b42a76089c46487831e4847b1f6cc6090f8985943ab2a47084be3fa14bb77917

Analysis

max time kernel
117s
max time network
174s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c7926031544a5c01a5ffb0ce483ae10.html
Size

182KB
MD5

3c7926031544a5c01a5ffb0ce483ae10
SHA1

56c190275ed2639a41252922def8ed83a1780c6d
SHA256

b42a76089c46487831e4847b1f6cc6090f8985943ab2a47084be3fa14bb77917
SHA512

bc50fd3f83029d86c7c27e76cbebdebe4d4ae9dd2c4bc84c2b92166407b17c7e57f87acd7d19d75fec9e6ba3eb26e7699542435867c9872e4ecc887a520d6c86
SSDEEP

3072:DSUcjvG8rMUcXmNRS7eQy8FfoM79yz1t8KNMlZbWX9JMHX:D2GXmNRlqSt8KNMV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000063a956b58c4e5d46b522162a3a84f354f7ab59d2bd011cfab3bd33c7d369e95000000000e8000000002000020000000514a9ce137faeebad2368f31c07bf0ca06c944598bdcc6ec70fcf2f057a5686f900000000a6ea2f4fb51abba37844d2f4df46da77955ec82f93c329e60b2ced46fd029dcff8300d83749bbf4f3f0b57be30e22ded4ecf21f511cc22412339e6e2e1146117749b9716aada54c5e028c43ebeffbf205e75d6096a642db22417cc1ccdc1f4be297075ac0efe9aba2fbdd75ebe6a9ff90b8d4a76e74ab6846f332e4a4ed1432de8efff4e902c851dd359ac7cb0b186b40000000de2ce2098cc96ba66fb04f821b16f59bcebe9af9d00af3644c29a6b7616dd80b5648f6e850b836344ddbc8e217333a0d4a2dfed7d7c7fea241db55e4ce648595	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05BE1661-A42C-11EE-9028-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000694a33f9b4c591b912f603de213efd90e7eab4cb76c95a2c104315088b282d12000000000e8000000002000020000000ae98d49aabbfac5c2d922c607d4c0916685c9e2cbc181a12957239667a847d4e200000008060fa0fadb1f16ebb1a11a7c33022e5e75015f17779d75d27a266d7c3752fb940000000dd32662f7be1dceaa4644a0616e1a4f7a7f1498aefc3e274e0ac79996bd10e70f6613cd3e09775c5eff2048b501399d7f431f949891dabc07e8ae2f5d94831cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801be7df3838da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409783823"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1308	2488	iexplore.exe	15
PID 2488 wrote to memory of 1308	2488	iexplore.exe	15
PID 2488 wrote to memory of 1308	2488	iexplore.exe	15
PID 2488 wrote to memory of 1308	2488	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c7926031544a5c01a5ffb0ce483ae10.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c654645910e0fc5a23008cb91e793080

SHA1
19379456d30b2f95ea0fc095a70624b0c5798526

SHA256
1710ea5022b79767f4882f8385411c3db01ab47bff4b43155ebc8d4e6a188791

SHA512
1d669f3a86a69df5f09c06320a19296acdc0b165031eb7b50f28a4716e89b8d0962965a829a1e099c1f3426ed880e315b99e58ad68ed363b2bfae0f7197e8163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a9d455d41f4b4efde73ba011331cef

SHA1
3db53c565c9e58c00bcf4a29890fc4e51e0906cb

SHA256
132cc328ccb6e292fa0f109f19064673c1700a15a0f2c39a816fdd6d0171c527

SHA512
ca88259ae61b9ac4c090ffe9e449bd586ff1f2ce640a56c726c49070ea46e670d11a8886d771fc94b21aac70de69cb59cb3ce6f99e7059bc83f6c1fa2825cfbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2a73c074db1c97cb3babab90ea2ecf5

SHA1
6424beab48d07dd53427ab933d4c33983122cb7f

SHA256
efca53384e871ef4e88bbb6744b509c0a1e649a8cbf91899c5edb116860c2725

SHA512
94992684b29071e8f4b484376ddc1d14f7b92ef906e10502fe89c059ac5369bf10b927d9ff0266b9d9909c65a1e171a8beb240ebff3cbe7fe58812ee13e6499d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb7614978ef85682cd73ec2b4203b0b2

