e7b4d76b6fb492d521621e60c9718aafd04efef2ee4ea7ad5f99ccf2fd2ca6e6

Analysis

max time kernel
119s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

374bfce013fdce0e97d0c533aba8d600.html
Size

238B
MD5

374bfce013fdce0e97d0c533aba8d600
SHA1

6020c3e727bdc15c1ef3790de5f8d87e5d16100b
SHA256

e7b4d76b6fb492d521621e60c9718aafd04efef2ee4ea7ad5f99ccf2fd2ca6e6
SHA512

d7036c60ba9156dd63adde97b88f97c4bc714e588d46f57c94a27bf479d255667bf2aead5f2bc7d048c57dfbb41d516e86a625ec6eebf53c6aa28eb5c7be1e29

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409773549"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a083a8e02038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D4E3D41-A414-11EE-AF10-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000a02234a6e33eb737d39a3c11ffc9dfea88c2cb7faafd7fae5188b84c646e3787000000000e80000000020000200000002c1efb7825d39b163f485b1183088fe2e128c54e5ce6d698b8f6e2b8c0dce00090000000dafa0e78f37dadeba0059ab7c01cad49ebf687c6e0757edf89a2ee7eeb00f224c9223938fde491c8da9d277f0d63150f9b9ead63e7e03b28a56a11d9221c3be7ad7a629eff0adc9209ccbde5a6335fabdd1d1b9b0a6d968c533330230e1205754a7d1a63381e7a8c5f1602b7f43dee932dcbbae92ab6ca982522d90daa1ca8bab9efaacdc776139722f26233ffe4eaea40000000ff23020412349de088119b4305b3f60ea4961057c6f15a2da511b024bdc621b6cab3dc79012481b50c36d4a146b5ade4ac5f08c6cb6c969293950d714724c4c2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004ab9b5d733cf9369c41a550c21644942a2a0c39923064ba491644d58e8a72c5d000000000e800000000200002000000032e8be26dd6c9ff967d17897979d061ac778d71e7067be9af84ce3f12ccd8f0620000000e234bba5e39aefa29d64a992f7afaf7fc3abab7719f4aa154d853a595e8b63874000000042abea632a46d7e235fdca32e91c66457f1fa69708e25b230bb4460324dc87867dacc84907f2c9667f4a4be7cb30a5c6debbd6a5670be58c41350f5c0cc7a51e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2664	2036	iexplore.exe	28
PID 2036 wrote to memory of 2664	2036	iexplore.exe	28
PID 2036 wrote to memory of 2664	2036	iexplore.exe	28
PID 2036 wrote to memory of 2664	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\374bfce013fdce0e97d0c533aba8d600.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d16ff4cffc38e4b91b34b92558c991

SHA1
2dc81c59a18af0694a4d3c6530bf518c6476cb9c

SHA256
3a29e69ef7cea52c487a4203b9b99f3080f7ebe5ec685d5f0223c0083441bd67

SHA512
9f038afba822f158abeac81ac047bcebe136e3b98fabf695b01d6747ca667a405c519c406b719ea90135c2685f7cb9fe0ea273a20537969e6e8a65e66b75eb51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f684843588947d40cd63bd586d6079f

SHA1
3b3d35ffd3dbb4745c6edb9e7bc6b0af42b2b084

SHA256
0cbc7bf8fac0dfc2d83ca3fb0d0e4c5d8d777decdddb126a084a13213e7a608a

SHA512
be7e67b64be93039fe1109d49a8fe1c0f7e845aea85e21c9313c02416c17547e78df29b54c1ac377a9a81a0f946d7366053161faa4a2731d6cea9e582b23e108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a99e2e7e675ddbd20e3d967ce04141c1

SHA1
e707d6dc7b101e6168cf79a5964070b2660b395a

SHA256
92d691a0171fd0aee2894c07c5cfb42e806c560b2d66a4a537c8c06a84556069

SHA512
ca160e8dc009da03ba90a1c6e7604292494f31b06c1a0350bec9ed699942e83cd0e852844dc64c60a4049d7c7f6ad3d1a1902ecb3b7933a1e90595f20e9ebd79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9225dd35728c99b61f2921c8af8322c1

SHA1
48d4a875161fa2ffe2d1d30e2c8a0ede61b4cd5e

SHA256
002103019627dd79d027ee6c777484cd647b3d07580488f4147f6a8870e55f54

SHA512
a3caaff67b0b1bc2bf63b2de2c5d31c893f62dbe438640affca127bbdaf0175357b73efdcb195bdbb503bcb00fb1654e9b3e407511d398c886ab975412579485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5be778f775b4c714b8ba2d3b875e7d8c

SHA1
af6809bf4ce0f1dc3f4a41b3c17a81abc6575115

SHA256
c14665131afb54a7680bfdbceb42de863f0d3ee8915e57c431c35da3a5096cd7

SHA512
8de12b5aa2b1922091043cd5bf80425906adfa3763518916c382798e97c3a5d70e3ddefaa4117c9b47244ca92aa20878e8b15ce7599b6e30b513a394769985ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
129c5145b1a85a287b248e7eaaec4fa6

SHA1
4604dda879c8d17d2480dc7347afac941c00bfe0

SHA256
d94320b2e77c63e2f5579e8375330496c23e1ca62611a95bf9cf598c68f9a37f

SHA512
a8dee718422c55b08c4bc9864a13cfc25c0687d2ff9ca15514325e486902e9a62abb9c39d57d7838e240db323da87a15572c7259daae7b7f6346e5d4a5205d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbde600d5e299671287d92fa1e15ca0e

SHA1
3a07b3d07014c5b69142143370d02a4dd43c291a

SHA256
438c9fd528fcb7a90e3fab047ed2844a99e022c3cf2c2637edbd589285f8fafb

SHA512
6ea3a76220ec0592c974a8f241cd75343ff8c95c54e0371d00cce4f32b3eaae3e4ebee380cb7036feadf22c006de27eed966535953deb38e3dc070cef1b706e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef33fc5b2ce094bdfadfde0623720875

SHA1
1298a7b6f288c6e2c8ef0e79d22b97199cbff9e5

SHA256
07a614d519c23b6ad37ec3c29de8ceebddd28602b98d5b0be69122008f1ee74a

SHA512
f13f9c0382fe67d293db84f9b1d4a4f0eb712e76ce107e178c80aa101f9d72c081a65e2380617e95f7c6253381645c498c647679c7221d409aba3f3ead0a784b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA460.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit