61ec03df225f5063630679d6be55afebda74218c3f9e499757a37be0fcd90366

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

384f66831d54ac3a30e7c5ab0a4026dc.html
Size

153KB
MD5

384f66831d54ac3a30e7c5ab0a4026dc
SHA1

40e5eb8d4316f78c6c8fde415b82129af16d4b68
SHA256

61ec03df225f5063630679d6be55afebda74218c3f9e499757a37be0fcd90366
SHA512

4de665f19077da658074ee5bf748fe9e3a7852abb354ca6918db79b1e1ba2600cb28511c1eddba5547a52d2a7fc5e9e3063e01d2d951bebeaa51a8a1e86b66be
SSDEEP

3072:FBPzloUxVjB4mBChj+aWH87y77J5CQArLxht7FT/XFB:rBZBdChjbWHey77LwrLxVTf/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000007562f5bb8c3c602eb948cd8b2df1a1bfb98f0db684dae423fe73c2cd784c668e000000000e8000000002000020000000237b32008c2f1f556da00810413ccc68ae4623501ba159983a01a640da52598190000000bcaf2f47b7bd84d28e7134c7645fa1c5a8fe381547f8c936a08f32e0e2785cc28133c2d88e04ad7fb5236a41ee6993fa55838e798176feb95e756ab013ce766926a02a705f601ba50ac5781fd6289fc284a0b51bf753d905d31d20e60a96cef19c0ad3b3cf9b3bdcfbc1f4e49b1e04d4aac72ac46c8d26d592c5535e0e129497de5c36e74e7bc19f6dfe54f846d5732b40000000012fc9e2933ae77bc4fde3b3c990aa6a63bf0bec133183f5821b6923bf7690f829e9b9e64b5cd2eb5ec1fa431f83e98c89c42d5b6f428c54d05eb8967de5574e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31B43331-A625-11EE-88A2-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000583ecab80e4d869af8a53b4f064a3b79e118918af9fc2bd58e51e7eea02e4b07000000000e8000000002000020000000020b11f2b6506166e5992f6f110bdfe307100e6ba4df2a46ecc40540e852f0ac20000000858ff743a20d4a09f8b3032a8cf0e789d123459475aa076b72a5f3cbcb9c23e640000000f94d56ba50e6974dc7ef608e330274506067c99272b622f743804ee9e882e1db8c80a5fd1161e9a9db7dda08620f3e27f26fe389f6aedc1f4325b3d2ca5a8093	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206c350a323ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410000785"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2652	3028	iexplore.exe	28
PID 3028 wrote to memory of 2652	3028	iexplore.exe	28
PID 3028 wrote to memory of 2652	3028	iexplore.exe	28
PID 3028 wrote to memory of 2652	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\384f66831d54ac3a30e7c5ab0a4026dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f08c2873000f394e854c007a0a103da

SHA1
0668b7754dcadd59bbf84ae30f351349b7c1f8cf

SHA256
23367c804bcd696b1f656c8fbefc22612989956ddc0f3d31f77adc610bc0ab7c

SHA512
9dea3a34ee17bb3dd0942f787377fb0725a7db28a70c1321ae0a7b44b1faee569d74859a87e5dcc2b1f8b91ffe29a7292d7fa082200c4fb171e7653b50ac2329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5dc00890eace69355b7202fff816434

SHA1
4621b87566110aa80dcbc7c7a21be18691c931d6

SHA256
692871cb979c8d4a9ad18b35e0a775ec7ed6306c98e601cce910d0409ac3aa7b

SHA512
c7f980dde75c154df5ce08f4ac4b0c54c762d07195448e7270c0459e4efd445bccc6c96425af2fa3ce1762483b5d1630ca62df6036f86d607c5dbfc5040070c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a3fa5b1fc9e8eddd046e8fce6b04fe5

SHA1
9bd976cf79391784fa9e86850a896e23654e864f

SHA256
16f7302e2c259e44831fe61ba1803abbe288eb4610780ab7bedb49402d88c902

SHA512
59498833b079e3cbade447323239c95b9600deb863e86f7bab855fde72db4b3c07f35df5b98e0a399efa2f41a10c37311fe708f8b16da73e38e2f436b9fde68f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba4f5bc202e745fe526aa9906d31b9be

SHA1
b97ac9530b2c49a60ae4596688688e4c22768f5a

SHA256
847470fe290c8dd99ae34e195ff1aff15ffb29586328302e6109a8154666edb9

SHA512
90bccf79598359f8a93b79bf78d9728797ba2139aa1ced927860614fa2bee6999b1ec845fbd464be59cf545e5dff579d33fd16a760c9cd104f59797453fa914c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72813eadad7568b9d603a071ff122246

SHA1
61803d53fa16609146c3419522988907767c85a2

SHA256
d6c2ebe42a716f943c95079fc8e615e8cacca6d12d350cc6ebbe29e97510a064

SHA512
2f8b82f6a46a13996add4f46bcd553accdd829d556116aa9637b129dea4e095d48cdd632c718cdaf89c212831492421f40340e7f6c0b54b4ddc37b8dc2de4387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c501daf832fbffe3f538f0e59c2cdd7d

SHA1
35420206faac2384fdae657700ff3add36f43db0

SHA256
e1e2cf9c87a0de54fbf0b6aceaa2298895ebe948dd989dd2327401318fc39cda

SHA512
84906cfbdcd21a4f68893fe4acb66a9a7904ff8272316289a9f2dfc561a34d5468e31ed6fab3bf819cb960f7ef128e4bf611bc86d3bc088a93d602b128edf61c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
529ede8dc6b7704de988024650930b9a

SHA1
b0fd7a3a174f76cadd88156323614dedc1328e50

SHA256
773faf66de76535f89be210ac35cd2959ebe8056559c86abc61d21996587f732

SHA512
9e6a3553c76fc6c983a1e4418b4dc089b0e563aa1e9c50daf793633e787fa77ba156ee6d3c25082ca5f5431dded241898e0376e0f6ab83187a41bb34dcd65df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e04b5a7e0d2773836d49677b9deeb1

SHA1
8abbbaf9054dd987e4625d06184a2492097f36fd

SHA256
ddc594415b04c47ed0afd5d52d776e8fe46b12e7db1e402aa526a24cf27ad9ab

SHA512
8964dd149b3d8fa682f8c46d222ef2c34236477308b8379f6b0dbd98826bcb94622d327e975ff369a96854d40a7851106a1f2897112b8de0c3c76a80c61e7a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afbba33e4d66bc054787d7248fe9f6c6

SHA1
27028967f994ccd4e4d54f9093fa835c8be71689

SHA256
948d478980f643b329bd883da1a86f8c48cd83ca248d7d695a3e9b616a97d900

SHA512
d60fb028eb7b1fa236d6e9956c84021e242e7cb49856fa71b6c59695211b655ba3a32691f7e2a38bb8e1f60e156635a3b9e1fc284ec3a267df958307e1b16a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acc1efc647e8ba062594df27bea98891

SHA1
b21844dcfa8e758d3ee08eba7bf703673a0e7d63

SHA256
25bd42c8f42f9e15c74eb645916de6c3d40c365ae53dd52f073eabae4bd3ae1c

SHA512
05b2b7627d4272dd90d1c9012e45494b471018da3cae3c194f67a3416e7197c5530fb53088a6fe6224c30a88d11eb0bcaa91afb84bc23413f7628af278a3cbbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b8cec56cf6bbd273fed7e66dc7e1dcb

SHA1
0be3683a009009ebfc37f6e061e853b92b5d1d64

SHA256
818adacf7b6eafd2003cb85bbd2a26859beb82bb7883ba84add945476c165603

SHA512
d05531ba39870ad897d49f7b97808eb31ea632dd406543bcb7ec41bf4ca0439586b8964772303c58f44da676a5e4198d129ea0b37f873fd4f76e12bd2028bbdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05ZIV8W0\video-one.com[1].htm

Filesize
12KB

MD5
cdedfa2739174ecbe1d917cccd39a997

SHA1
5692f9c2e13c4218661eb90ddfaec0ced6c15a79

SHA256
f1021db34e41f7a1749672945dd2b77235bd04184376f8ccfff07e613a53685d

SHA512
9ac63c2f46ae781c33ef188a6c2837e452a2d008028eaedd17199748e3c079df45efe4a6ac1e631769b60582d50bf34b993cdcf3607157ec64ab35afedf1570a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D4F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D72.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit