fd5b4a4b464a0c1228a3e51f445571bd89e49841c5fc5e1571952641f93dd4fd

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bea9b56abc15ef6c951c10712647d5f.html
Size

12KB
MD5

3bea9b56abc15ef6c951c10712647d5f
SHA1

acce0c8d3c055b37402e61e851e9313d63d2136e
SHA256

fd5b4a4b464a0c1228a3e51f445571bd89e49841c5fc5e1571952641f93dd4fd
SHA512

a6c95591ff9cba4d8e659f92d53ffe65e23d544bd70089ad47e531761c38b6f1f635c9e6e95f55d7419582a4af2325991978174c0aa9be185ff2e5147e0ae0a8
SSDEEP

192:yAyWbl3znxt/5R2c34R5hXs37rCTo4AiZXI8y:LyWbZz284xon4JB+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410014451"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4075a8d5513ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB958091-A644-11EE-914A-EED0D7A1BF98} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002575f69e9fd6452498f41f7ca724ef1cdd38b8b91ff73452b4dafa5b60c44263000000000e8000000002000020000000e4a5f409c9303e4e25162995210bdde9ba9c2defd8112a354b088259f6e0600390000000950a142fd7e7511901cae9eb27efafee2e09ca1c788dd1e7675a39eed7bbfa34933520dadcb64ec6e83257f302556f76f59f8423c060e7c9d2d9a516d43ba6475df198deec6c4d0a847fc6934706dd5ba4643ce79e134332f555dcc41a3c291c99c9812823cb39f0965c1115aace12592adf89b01002f36bb5b6dd160e11fc4666fd5758a69ac8f1ba0cc4401dc220194000000065092d20d750ae1bd21ca736f56e9d19e82197b9f6308b61537e79b75e81a6abd1914846dda86da1a8a6315293d85d3e0a0dd4eeff4765ee20621e54f1eea315	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f25903b52911e08b3941b0e16ee814e90a4c35bb492e334d565a454ac410175c000000000e800000000200002000000002db6b683a0f68549e10bef15ebf9bb70ee1ff408e3fd47bbe75501a4f3c327b200000001b555e4c6d42b83b2cb671b6957f73b89ebff1462061e140181f77b2d2dca27a40000000e04b1df85c32f7fd3e19e3dfd00a9710b29a0c9b4ea07619fd5dd4b0194c64ba2a25d4782be00519c07fcb64fbfed9f616c8910e3f89dc7cc0f3521376b5af67	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2300	2020	iexplore.exe	25
PID 2020 wrote to memory of 2300	2020	iexplore.exe	25
PID 2020 wrote to memory of 2300	2020	iexplore.exe	25
PID 2020 wrote to memory of 2300	2020	iexplore.exe	25

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bea9b56abc15ef6c951c10712647d5f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c9c2fe7dd0b3cf5c13b13be676f2a2f

SHA1
04890502bcfb1f655c4d4a7a35469d58fbdaf9f0

SHA256
58e0b73ecc81dd08784421bd4df735110be5ae4d9af20d90016018f92f2cbdff

SHA512
9a4a8aef89ef1fa6d445171ccf72556c2f11e68f7022b9d85ca8c0617429ba2e7c0bfc832f73850b6bfa8c0fd050736c262e554558c612ded5a55d795a8d48e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14304d47ed6a7437a8d34a27740ac7df

SHA1
0c08edf2a09720faa2b343ed53b0269afed22e24

SHA256
290b28888dd27d4dda14ac80b4b86079af9c59bb175ad8e7c99424db02c0d3ff

SHA512
1c993ecc2a92a3f056cc13553f83380642b24277d1a1920beeefecab4ba39178811b4550a9ed9691195fc1613aead484a4bad91b643abacf846af69c72dd17dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1897c4006f976368d1b61676f65ea9b8

SHA1
41b4c66722c84ce292e999063fa2b6b7694f5a45

SHA256
9846f0b5a116b968d81b8095756dea86cd6cf0509f42fb3327bdd353255d358c

SHA512
dda3ff1792cb9325e38b4c09740ffa8415262562315ca4aa1a9722b3fd597638ddd8ebe8a2058dceb98f640b14ebdab7d840d444d346b20aefac17df6f361bd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe8fa3003dec8f41e890845e3b9a3778

SHA1
5212f97d5d8e6bdb0e5a3e7d393c4654e189cb9d

SHA256
f3d9e95faae1714e62a611606e146eceb4996953209b4a816bece75c983d23a0

SHA512
12e5f6c94c71f60129c9a9ea280a02044cb8b72dded76d3940bb6ade82808d32251e46de911117252731e2c60811850ceeafb7d01f98aceed3d24b731fc001a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
417b64db12db48b04406e1973040cf4e

SHA1
cb35d285d6ebc7dba5cd6fa2b98ab19847e64d68

SHA256
5c4d8bf1c8031f307412a1fe16bccd91ab4c6746352e4959cac6ddb8886ba9fe

SHA512
7cdb7d77849e2f340550430d997f3b425575dcf69627dcacd69730e6bbe19d5b186d5560c846803d2542cab054194253b0b77c5159ff07d06e925050554b8143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d587f5f856926e753dc209c903ff7226

SHA1
f42ff5562844e88668f8ef53b34dd8ebde2eb82a

SHA256
7c94721887e665dff6ff0920574b31bfae37b161422303d4feabac6c56a7fe44

SHA512
89720d703cf050a69cab98008a8157ffcdf47b2e57a720686b722e83afbb1d894438b0b8421d9f840243398bb6666bf86b0b49231de0999c5720ca3ea63d674f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb53da4a7c33fbbfb8eceee0112e8b34

SHA1
c1b4c2eacf14485576280d2149c4c72256ac8a40

SHA256
4948109bf3cea6ca6130beef8f7ad8fe6417abc4acb1f5328cb6410d5666d086

SHA512
03aeb6dbd3bb2aea57a570bc460a70a944a109a05a9cbe7a7c448c9adfb89f43ed82995d4777df003784329c6d03a56447eefaa1ef5f0b0245efd5fdfdba5e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d088edcb167ada17bcae1a78a0e5400

SHA1
ec63c08e1b706192ea524513a9fa2628bd8c99a3

SHA256
a8d4ea826d4a6c1cace55bd13b3c68cce07e21fdc7963570b0c89823ee4b99c6

SHA512
7cd66bbc9b3b2a7fe685e763e55006bd80a80f4ba6fc5ec2d1745d5c75a2dd1976ef30bc7f50052316df23aa85e2cf415142369d79426168674848b41fb3f698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0be15b4493fd853d7a3eaee85817b9b

SHA1
20d36598be7713f4477f3e39c06de776a2cf326f

SHA256
bc57838e3f3a04527b72ea36ff19d86cac715b1b496d11e8c892447768f67aa4

SHA512
6656764543f006de24ba77884cb7450e795ac9f7c3a8bba92d4bc2d807289cdb13ac2d55d99281ab2aa6a80262cc141e4e495dab6a1b0432a79f6b62f94af281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ec4614b6cc65b6d8e2e9ae78268b6b1

SHA1
9f7152373fc00c8dc7c5f70b174e14144bfa3073

SHA256
2f680b179b926bd3f647d102d0673491a149a293f6658347e44cacb73d658dee

SHA512
dc9254abc57b154eb5a75ef87bec17b913066aa4ecbdf7e12db0ed8fb75ee7a088cb97926232fdf40e9569fd60cc7f93e6dab9b5c0490becf539a409370fb227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b5ef4c386340f1f6c85d8d6e30eebc

SHA1
2431b0927659fe28b15d33431130adabf194690e

SHA256
ebc7bdd1de95ac529c4cc871b01310aee5a869e191f78188f55f0c27f7f00068

SHA512
2c32b8be7cb145ed9e841955807e782467a297676c02fe934b5face3e46530cddeab8f664e1d91611dee6fd4c00d8c0780b10d6de271d2dfb913c7ed13da73ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dac43512c8a0972cd611060af29670db

SHA1
a5147815f15623c0182a635f3e4273f7b93091c5

SHA256
069891c0c497b21165a6c8a3581169e67ea3b53818cbee9f63626903535573b0

SHA512
9adc40203aad15e0a846048602402e2d998544e1ef962489dffd0592f5bd61e26258936fe9c64e8c3a96f0fc14e028f858b2ef48d76d663dfca7e55922745668

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59A6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A65.tmp

Filesize
137KB

MD5
79d53eec61a256614436e7da16e9c89c

SHA1
15fb69aba73a7c6ade25b7520138123135458697

SHA256
b4285f9f286c68ffd90352a7eff92d582156a3d3f635c388ada0c50cb1baa85c

SHA512
6c4869029909c432a60317de47e66aa6b26beb9dd3cd6fd0910dadd45cab0772959563f751a99f76652c03a9e548554c589686c73016386d9b60f17e44cb15b3

Download Submit