SHA1
05f0d14ddd53250ca85fb1e99b38735acfcf1613

SHA256
dcecf2a95885fc03b7f76f3833846db97ea6313a2bb514381a9324015afe5255

SHA512
263321644c49188a2dda21a8b918a72e4daf41900c160e8c83c137e6fbd50b5f25079ce478016fc598b4f664a9c6c6517fb2f2e07aa2ac9d945b7bb4f1ad3d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2980cd261509982424d45817c028366d

SHA1
a93b086eadcb525237eedec951db9e5edbf9abc3

SHA256
6b7b134fcf928b7aac31a97faa1614cb7d0ba8882c1db207aeee604821e46494

SHA512
ac291c851562e97b979e6f54b3b2eb311eea24082895129f8790af6fac0d2e0619f25df4e1df17842b41375d0e5106e43ab146feb72870d48ab47048a8da418d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32d46838601ce563a64e0dca706a333e

SHA1
91a7498030f5c3bda8ad7fafd29db60d7c5dad58

SHA256
ab0e7cf8edb6c8aec9290ad645c2c1af68be89b146fd210814bd0369c42b61f4

SHA512
8359b8cd32c57a8111a96a3f21144bc635683d2e9556165422b9feafa2cb6b9e2f47df29da7eccaa4aa37d135173657cacf9ae05920251fc8731e7b91f16f0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eb86f248321972919117a4ef1a942b6

SHA1
a5146a813e3127d487b54f42c6131be9fb91bcf0

SHA256
9b70a793c739623495212bb94f774a9ef950e7dcf73441bc643a8c2b9d927788

SHA512
d487284cede92fdcc24d6ecbc6233790e82681064d4182f90ec7b74c823269684be33637535fbdb5030db15c9741f36a4d7b04bfabc7e113db39ee0918f755b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e4b971e34e7919a8128cacd3365551

SHA1
a511236098adab9f455fba44f200c4d01cf6a883

SHA256
90f93835f87526dd9ade7415448c7ce46bce09821aed313bfa88b2d2d084f71e

SHA512
416b708556cf5126815467dd43bc8aaac9b3051afb83d99956c698f22181134883a9a4f7b523eca79dcc51355340b1698cf24bb7e128bccc00943e1a6ba3cf27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69f8c6389c7f266a90e4b759899c7ccf

SHA1
3aef24851bcb8e361ebeaedf2871de39349dd7cf

SHA256
ad0e88a4382d11aa27e9c4d3e8dde456cb1a40072c404a68ad46f5f5d4be3ca4

SHA512
f50980536ab86f95eb09638fb8fa547705bf2c81a106fcdd209a7424e5213480c3817202a74f37ef961ec8d6f3f60eb484a57dd97ba4b42a3f8c4f8d6e9bde67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5bdbc4fee3e58eceb5089076ca08cf1

SHA1
938e17c5f683b354e27b68c4a980d30f941e73f0

SHA256
715f2b19b041c1685da53bdc38a1d2c62721ecf6a8a737c05a410ab93992e53f

SHA512
f8d2545799b91238d399b538e68c9eb88faa95ae2356c083375dbe6ec78fdfec8e9c47dbed553d2317a3c7efc2959dc6540f435e01c1143e27b168e201d5a0c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12974be0ae9c67ead7d0e2416be3c7b9

SHA1
44ec034b18d4188d58bbbc72806939d8761c99b6

SHA256
49acec0ea9667df0c037d5b570a2d5217d002c9f72bc5083d7b891ef8c1c997d

SHA512
3c587c0d0128415e2f2ef5252593f5dcb0588184fd640ed252511a9ea21362c7e22455c6c3569f1b58556340dc4b6bfad0c5b1dee0b81dfb3fe01945b3afe851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c007b46efb6602aefef59eab42d19503

SHA1
86dd04a670440e2300bc109e89978e44cf427867

SHA256
0e9ab95dedccd6027511fa700762802b89740ec4131f44a56b6aa5e2916a1321

SHA512
10277249f9a0befa0ca36279ab7b95f891eebec5ba792559a17f23a8282ea26414c20612cb1d5a3d581bb4e03edda91c419d4ec9e9faf31ec2c73b33aa5403db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d18285dd490685b5f988c446ca25255c

SHA1
e74bc113af84571b0c3242956b3126a8528ee5f4

SHA256
3c4c24b680e4aa1b5f91a0bfa87d7d19326a731294a53fd7549b4cd4d0304b86

SHA512
df46781e1c33e02dbf0a10194171ffcf472809d0ac8fc30ebc2b629d7c753783070a019a3a6469aa8739365e3c280cf0640158b34bddb72fed161554b510b7e6

Download Submit