fd37754447087797c5e88e8f124581785cb314a7ee5a0f283c62df2672357346

Analysis

max time kernel
121s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36e27a0750de17dac5cd01a1dd962a9a.html
Size

2KB
MD5

36e27a0750de17dac5cd01a1dd962a9a
SHA1

11fc3f206d0b3c1ae67e540d77d5f6132d6c85c7
SHA256

fd37754447087797c5e88e8f124581785cb314a7ee5a0f283c62df2672357346
SHA512

2daa1f8d99a55504963c0f7b58155136a6d6b85520792b779fe61a31317f96b8d7a044da2521a894ed4405c172e8cd6306620928cf85e0de6a6d4f721fcd1ef5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d228ec2d7269f695b882895fe6f3682420db28c57cb0f9c62df9b5894c197898000000000e80000000020000200000009286c172bf72438ed931c2c3ec10e281f3eac2ee4bed0290bb68ad20a70b948a20000000c8bf8bcaaa639a64e47f9275f5411dcc19cdd48a28d93ee48619edb2fb81205a40000000b89e34c59bdb69e806122c32c7bccb176edcbe856ad2e6d93bef5fee97eb07af3ea82a9f7834ab1192ca951615bf545505390026c7cab6f5a50167ab03997dda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409996124"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{539E5531-A61A-11EE-AEE3-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90aac229273ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ddf3cedd0c91f7fdc169e7a3b59a07a64798350771952d36dee2c709f46bc12b000000000e80000000020000200000007396c975d7553aede94b204b0a6d838462525edd8b65a8172d363df7e2aa1bf290000000de729b2f18431eb7a9a66b7731194fd09c92446b4ebd3dc2558c470bdf16c1993971d93ef0309d7a77c8554a30d8b4ccc44dbc343739a2fc0a74741581b90b6ed413d0e7aae9af84980bf516ad5cdbab72ec476346ab93076d84a23f085f26448f3c34132601d89e0c02c76a51642177fae19bc19ff659339df644a3147878e02cf2149e96117302152640dbd94b074e4000000089f7b30fb7eda62eb7c266de54dc4b601b2cb455d7d80ef6a28113c718bea178152f8d8ff69d282c2a1d618be740db9c3afdfb95867042f76e450a9e56431b92	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2844	1724	iexplore.exe	28
PID 1724 wrote to memory of 2844	1724	iexplore.exe	28
PID 1724 wrote to memory of 2844	1724	iexplore.exe	28
PID 1724 wrote to memory of 2844	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36e27a0750de17dac5cd01a1dd962a9a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eed42886e9ad73a7ffa083ea24deb39f

SHA1
b0d92f9753c4dcd8010ef93671a44ac5905ce526

SHA256
29b87bf111295293301e3f98aa83740e948497316986d0956f6d6df618b4b583

SHA512
f5c1eff2c453154d6d7dc81848648b1fe5b0454a174fa4a4e2a9a84fddbd905b3a8e11111c09796b96c20cb5d664fa81cac40b1f5b08b01cbeeaba5fe4f101ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5921beda645ad0d4024f7ba447872a3a

SHA1
35d18f20da84725be27f7507cb1d768da6a1b149

SHA256
eb8eb2f4af92aabad4a43f8812440a16feeca959adba00ffb3e407cc13e3eab0

SHA512
fb2fa92336d3e99bf8f012dd106c7e75c60753ca349ed69d9d6e915a76e88ed37303b59cca395a27ae4704d4e8523d6e51402fbf452d32cd497d85ebbf6bc156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aabab5e81a8bddfd4d6b2a27eda6c917

SHA1
d57f5e2840c1359021744d17767502810635d8d1

SHA256
611bcae4e4a069fe1e64e950e52dba911a4b1e5db9a65e61428fde72eed88a8d

SHA512
5c08ddbf54a91b2783dbd1b4d4f7e8e738dc7e8c8c9b8f6dd956dab9c7bba4679c573a14b91dc859b8ccc9ef8294cc0551730d35e2e665613b5b9f5ac8958f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89cff75e4c93f6fc9473061d7f67eadb

SHA1
c0fb470ca523d7c7ea69beee3e75507530933e63

SHA256
28624f3d79df4f3929346089e6f4ca35462929f14eb016f8dec88850ef5af4fd

SHA512
76031a8e3a00beadf5e7f9c7d91f33285e2453198ac8ca5488011b4917d88e558b8ae46f3edd60f03b334d8f2606e8b17abf26d968f13f01661d490540fb926a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89687baa977e42dfeaec088517c63e0a

SHA1
b31f56439d82423c947c9c1cdebfa4a853a27789

SHA256
459f08e3eb834fbcbef3f7331034f58388949b59e02c259b15620f3240491981

SHA512
c44c92e6f1c82ec7202cca8d2f525ca15fdbb49aa33f3a67a87aa461eba96e2005ebbfc292b5405ddbfa2f16ff049f45fa56887a077747d2b04f2c95e577a150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d9f14b24655708971f9148a3e710e46

SHA1
fc8f32fd323d6282ad446f2b5f84e161116ebe59

SHA256
70a5a830189cd3c70e79912c3d181a236c662f1708d2d9c14e69fd7d52b5b886

SHA512
71387f9f3ec20f2c28c4eb8a22a1b127aa40a346fd443b3f9c7582fb06ba9515afa9764fee4eef3ca6d609087c4f6860244be8c5c6e6222e047c3b8d823ef266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac7e389fb854fa4c90f8d7d13bc86238

SHA1
ceca3490c7148359c2f74f1c55b1b7967a81b579

SHA256
5a1aa9c32ee30a63f64aa6c61fab4c920d8b43d7be84b453e9536e741c6166e7

SHA512
7719f162dcf11f827cb2b2b9d298a6c5eaad2823e803bf9cce63b1016faead1b2bf24aa9b4f478d030945aa91a52e428c83275ba848d3f9afec15d8adf5cbe4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1c8a3262a18c9af0d5981d617a234e3

SHA1
18e21381e3930f9d6136dd80a578bf61d10932d8

SHA256
d545424408c2c1a57458d3a7d4e57aad2c42c5c1d9aef36654e2323abb38a4c5

SHA512
9ddeb6661e8521c4a3bfa4c006685ddc9dd18984524ac9523b9b160c07e66a970ac395c242ff42dc172485560fac6f423b8a7e53606a18cbbf124a12babaff38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CEE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC1D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit