e9b9eda56e49fcf888ef86dbb6785427994869f165f411655548765a6826fa9f

Analysis

max time kernel
121s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3837f69769544afbbe87522ec2b53606.html
Size

15KB
MD5

3837f69769544afbbe87522ec2b53606
SHA1

84fa9e890be10ce3728f89f79214233737676e98
SHA256

e9b9eda56e49fcf888ef86dbb6785427994869f165f411655548765a6826fa9f
SHA512

2d01bf5f6d6c5f69879a096dcc3fe82560171ac8bd4f858ffcc3d493891b9fc32bce1f31812800d56bdd8eadfe61baf1c7d0a160ec5c57497a44d101182a7e94
SSDEEP

192:huaxZ/MEmNZtC26gTs7g72w6Ng+zBv1JA18mXUqLzwifXgPhzd+zUdtnq9IQgKjN:wscS5itn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000056936b6c6f7bc4e9aece88f097a28ec82938372ca8e9f551f9960aec2fa885a8000000000e80000000020000200000006b2f752f1e0ad1df0fdb6751a7b5fad5ab0fa1d5471b0853d90e1aaefb0af5d590000000b993ffab08e5ad5ee3ced3f2434f3dae8d86e8278db475df95609e9c3875094d666faf6059d8217c911c0df162bc2c55d7c43543986d12630ea3af698ea06cc82cb971020b3cf632ac96609a2ce3ec7a5284da839c3f6f34cb8e8115aa8b615861d55d4e821100959eedd07870b512c09d5b5a30ce0608eace4b88b056e88fda455a42ae33607d6b98bce4bd50f982c9400000004fd75f6b1b67e6375b0e2a7c3fdb6b19fdeb40381e7d0c40c0de1dc26cb3d59a0a7492211983df6f83f3c4d49b72ed4b427ab689eb9c7e4f76ed072da60a81f9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409775546"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFEC5921-A418-11EE-8427-464D43A133DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400703952538da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007fb0f058acec70db158bdb39880d8fbd397a0680afa3246e88afd504a2b6162f000000000e8000000002000020000000fbeabefc187da57d7fcf67c6fd57fc997305197ef2d60f11b4a93e932597a1b3200000000818e3e153bc1d219e4e3404de80ac2e985c4184675f3cc80567119ba75320a3400000002a331e1fa2ad4e652074627a9234171da277641e6e1a3450c2f4b4f4d5a01cb781e7b04de9f5e81620d640fa5cf1f3a785acf9b8ae8bb7439c97f9cc12fe0dfc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2416	3000	iexplore.exe	28
PID 3000 wrote to memory of 2416	3000	iexplore.exe	28
PID 3000 wrote to memory of 2416	3000	iexplore.exe	28
PID 3000 wrote to memory of 2416	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3837f69769544afbbe87522ec2b53606.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7ddced2bed828cc5710b2186bfe8325

SHA1
a3b211d75e0db71257b893439edfca5509fd4e62

SHA256
bc8c316eb8ecb55f77c8a567ed2a6411d9b0d86297add5f7f70e331d7a11f672

SHA512
765d453938e5768609acdd1e95f7f60c397f50e8a544a770da1b511271bf181952991f3475aee236edd0a540eb3fdae750ee0fc30cd9310a1a3c7e97ae689d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4308732c923b28e5cdc05d1a8cc7ca54

SHA1
f84d2939d42e3e4f61cec6576581f1718f916fe8

SHA256
b0dcb7d3ae5ee0995fb718a4a0eddd6fdd48880f4a35ab372bb2cfa24cb90088

SHA512
521340fb2fe6b17243dc538e4cb7beaf14c2852bc8218d3c948a37d836c080453b9845bb038039b6acfe3df4281dfadd6e419fb43dafc2f5f954bd09f273355e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c28f85f6db524ce79293cc3432d6180

SHA1
3ea6cfdaedaea2527c75ca04670bf0fd52e03a5f

SHA256
ff8bac890ffd6536783d6a8ea96bee22b3bfe3c18fd6d606ccba83908083c414

SHA512
15121d4d79d8a1b849e2d22525db8dc397c0b63a27ed61855ee2a315c5cf3c60d27a2b83220f431d8dee9dbe8087e5e13e53e685a7e78db7be82b5d27b50bb1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9510cb14f9efb87532876eaf833f0962

SHA1
5ade25a2bddae233bf1fa01ff8197c5635fa7e04

SHA256
64a9618c01c121035d7f33841f8219333387ccbb28d3ae71adc39a55ce9b5f7b

SHA512
f60a3a8ef3c8b3e2ed0646d42fa3688ea40584ad52e60ca45dfd47cc6cd97c803af0d3e7406091e25ad5ba6e0762101f04410b2f1a20d813e344ceb6df1a94a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5448e2c84cd7b91df9dfba774a33c574

SHA1
b4d20538d3c9e0e4ae4af157c348cc37d7db3a40

SHA256
a4a4d72af1d365181c8a9fe3c23b3aa5d9eded2c536408feed3f86a1177a4549

SHA512
49922fdb4a8862bff5adcd0019e0ccf9a8515a5d05e2cd251624728be67fb56d7cfa74c9dd35a380f952496d731a9e025f0f3dd5bd4fbad39df75949b043a982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c3b3af3719cc0d77f72c16ca8681b50

SHA1
6984c456d7b213939de6b434ed928d1c3519f52c

SHA256
e7a8d11e9d822cbfe3ff8fc756bb59b9e72beb130f3237e03af9eb9aafcd37db

SHA512
a0628a273af7c17ac15719aeee8f9a9e7c6aeb832d50984d1c8405fc3999a18d0ae72d655d50acc6fde6021cae8161e7b08649291556f4703911b331f4b5a540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7143fa0263ff5a92821b1d90c62130b7

SHA1
ac57cad9e18412fbfce4ea4e4ca9f8271374d788

SHA256
59d2b52a8c7e2eb351221930e70e0ffaee2cbfc5cd9524ded2e74ab0e9ce810a

SHA512
e67ce6b32e01915b31da7acbb0c2482d854cc4189933203640c795fb6e18c09da6b7d94dd0814a45bb56841fded7221f6768f53135039ceb5dd8830668af8129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d600edb4fd0379238efbb1b699062d

SHA1
6506e226524eaee9e8f28c85da6c668d1a80fee5

SHA256
0a4358c5b3efec9630f5f52348292306d4c21146865ce5ddf5fe6ad774c87658

SHA512
9ab7a6b3c88eb9a89c5cac688d99b3959524a1523b93aeece666ef1736de87787f099468de3579c04db120b5876ae586d3bc7c71b66db0c07f143c57a2190d9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
139c86885946d6b322ea7e670808ec32

SHA1
737d30f05ee83149c1044294bcdc10bc5c598cf4

SHA256
3947f525d8c23d37e693391df0c1f971b0809f66f876f5ec8f225b2ce86220ea

SHA512
3fc583beebf9c57cf6637dc86b3141d17d52d3fe25a1c952fcba15d52585f41fc5747d299f12965df92fae4a41968ba6a1419f5979a4dba0f093a791bd793f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
932ba2f7589b822774e4b77c07a3183d

SHA1
4a3734e63200ce82bd206b3799885083cd7f07ef

SHA256
9d624d6d8df39db90861a1068bb3b78a44b6119dfb4d310ac54addf96566e4f3

SHA512
ece6a3db0c7f7807e36a3edf59f35a3534eebf7b54c4fdaa99a61fcc0ddb54342912002a963bd8a2277984aff0c7245b87f68dc851f547494a885ed0b3b7a41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b21fc5a2455b45e2598eaac4da340f32

SHA1
366962c6b27f58b92309832ccfd46d6d15cabeb3

SHA256
18adc08ee7a0a1839c41e3adcece7e05b0ee40b7185b4af731dc071a54940b46

SHA512
af09f9b61b714245c723199d8dcb800a9ee91c5670011c6ac8278c81a7ffda949fc2217d481677621c741de742602ffb5fa72862c00c0acc2a3e8c79a0cce21d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a156bec0b27a62f375a62db9427a252b

SHA1
5b51bf616dc6692a5f7eb9ad25cd33109313bfff

SHA256
b4c806fa9c5a5e2a031cabd404bc722dba14ef90be929b6f2aafd870bd945c9c

SHA512
f429fb8cd03ed49b97ecc76c39551f66f14801a718e45a972f80e7a550e59b2eda0cc5a471e3f602bd9aac239a919cbc6a7c68a94744eeb558ebaca78da25450

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB712.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB744.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit