73ae2a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c03047d4cfcc9364ac367f18addafec

SHA1
1e691ccba974483a83adc00b016edc4ee06219a0

SHA256
a827742c7a980324fee00cb955652b8d85d4bce2a485468782dd23934a2364c9

SHA512
d70edb0ef09d23b8835917320ec2f54455ef4ab2dca706a6a8b03b64148a5f52cd6920a65f6268b49df437bc71a0b3bc6d72eef890ecf68b62c9d1dba84ad8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a9e1023be3a39bc6ce71a89db4b8019

SHA1
144c1984cebafe90968767cfa1743821205f2c4b

SHA256
56e0d87f9c2fe22a9a7b9dec831e8a73b87aaf01e559432dfc40a35c505ac8b2

SHA512
a6eed33987972109bce4813525288caba4edd0829f512afbaa83f053cfde6615443e0adc7c7d6dbc100a5f2cac4b720e86cdd77e01db0306e19cb767c1284f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa38ab7ede5de8c8037c2a88bf82ef2

SHA1
75e63a1b6e3de01b6923f284b995b67fb21e41ec

SHA256
afc4d124aca700af8da8c6d3741a49c7611a953d4b3bc3280c6bfc48e0035c1c

SHA512
fd8b034e3c82320f892858b36af7f2e3824762045be7cf61fcf35a505e71d2957f73908ee909a64d79ce07286abe43eca86e990f7ab40eb8fbe5b008317af868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd203b059f345788761fb676a272a55

SHA1
e4d861e8de721c37ed312b99100a3b2dc75afa99

SHA256
5cd89bcefb53b12097db1ca0e5f6fbb72ab1680c56be3c5026b676e748c202bb

SHA512
872ece43e4777df90934c5c37782fdea7f49e73aa3951f9a2f6040c0fc7afeeba33edd1430eeb55c58d4662da0407b77739a1a1aad63db6973458a546a69ca0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a68f85e2ed3019cfb777ac9bf82d21a

SHA1
78792971ba6edd7d077ce824a79cff00269caa1b

SHA256
9e03eec82d6ad24eaecb42baaddab0f81ebcdd79f2e53788823a610ef6266092

SHA512
942ff39ea228b4389c9e178a697adae0f1ac1537afa3c0c06e95aa0ec431c36c47dfabfcfd7cc9f39414288f8e356660a22cbe0d3a974ea4a18ef2b67a26593c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c87f5286a45f799992343208f1259e8

SHA1
9f2995071d99285f733f80f65133baad8f480eb4

SHA256
9417bb521bf08a45427f3593b1c9153160f2e3cd20182598e46929384d0a17ac

SHA512
02c2941510b0dab889d7353f4939b3190a8e3b70024c7eecdaea3227f4e38c128e9d902c4e74e0088dc953eb7567d73b57a6dcc6ba1fc91b84d844cab0b8f259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
031c37dcf51391a4ab298342128c3f79

SHA1
8f629b9809d04757fa641da55e327a3b77294adf

SHA256
acdd09f880c2cbcd7aaed6eb968e8933d4167abfeceec9e2697c0cc6ed97d94a

SHA512
c9c2360bc3026087b66beec6bb675244f565bd3b398e10606d6f1fc09e891b862c7716b646d4038daa0bc16fe2a595c92d188c57b41767eaaed19f584378d240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2465eeeb76b7ff769713efd05d1e86a

SHA1
432f5c706854709ab10f25ead9f1c21a5c23e603

SHA256
e8d34b3ebe8a7566f868ec0560b185d80cc1db43d9e16a9ea67cc2fcc8319396

SHA512
2ce553e51ffe6c22d93fbf287e1d4617a65990fb20b6700a115e6ce3e496e0ddfdf9be28203ece764d3a01831a82553e4d2e0bfa31c4df1ab74c163cf5d357ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5320f99e29e86e1dbd56b3532410d50b

SHA1
56724522360bf33b867a540f1c2d1d7808ac953d

SHA256
26b39bf0e6a1d62a8f1a66cc4c21c684141098b2dd3b20a20df513e2d21406dd

SHA512
5d131db726dc481c1a888ffa5ab404b7408254af4450a2df4a2287d25d87c9fd6b4f8437bcb26ae7dda7da2a27a9d78629f1803f299a60d98b5988c8b66641bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab454F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42AF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit