e31fde140cd91d211b3d95aaccbc9371991678f71b1fc259eed4a85fad28d9d8

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a3d359c86b0eaa42e1c385c59bdf0bc.html
Size

10KB
MD5

3a3d359c86b0eaa42e1c385c59bdf0bc
SHA1

c77f741b8c99c128de1e416415890cb13f76998c
SHA256

e31fde140cd91d211b3d95aaccbc9371991678f71b1fc259eed4a85fad28d9d8
SHA512

325f7528ea5eee78192591f8dda4f43906dba6417c9e0d6c10ed207c313b4839ff1a215d6002a61f538eff36444d02e35cdbae58f7fbc1395b8d3c1ce3c762b9
SSDEEP

192:2VelIsr03yX8k/w1wvqLkZXBxon0zCfMX01HR6uBuLbdU8d:selIcuyR/guXBxon0zCfMX0x6guLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF5BDDA1-A636-11EE-B928-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410008421"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a3d359c86b0eaa42e1c385c59bdf0bc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68da1144366ba5ea0e6c581801943d31

SHA1
bf0f0d3cb9338ca06f27cee877e0bd1ef6f5f803

SHA256
b8c24afc72a69efd038e586c145aa6b2554582a77681082b1513ac9b800ce331

SHA512
180d9cfe7fbc8788e63c79d9759d65f3190291e9250ba121b90c72184f5101ce75740a6115cf2da8a20beb15cee046f68de50c23416a548d7fc3226c61b1bcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d94848d98ef5abadf7ad67943e3b145

SHA1
49d35cef5440314c44459fa7f52939991b85b30f

SHA256
cf6f98ce45a081846857e36e38a37a724b9a132ff77af5672995079989f840ff

SHA512
01ffa922cc337fbb05d4cdad9a549348fa3d7db7b286b7c151746883ee2bf2fadd3ff02c45586966792b100859e7238e7e3370cd06e70718ce5b56bbf9d28635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7270d48eed8b3e02d0d924e50326623

SHA1
a434ed8fefbd4dc2829460a8a7d5dcdb11745df2

SHA256
2686635a082cd3d61c82422710c32799b5c0a67ca1fb661066135af78325274d

SHA512
02889404ec5292eddf003579e3d0fa370689f67097b9320a15150d3b91aa1709cffd33c36e054d8457a919f55f636e4c8bf96a28381e55fadaf9b01050356fac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86da56ad941c74e3fa7d066702d8de46

SHA1
dbd492631da6cba04cc40face10653d81b314411

SHA256
87b76e5f6c5b3dd25f464538b0f33f5602d7cca454aab50a9313b00317476f4b

SHA512
4ae37f0ecf813f4d433aac433d73195ceb597505cad3a285909b6657580337ab198fbd36f6822b7a34303b5082291bf9f1488d84a2814fe9c072a18422297740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
044ed4710b71bc9592029c679f07e516

SHA1
600505b480cf7a181295f7a362b66c8e2ece4fba

SHA256
b6ea4016c2cf70916378a57b1253ad33c205e94619165c78e2c8768accc65ec7

SHA512
69109897be5d517bb6ca2b7742c9d93df3e2e8ab7251358539612644ae046ec53ea3cc7bbdf50959b337165be9033708ee9540fbeb537784fbc83ca1a8109e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f793c605830497e76a40d0085dd2acf8

SHA1
79c724573ac2d2272b3a30a35f55cf744159c328

SHA256
4a9fa26a04c91543935d7e7f459599dc0bd54ebc425cde057e746ddd50cd7784

SHA512
665f7e47cc5375b623a545dc20656cb0ce74bca0ce50973c7454827caa0fbe3771be912a226c98c8a4da24ec769554c8655b98a099627010cf61ac016df96d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
427efe16507b6d761b974b1b5c43f59f

SHA1
40054dbcc05f4ecbbe7337b6fb6f2c61f4061898

SHA256
f2d082366b0ee0e2c48447eea18a0b74fe1f2d7d0a72a96095658a837b74df49

SHA512
424809651dbad8f0abbafebd254ba1593c3954c51df9d4275eeb61ecc57d156c91a1d34e517a3d4f58e4776a99a023bc8ea93d748a2e5a45d78283ad3ac69452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73db7571eb64df3d18b7b6c1549bf4c7

SHA1
db192442a63eaa772c2fc3e7cab2fa84a874f2b8

SHA256
9028e4ff975aa337132c24e9cbcd4ca6ce423d3a2f950f094f9d22e35d467345

SHA512
da29eec58ebeef453716f273591706fbea7ef0f9b0ed35dc041d87a82001ee370e0515b8f0edb8fb576e345fb8e452cfd332f6fff7bf506634b20712e5cefe91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfaef6d4037dedf59dfe93e8f19d2c0a

SHA1
fd256dd34f144edfd900bb43aedddc93b784f454

SHA256
c1709cb4be7fefc86ea77d23b0a30ba8ac05af34f8a860dd606ed5a38d34f7a9

SHA512
f420a09fef4826ce160a55ea4c88a9ea74a28c926895802a1cd4dd039c86f7c8c16132e510939fa35b5a813c68b74ff95404a18ebf4a973ef431d69a8c8ee1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52B3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54E9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit