f877f8ab3307f1ff5df46c981393289ed9317db78b2acae8d093e09d936a9a66

Analysis

max time kernel
122s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b53668bf9c05770c9c5d540aae6c2bd.html
Size

73KB
MD5

3b53668bf9c05770c9c5d540aae6c2bd
SHA1

1cb52c1d899726a4fcdb2cec5a56e52f57305581
SHA256

f877f8ab3307f1ff5df46c981393289ed9317db78b2acae8d093e09d936a9a66
SHA512

dc94f6e32c087a3518ee278428ad53cd844f9f8e64c83917f04b83aa6452fb4d74407b8558a1239248d51317ab05f4b7da8a2374af38fcb4ee60c801cc402714
SSDEEP

384:TVftfYntgb1BQ8tV7PB0YhPQzfvfWi3HrYjzYmKjapiP9LtX/2S7H1yYbhQxU70l:7w/riWrm7OAAg0Po

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e3f8ccb7997cf3ffa57d552c6c4cc7a21a9c75eacced29516479fe9116a1a8bd000000000e80000000020000200000005dac2e54fa55ade648bf9b010a339664db13674a646482cc4a75a144ffa19d7f90000000fc58f65033cad8960437bbdedd8dbfb3f66b85e754048098386222e5a7e280da7a6cfed7eaf2b5e904a1bf7539cc4894ac7f5835ae2c89b78c8a3d0012459fb8479d3ba0876aacaef00a72127085f65e9b7e74adbfca428060b0c39c95c97ffebb814a34c1d2a3ef1d11ff84cfb87ca1a66670aa7d874bb38a41ac8f4acdd4a4360aade3f8f52c032fc7f6a280d8a46c4000000055c151be83604d71f77d10ab49547cebda1b4b78514dafce5de4de2b647899a041ac59ae291f55c7923287a8183f31e8265acf669802e08dbe730eae456fd0f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409781649"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F11C6AE1-A426-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b011eac53338da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f4180f5ac10355267d80940b4d699614c2a4722d8e1a7229960719e80e4d99fc000000000e80000000020000200000001e6bcf2467739ce3a52af5f4fc4282762f1b4a4d3f2b5023bec6d85bd91b3a9a200000007a8bb2cadc10cdb0ff34b269792751c69289c9350f5155d58f059bb59cec46784000000067f6f53ca6d3600f1accfd34773cfe650d27d08355a8b165aea968d1464806a614aabef5a03bc25aaa1e29c9d81b710b83acb24a301457595ce52f54bffcfda4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b53668bf9c05770c9c5d540aae6c2bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4756bf89df93ac1d1a359ef99552254

SHA1
05eb9ba04ffa1683302fcd8546c81b5f9c126a26

SHA256
545fbe9b007fa9f30f22f90876842f20e04e27f8b9a888f9dae1a6821064c0f1

SHA512
1e328fc6e2381b25562126bbdff7a637e06e3907447a7dfdc7ce5e7c9a6d22872a44acacc5b4c6a7c2c9e19c1effbce0f456f229a374616c0725b3f86c07dd26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cecb72c26e300f4a62e7fb10fa6b9fae

SHA1
7826293af647577203425ae421040ea60fef294e

SHA256
40c3a2d69ebc467ff82188ee8e27b45ff7de794bf3658d91e02ec30dab884ad1

SHA512
d1f22ca42be9d00394278d23a512897ac47e10baec25e0aa8cb70594d6d9c6dbfc5fef126f8a86a76cefe7eeeea92e5bd706f255676e5ea26ea9792e34d9ee4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
016412b92cdc2dfd45f38839f0ec091a

SHA1
6ca434da17799b9aa90eba71312af84a7f50c708

SHA256
91fd38145ca16bf4a24acf1b8f496f4bb56d6ef6604a557d428016871536ad44

SHA512
5af73c5d6e5f873b6d6b2766c958ab9e1cd9d27eb055013736f3c7235519f75e487a2c908e707edb39c881a06bafed6332a4197a82ac93235364246ca569663a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
301975ebebf7ce3e5c02b844c1104497

SHA1
f1b425fea55630050811ed330fe1198fa471d465

SHA256
ccb28def271530f589c6cd1a6eea62d41e12626ad2147914f689bb113b1915a2

SHA512
308676f7a6a876d6829804e28342cc94c1b2c978e6440ceb1e84156a2e89792dbd06957a0ffcf0bf7d30869df143a4d38365ac191f7f4ce4c5ecb54d8c913fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ab0945ca0097fcf151882cf72626d39

SHA1
4d7e874bd9a8006bfe893249008ca51af163e71a

SHA256
c69a0e8ff78ccb5d591205ea53adf96b399d8373f43171a2877a8a0b4a662d88

SHA512
0d219797d261352297d2a6adddddf7f07f9030909cc56501c62ebd0793e76d4878503f98f31aeb310886fc78da05818f7e3e05298b45081b27baf83387600b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2587a54a037adf86a08957cffb68f468

SHA1
906554e3b45b16566736918923aad1a8a3b4a415

SHA256
b0f097a7a55806f4bec5daf5857043429571b4d7d34f034b8309ef322fe0ec9a

SHA512
f9df68cc3a47b5765831dd1f403108c882f526eaf0c27499f2c3112c0cad65e90356c14097adb6c182372debab485377abf4cc0fcc0074e8e21495b15fed96fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dc1b83ef86440aa0445a8daeaf5b335

SHA1
4e0abec3906b52f9bc1445d40040b157e9362c4f

SHA256
48f8e1993067ec4c52d333aa4e816a9176a6433124cf9f6f30fce387e8036bc7

SHA512
ea6e26b4c42e99fa492b16020f74529bff0f7ff2fc4928c5d333bc277091e1cb944b74e80672c620d6aaabac3f9c31578b94dbce675c67f94efc3b467c4bda8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f66746dce49fc49f901873a33be2282

SHA1
c5f01f7547da377206656ea98d3d40f5f9a643ec

SHA256
9d3d810c595fbc9dd639536180ed0fd39c84ee64df31bfe2a5feb49d0badb275

SHA512
825c7fe261bf4d7cc9e0da23ac136af12769917cb73b23285e790e21df81ea09099562f30dc8f05728d89992ec15719fe96b832483cfde0e8e5a41164753f12f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4ffce4d7439abeccdd8951fa76f11f

SHA1
974ca121237919baadc2151849a55c7af81fa825

SHA256
d7811fe09cbe21eb18658b6066a5950e4a54755a053ad206e5b1a096c9dc298e

SHA512
990586394e2a5a84222d6f706b260eaa27aa977ea67f9916c3fdcd6a0a7c25770bbb726bfe03084e3cf84fd923d0b85914c3e7245fba45e75ecb138f4a460c22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b8630a28e22e47f43894df2167961fd

SHA1
42460d9274fb4f634fa2250166735c766706e6fe

SHA256
4cb5019d5176daec07b29758550461e1f9550a806e737a0d646a64c1be3f7521

SHA512
900d798446a6efea1c9a60d169d6c4ab14512102236bdd775c86af4597e156b3d380d8c86a53d4b734a81f8354a679e48e53e82be12db4f1215b64d8df433773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
773f7404ce7f18260148a62bdb1a3e5b

SHA1
c94ea2b54e816524bb3c9108f8a21eb8fdf9c33e

SHA256
0c6cedf3cf5649b76f0ed472f977f222c55f4191c4bdce231c9810f6839a6f69

SHA512
913ccf02a9bf51e95c5d55994f453b85ca57c9b49ffb8922a0beeaaea5dbed9086178ea216b5c29635520ffd90bb8aa8c23da5bdbca1ce843295728bd8fa8e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9ED2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9FFD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit