db89621f5bc55b6f7ab64081e33901a9eed02e0ad97da9198cbda67ea6c35db3

Analysis

max time kernel
71s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37c6deffc91f44508f811c53fb2bc7c3.html
Size

57KB
MD5

37c6deffc91f44508f811c53fb2bc7c3
SHA1

c975914779f86a218a59aabbb91ad07ba31e3789
SHA256

db89621f5bc55b6f7ab64081e33901a9eed02e0ad97da9198cbda67ea6c35db3
SHA512

420ff072c3f86183a2572a3cb936efe5aba1cf8826906dff8682e66d7d133b70d73df057494433537855718316ad1185dc266a9b2bfef99b34a6c2591715ae12
SSDEEP

1536:gQZBCCOdJ0IxC99fNfxfEfPf2fWfJfxfDfIfJjfRf2f+fFf1frfhfPf8fKfFfhfv:gk2D0IxkZMne+xZ7QBj5e2tdjZHUCt53

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0BCF641-A620-11EE-94B6-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2668	1740	iexplore.exe	14
PID 1740 wrote to memory of 2668	1740	iexplore.exe	14
PID 1740 wrote to memory of 2668	1740	iexplore.exe	14
PID 1740 wrote to memory of 2668	1740	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2668

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37c6deffc91f44508f811c53fb2bc7c3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7b644e20a3e1beb1cd6dd5e0f4cc42e

SHA1
9ea35f787d453499188b4656bd731a5307b7764e

SHA256
f9e6ebfc1f4c897890666a0e0c561dd24cff54b628836186eeed97451d3dbd99

SHA512
04f54bb3001a8c088d42f89ec82a417a81f471968e9f36720b31e73440fb6f5f39399c8fc3993d2ab72c3e31779d2e5ceaf6ed20056d5c80ef4bb10ba1f84f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2bc5a278e94c15adae43b3e79a13b01

SHA1
a430faf11ee1e81b262eeaebee166e4b8c8efde9

SHA256
4a4b2f17b4f17b10fa85ea2e4b006155198dfd85a6dd770e17d0277432e2abee

SHA512
c6621988bca733e38db3820b4ef0eac8e1dde4d440ca07ab7fec4195785ad88bb782a4bb63e3f34e51cef96a6b14101ccf5b046d26017144cc9545456a204193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81bf4d2d29b3fccf7c992bd236c8856c

SHA1
8b19d02dfb69261abff092c0326e7a8fd0aa400b

SHA256
c441dcbc346004880aa97bbb299ee0b6af4193ea91064098e347df35f50e1a79

SHA512
fe25678b982ffa78953800dfa3185a97f7ce85f218d47e7acb4d0537652606dcb608f862d49127f6fbae723c212ba36c83c2260274c110dbee5aa1736a15c914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb5634276e39ff33504f45a5f53d2f9e

SHA1
6512445b4e4825e1abc91aad7819a4d8eccc7d1b

SHA256
62e725344ab27631edb6ec981848534bb25a7d253f84978f7d8f3d17d4c18c41

SHA512
a0eaf3326564aae89ab2db6a3db2cb578983e0d8f99e560cb3108f9942fb721494eaa371af94337c86ad4d464d3aadaa46e68f198e64855872eb43770fc48cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfe3ad91c28a34d87c5db9171f08037c

SHA1
82be3d564d76fd0a83fe10074e55b11b71de1edf

SHA256
ed2371fb55086e602b96700847058c3ddaa9954538ff7de04407e469c626fc32

SHA512
147166c38015d52d64d9c1d807965ee0317c8f3c89a9fdf5af56159018836e44d5dd9820a58406094ccfa63f83968dad16cd85d20f1c62f5f9bda1ed8d61861e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
285193475a1b77d7ed8e6d033d3a3e0f

SHA1
1a0236dfa943ef80044d6e864bd3d1f4049878f8

SHA256
7313c86b24490d96d88d859e7cb351cae2c890d04d360459979721118998dd8e

SHA512
81dc81ec11157160b9badee8621b5ee08ad682413d779e39cdee764c91112d41651ad47732cd3e8cf6511acb8362e70b76d5c301d23792810b1c6938643bf451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e3fa20c8331038d649968e1a5f8c71d

SHA1
4a9f0d2eecf0469a772f64982977f930e11d6349

SHA256
27ed1d42bf5ca7f774145745dd187a0a3b92d54fa0e4d86427ca888ede8db4ba

SHA512
3761eb57167339fa294bede632e88c04dac83059ff4c5ae1539927d08114c7b654a0b9b412b9233f9efc29d881cbc1c1ac0ffbe751bd9af42ec443e27f1d9641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca1bb2dd6ad1aac6705f6afefd637da5

SHA1
fe3c49a2b6bae74de26540ce40a15074d3255173

SHA256
f68e373ba34738b4e99d7c862478f56ab1e934c0e9df6dc8ba56ba718914a069

SHA512
099695d048f1b781942069486d6a87b7f29db9fdf526232f903e2c3aa29f3e435a168b399ad142b9dddf22f50cfec88058fd0e3e8d10192d2ba248b692e7a528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f817418405b4d828c1560eaef3f101e

SHA1
445b07b90de68956b6845d5d3879d4093b05051a

SHA256
ab4b47a169f9d4e507b5efaa54b70185106149bac6eb8b273d2ac0d924f7467b

SHA512
b381a79ba966dcfb475c91310d19229e5864b329f8d016faed30a9a3311ac908ed61822d658dd44363449e72d346404d2f4c3b734651cef58de096bc3ed7e15e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d01afaff6e048ca51ac79a1478ce6d06

SHA1
bfade2f5b8692f990b9a3294035012456e3b27cc

SHA256
778039c50d6d039559b8838e16190eec04f7aff7c2befe8df0b3fdca49e36af1

SHA512
9c8f04a899062c6322fa67209e2db7c45bc4944860b71991d7e915cfe13699d6840c05f5200c2691bd6aef8eb76ac5013b67666b10dcd855d3127a8e81782ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
677ca9495230711924070317ad4d043c

SHA1
258027436a5e796b5862c54b07312bb9cfb7451d

SHA256
e283f619fced468f550640d51bc02aee58add96e47e82eff0f4c73aee927dd33

SHA512
45f914aa9ef964cf5653b4a82549d91eccad558ad2289b7359ada27e82088248977a4c5bbe0bd52d6289e86250352b6c1936d4490a3723b58b2d70f743df3a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebafbd1edd8e4aa39dc0dcdaeda0c6db

SHA1
573a1f78462a0ea295e21a0237ea4fd6593717d0

SHA256
9738133946a3b2dd65e87d1edb0fa1d91531c38bd8c0374f6b8e2aa978d96c53

SHA512
56bd39d9856c3d8c3775ef2bcade1450d9e393e92cf4113c331caa506d4429fa563571aca55c6f921a6beddf0b7b84e836f349b5ad32206f2a9a78e5dffecf66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab316E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3181.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit