e43dcf60c4baa7260f94e0d8557db18fb65c693a8c0581539a6bcc9fe7b31e66

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

364889a36e513e0a99ebf60ece441fc3.html
Size

7KB
MD5

364889a36e513e0a99ebf60ece441fc3
SHA1

db6155bad37e19d05d98f6088d85a3bb44266c24
SHA256

e43dcf60c4baa7260f94e0d8557db18fb65c693a8c0581539a6bcc9fe7b31e66
SHA512

fbb0ecbf17633994f0e7ca334ce85b17683a7c36b40f924513c59dc8f5974a08241c1942d4aed4461b4c64a51039c1f9c93cf808e2cd394c64a2595edc1d3e43
SSDEEP

96:uzVs+ux7zHLLY1k9o84d12ef7CSTUjwzMcEZ7ru7f:csz7zHAYS/qPb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0cba18a1c38da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000efaa18640eab5d9fb7a4054493e55711474574ab8d78e5a2c5bd6f122c46670f000000000e8000000002000020000000e2633f2d6df80e19e857721f67422a4bf68ae65ce2929df9864a79dcc86d291090000000f5894e4db939a5c101718070c142728c4ec9828509ad9dbcfeffe4b0a3a6df56bbc4b829aed19af2302cca53b491d13c93436ace7bad5f4fdb7aff6e4b701f702d0147229db8a4002b93caa3e909d34c53ba9779e678f740174de3b8667cc02c7f4f9550744325c365bfae77ddbfd9978df6b0d929398bcb9151abaa018d665bc37ad8b61cf707b394db5e801e38ef8140000000666dae932e47ac5a4e801311c6eda85f36faf4c8096aaa620067b5b4e7e3775bc44c39e8e7d433fd64bfc4e14ad19fb2ddff0993946b974461345de74a983b5d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409771654"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B29A4F11-A40F-11EE-9AF4-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000078419806c143a676cbeedb88c0efb43fe901a1cb94ac0e0567c89fb98c641288000000000e800000000200002000000044b57d156b9662d901a5b2228dcc44ed42f58d6b814b286f7fc28a793ba9613d200000004127ddb6f84368108c0b75350be5783fdaf9e1af39cc10d43a039e231598a47c40000000334299b2dc85d56de4246a82b3ee956a8fdcc9076e9cdd9fbad3cda0b8691ca63bca40015d54888ac96ae75066dbdb85a27361b17ca39b8b23fffabb61ba806b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2940	2532	iexplore.exe	28
PID 2532 wrote to memory of 2940	2532	iexplore.exe	28
PID 2532 wrote to memory of 2940	2532	iexplore.exe	28
PID 2532 wrote to memory of 2940	2532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\364889a36e513e0a99ebf60ece441fc3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e7b5c794df8dfe83a629a6dc50eb38d

SHA1
abf7b292389e3d83f8150846790838671e4e9565

SHA256
a23f8f9fe865d1e867dc133f7beffc5c48a61bd7c7ef3ce4b6bfc5abee55f7fd

SHA512
1bbb426da4758842ce6d3bb4817f2e6d063e0c0e658018f1ad4f40f5e71a0bf60a238af5385a270629d31bb332e6b646ab36aafaa7ed16f32348c3474e765031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f7eb67a93958dde0f0068f1c082af70

SHA1
8dc2bd6468fe788ee431744d07ff9f0ed0036376

SHA256
42def1b2a37980acb658f97c9a6e1e6ec989cb388328a6f589ad50b9c99d6748

SHA512
18ec0d296d03ac9a8e71ebcc3166604e24117c989fc99faf9d24714c600e085d8edce3210c419bd82aea9a5b25793bb6370b2f616a24947661eee3dae376200a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fe586a87a80ad89783991f1327a34a4

SHA1
1e1c0600793bc80490266f01b00b70a1571a005a

SHA256
71d841af7358039df6f8eca226f8c621a7b1eed5a3d5f23d49c6dc8847c9f47b

SHA512
02491ae045132881a7977e89a6967555b6e5f47bb651ef656dc01a1832c9f9892a6bc51bd4698121ee995624424404510cb35310f9ac4ebd1a62e2a0abc25386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beba949eedf3da245107ca87bccd6cc2

SHA1
3d029996f8e9a4c91763537df44bda91c0349626

SHA256
351f113fe3092324be357f16b61a6c479baedd6fa49ee4673b2f3508eefa070d

SHA512
b0cf3cc96007fe094a02b7a7bbe764eaab4c28226e69725eaaad6f217aae5e3b5a8da3f913cdf77b80d9d083b761ead9ddb784caf892c2e6d13faadcbb076aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14c30df4869949b42fae5499b72729c5

SHA1
20be59c72f8d892c80291e68ccff58e087e7985c

SHA256
ef12ebbcc24252b1d15e6fd8952f9e74ec4f43d1e4c491b695686fa3467929c4

SHA512
9735061a67a659f29f8f1bcc4b0e75a505221fa7659f164735ca20a81f235967c811b06e94de8b8d6228fbc2e4139d7e8e830509db909374abab15fd939e0f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bb652c9b126679ba078fb65d78107b5

SHA1
c1e76c95505f23d10100439869360205dd26908f

SHA256
d283a95f52f09bc891911e00f5afbd3fb5da036f309cc695bbacc4239d417bf8

SHA512
665f4b635c0a33ea9c9e818ab1b518f9e7a475f28bca8504088da9d5435f9e0bc450737ffde1568b582e925f1b6414c5e4f9888f608ca6d0afaf2190cdc376ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77ed0ffba10f208a9a8f63e1d33779aa

SHA1
2db6ba4c3994deac0e67d248cd2ae48988362320

SHA256
ce003cec82caf4a1a70219fec8af24226192a7184a30720b809db328e9268c59

SHA512
1e469f00b03b6bfcd5d699643a0848193756e57352e7899735339e561767ccded02bd32325e938ea514361c6fad39d0896ada1bafa640d6a15362a3afee8e835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e61db0f6e161376144198abd42c8a081

SHA1
1b31acb7af257c847bcf1182c050c1cd6a0b1a6a

SHA256
794b0aca1a65b1478752a93b51bc874a55568cd034256ba9fae013c0e1aa5d49

SHA512
43fa3664b010a532a1c60006edfae2a81ba78e10394889718543db8acbad0fb06129e56a678778a57723a424457e8c96951624ccdf5a9579bd694a320bee435b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d40c2d977d58dd46998269abbb95c172

SHA1
1a652031ae06a812a398839c101212d9feb06210

SHA256
6d2f367f153f7e34267e1b1096e355405d34e3b46cc3d5d597d845a8c8ab6729

SHA512
81883f1f4c40d65f4f07f413c28b4fa3631974ae1987abe197e07f7d7887f8e47ca724543e79cd116e58019a8d2b2701e95689149cd998a85291809f70c7d040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfe1382d36e671963efc86c12626b0db

SHA1
8218e1c5833f77eafc220a64a7a75c69649b0a47

SHA256
2d8c0b6c179de3638a9bbb14ff2786b65199861dfff3d74ccbd04763b5f69abf

SHA512
c10aeaecef21c19097d54f514b0e3455f7eeea469caa42060b871b698f7ecdb2ec5df22a03e46e1908cd4da0d2730a93547c37f0b5791d38e912c25781da2299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deff55c57cabe6630e80f74b9024c164

SHA1
fd657618b600d3376f011955bca8cb9755741e18

SHA256
7a360e5c3e37bbd0e282ceac6334b487a8a506194c14b615b9f3eb9e457322c5

SHA512
2e4ef6dc55b77bb8bbbc6c5f14249ad475a8dac387b0f8a99d7bfa1d9bb1424de1937672e4d3fb576d640873fb2095a159fb9147fba557e37de5b45d06b68807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
272b1b8f10cd176ed48f5045485050b2

SHA1
c056c2fdef7df0b0a27210cff1b31dc5aee8c918

SHA256
94fca796cffe4d2c71fe74ff773a8b44b7bb38eb369bf18f8f2c6cb54c271f90

SHA512
964742472579ca50f3d95b160946bc5f00ebe5a63857aff7e78ba5f00e77b2fce7383da11fa34d9e2aa2d6b71dab95d950e07d0df9579d7e1dc67ad05153cdc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4edb951d1a3170b73ce599286787237

SHA1
4d1ee9b6b9bc37289835ade37389503eed39761b

SHA256
bde85aee0199d775968ed4f7708ad681ce3eb1f7efe7bd91df900a3c0b1d4e5a

SHA512
85d89fb886ff7d1e8aedc8a2dfff43549dcc24124935994d4f055617eac0c8241b7b74071e27f8f0580eebe7ba76d47766564f4b9343ef870c7c3aba933bc967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8875aa75a06e2b29240174f7f80e86fa

SHA1
9e42a9a80a9c11de42b8d5a8f0eaa13336e99436

SHA256
120ea5bf3bf147a4ac3962435d43535a9657d62be241db2269a7cf2493c4e2c9

SHA512
36ceb62f00a4caf5cfa47d421c4416e561dc0e83b92692eb1b42b70b1eedcf73eb063ab0a7a1785b95b03200b49a1f669aace6f002d44fb32af3489f5bd099bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB35.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBF5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit