e31a017b7927c1a483276cc0f69258e2f8514a7337e922e64ae917dcdae0220e

Analysis

max time kernel
138s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3804acef778b26d1ebd09b7d86684e05.html
Size

7KB
MD5

3804acef778b26d1ebd09b7d86684e05
SHA1

efe3509c15d5bc5a78d94fdf8b3cea2e315278ef
SHA256

e31a017b7927c1a483276cc0f69258e2f8514a7337e922e64ae917dcdae0220e
SHA512

3c2600c281b5d486229115be3ecf2813cd0364d5f69342243f6e57dc5adc5688529a8eb3dd3a4847781932a8bf3f6526c6bae9971f4e58ca5c48230d9e4e32b9
SSDEEP

96:7oLWvRg7PBTflGVZoqyHzlXoN14NBeqfpvsVz4/EiV4pSnDGVkzHkdqoc1zPX4L/:7DWPR1J2N8ws4pSDiMDf9I

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60755fdf2f3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A656761-A623-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409999863"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000018e8a7fc381e510d5d71a5ea0bf9b9e8cdad748babd0ed379422bddfe5cb8506000000000e8000000002000020000000d7219c3f5288b68a059ed9e2e826d1a6923ed9cfdeca9ec5fcc51768deed310a20000000c42e0525f89e4f5c39a532f778836c658e9d911c0e91e670ff7fc31ee12c3a4b4000000002388eb6bbbb2d19ad9f9fe7015c36a01d12d52d05d514ba8c02b06394ee09de0f0031cf774c7bf909aaa716fce658746343ab482891b7a33ef0e4512bceb632	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d5d229185870ea9acf9a6eefdb6d9ceab1aad5c98f2e557cff7ebca20dd98fbd000000000e80000000020000200000003fe11aa9514a8e4305b5510388634936d7d8165e2166ab52a2c7e26db731410690000000fe466bd6002aad0b6dde9af4ffecd43b3c901aff4eaffcd789f0ba3fa88641536c9b175f6ce8d49efe01f08c811835ec9d2615b6cea57d2df1a098bc27263d621bf3aca5f05c326ee0ea23bf3025c58cb2c73a705ed8d7b667b5516e26b1251bbed2beb7782d6da5ef5678b0238235ca2cfb8049fb97e4adfd824e03c7add93c871497e52d1bff2876e368361fbf5559400000002fc8b0e11dcf0533f50d126c6df7ccfd6df78023e1daa4ff9f6be7465991bcd4e5b768271faf0701a3fc9062ad28596ab76609229870256fe8d40e40cdd7f6a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2204	1964	iexplore.exe	1
PID 1964 wrote to memory of 2204	1964	iexplore.exe	1
PID 1964 wrote to memory of 2204	1964	iexplore.exe	1
PID 1964 wrote to memory of 2204	1964	iexplore.exe	1

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3804acef778b26d1ebd09b7d86684e05.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f96555d0c79b847720d29dcac12ea7bd

SHA1
da37590cc24ac28840a4be9bcae293a1014ed78c

SHA256
6b9d2483271e6f51067579a5cc88435465cfd1765aecc15a59aab921ce31c0e9

SHA512
e18a7447cbe3e43e870df86b42d540a9a23d00f93a860d1b6f91605d9a8c9d4a0938b3b2cfd1af526ef173c97d09571c4bda22e10effcce05fa407a34f62a93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c84e88f59c5c65927e7818a49ce4fa2

SHA1
47211a7a00844762d161a94f5e0da67bf50f60de

SHA256
348d83d111f5cf402e246806ff038c86587b362fdeb5e79708c37836e6387464

SHA512
0f1d526c1f4088b4bb732d9c5a2d69c9b227552ea0e197f7c43a9c361c601b5bec33b726e16aa6ae14642ffcf253601e82c3937ff2b3cb44bf1bd2a28d4a7903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
395f90f3dc229897d0d2fda8088ddd17

SHA1
41738ab0b7f4b8efa858ea84a8f8b7be50135bdc

SHA256
2f9ae84ac61af2f52226c271737dfde9e4a894bded1158fcf5b5d9c7d7a9e76a

SHA512
9a137f141da03b2683b6ed35de0b308d3b629f53c056a39d65dd499acaff97e4b554661d0b0f9d212d935bf6c144331e5377e3abb677bca9f4308f16b9aef564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19bfac0a774a074d541bf164d7841e0d

SHA1
9d10425a22e446db82fc5b1764ba4f78707ead4b

SHA256
652afb951cc504801eb657f98af017e26f8019f87f171c0e54557c5188a78bc4

SHA512
792d760c4905f6e80490fe011ee7a38b543d22f1ff9c6c28ff22e1e3271f919a24c9341ebc9beee8a7a52918df2bc63f9061418de030db1acfe4015ba549e397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afdbab62e48fcc815c62e6f174ca35be

SHA1
2229434e1ffe1e466f250767eee3a4afc29dbaea

SHA256
bfdbf21e9505cad37536ecb918878fee5765c40bceb8169303e03b86d637c904

SHA512
1a10ea428cc77188ebbe0ec0e07bc05379005e96030c8fb768a2829a7752d86612a67e6ec207c5f3f26632612c171b7d522af1171b2211da5d7a7c2123543b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
204a0b4b824745d0f381b50ff4349bed

SHA1
44490167448ae035be01b5752633707d87f98ad9

SHA256
e05ce6ed7a2873e4264ee21ef9545348aad758bae389573cce24464024885f84

SHA512
b77dd73839aa0f932c9e140a44d5af78f76c7f038f05fecc939b8285ad16cf88bfd7add0a5dd52d71b00d3101be3ed8435c335ee5b0acaa2dc5673df5453a989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
608ab550bd17ce04bc8559f4c942689e

SHA1
e76265b7c29ca6a859cdd9f597fa340900b87e18

SHA256
eb4a137d1da6b04800a1600ebde95c0323f456c6f1370714c0a4efeafacc3f68

SHA512
cb32440b65a088d771962b4f0c6676c12409fe242e4039c0555d4c6d455701704db516a53b3961673d09244af805131278510f5fc12e5a8f096cf8554adbe8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76a3a6096a8c29d99b21b95b98b7c28b

SHA1
96443b81866411a2eda610ea60710c3cdc080a58

SHA256
7e625a2c3299eef4c61896a4dc5c587f1313e4410d752bcb7e9216286071a323

SHA512
d83efdb2f29603c0e6a5bb1552f72e340964987d32f06225bdc8a1ab76a38c33a70567dbd89e0834109bcede0d9bae2c041094dc0c4616a84fcee6ac49e7a33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b7f8d1a7bf712e5594e78a737104258

SHA1
5b2649c87d663a6a22a92ce21a8b8be1fb976759

SHA256
01790a04bc29e4ea531f4aa49da815ddcfb0b12975d90faca7efa1c3f124354a

SHA512
be9f8c1b816b332942beb9b13c8366ff7fab67b606bf4150b7675ac4426c3dcc242f00477f54712c414fd77b975037a80ccd7f6d39c7621f46366720b4bd1f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a580dd934aa6c96cf3495a6c9adbcff

SHA1
41bf6ff9f52a7a2693de776ff484fb64a78a6a27

SHA256
33f92f491e95f1fc4691f28c9c07f2fbaed5f1617fee20d0f8a8860be339bee4

SHA512
c1c63b0d38b932ed5352072d3385908fd03a91e3b7ee34e0ee4ca1f78168d63381c49f4e620f0b02420b65ca91dbba2ac025379657fa772ccd6733d50a41c513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa508f3240e1918a5b43e2496fbb9720

SHA1
6d34e59c9715e40a6df417957dc3355f2f257373

SHA256
de5000e7dcecdeac8cc256183442b43d06efcbde60f3d221c8bfa8fe50352c07

SHA512
92d0ecf16c42d276aa31b88379850f246138a62063e289a8b27baaaf406752de3efa987bc400e9b507f554a6fc8d1643cf36a71378dcd0b679c3fbf65935287c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9254e8be2be977c99b6293c5d9173988

SHA1
730a53a9a1948c95d6176f8350b8df7ddac4c714

SHA256
a408ce1376165d4230e112e5ad15af4a47597cf5199ae8962a92a0fd38aaa215

SHA512
f868b1c24f75e3d9753b229acd76b051d2aded947eab7e0a495fb0f69b65d1b54afd8be9b2fbc5ceae260b3c5c64f7d7d3fb0efc8220da8bad9ce9ded631e49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC59.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACD9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit