8236faee6ea3a0828ed876dab1174716248bfd037ad0434b8ebbe2f78887f901

Analysis

max time kernel
119s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

738ec5b4e250296c4eb4306f7dcfad17.html
Size

254B
MD5

738ec5b4e250296c4eb4306f7dcfad17
SHA1

4775916826a8745a0e73963c3955366454d5a108
SHA256

8236faee6ea3a0828ed876dab1174716248bfd037ad0434b8ebbe2f78887f901
SHA512

e42f720fd08f9a2d029ad78b757b7095582309c210eb00c5d40d789a501eccd44490f748868be87e2bf173216d13926dd13b7ca28384127f32bb1f6ecf32afd7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91FB3161-A519-11EE-9240-46FAA8558A22} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506dc0692639da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000272799873089d0b21f695448712bf6181b56392d8e81399c5b6ac5dd3a2fce10000000000e8000000002000020000000c3b4cff2586d9b16d2effabf61d2fdbf85f3bb7852637ab85ca9de090ffb693a90000000469044ea4209268f5d5fc2361df78dc4665432d0d849bca1271177dde73fffa73e2a516d21b56b6b66bcb293e36b4e1a77345ff662ec9845a7aadd677c672939d5c10a418bfe2b10f36a5903e0825106f2b4bfe18bbefecba5f277a2738d91c5a5e578296cb5cb0df7d406d0def5c03c814bd104b4b7609e418d0b161dbe461f649d7c4124ae4b3d439a0aaa4edf76e14000000000b41570e744577a6034fb30cf73c4fc5ecdd02680e29ea9028966a728d23f706eb474bfac5240f9b1edde8d6913f1f0fe954e2bba15ba5b1c307d363372bafb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409885846"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000008ae9baeefd531db0b187fa2bfb17c2fec94cc5d707f6f4cebf4b7319f3ef0f02000000000e800000000200002000000003730f894d702a168445a975848b17ac5c2e2582d179bc0967838c79239b60fd20000000dc458a0ad460e2c342d1ee429acfd88b9bf67ad9bf62ac7e14edf107d8ffbff04000000031909258cb7ae533f27bbfb6e7ce1086be698e60fbe90e5c856423be19f109f2de78e2d01e2d7e59fbadeedb4ced605080412673388bcb3cff6cff5bca594bc1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
852	iexplore.exe
852	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2704	852	iexplore.exe	28
PID 852 wrote to memory of 2704	852	iexplore.exe	28
PID 852 wrote to memory of 2704	852	iexplore.exe	28
PID 852 wrote to memory of 2704	852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\738ec5b4e250296c4eb4306f7dcfad17.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6c768a82816bb5478be4c6c2356509e

SHA1
400c4fa7f7ad2efd2e971aabf2a2f31ec60ed598

SHA256
289eb6c4bed4270f016527ea28438947d52cfc2d9f9fa12ed49d1a04277a6c08

SHA512
270c66ae4de5efac364ddd6ca925ba1183dfd27cf89645f25ccd981ff543cd93f4617b4e98584fead5d2b48bcf34fba171836db0aff715ce4b58926db17a8055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bf94443a8c66d84f593eb1124dbd7cf

SHA1
6ac5f37dc7b7ae4ba24d286360d81dd3800eb2af

SHA256
c3ddfead0e69fdc99b9a4fc5786f040a65c02107008c45b37e72c189a238c686

SHA512
1814f84ba59b63176f9b34ccaa6e1cad6af519811ed77f5b7fda6e9b21d1c3420c01b9d06355a1b918fe93d1456a22a754f1f859405d2169a2cccfe56e43cc70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22aee94d8bc9cd4ce8c9bc9be841454a

SHA1
b827d4bfeabfb579f7f03e99c6b719500a33f2d7

SHA256
27554ca7133ae450a9fd72fdf15f9e302391bad9a0e9cddddb52f37e314d386d

SHA512
c892f85af1879cbd061353c6a21bbb06a2cc73a907385aadacb71ca372c41a3ebab01b4670aa3f83bc1f07ca099e931d7342f55a2db57c156233a422808ae1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
112c7350168407e90b048b25b1515b5a

SHA1
810e1c4630489105227bfa87a35bd5d7c023cf1e

SHA256
dfea431329fcaa368b1c3d754c7464cf7442a713d7bcd9ed7b4c988cd7ee6122

SHA512
93f3c6871091aebc1bd77dbeec3d1e92b59a2e2970f116881165bc315087eab43ec032223f6fba20d1f96f4f8d69996201e1726b3a480cea1dbdd835c5207a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdcc5b21a56030808f3f272bea6a7458

SHA1
fc113447ee558449dc4ac5782a4450e1acc62141

SHA256
a3a792333cee8dfbfc350bab5f8dd55fdb1df23afc712382d7ae724e1ebf70d7

SHA512
58f3bfb336517d8611f65416b68a7f9d66403b0736e87e5eef05edd2bb08dbb5dcb3b2f9119c154a73bda397061c813c32cf760170f913fc19b468264eb5284e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f98b16e05ee12db6cb68aec7b78603

SHA1
52c43e49cd4fbee907ddc301483bf0d08ceee50f

SHA256
a18efc05ab509aea59dd063db0e1114461556dc7892e501ca8a789c8a82b64a7

SHA512
ad7f2ca37b1c2e39f808a200662916558aef771365606f4f2d468c510ff066c627ef54410ad0ec7522e82de33902053268313d6707b0ae15e86ef46f8af94958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b27a26690ac55b6aaeac14651f2380cc

SHA1
5b3776ffa8d9124d52bd5b376ef58d1ef149e1a3

SHA256
35ecaccf28d778fa3f41e63215e9ca869a9f2fccece82d22b6b70f8c746c91d4

SHA512
ed56417a62830a6bb9336918bcb3cbb7ff195c80dbc83ec04987f409140f0e916ff1c9ebb8d40a01a164e88847f1067ea558f8e6be502e2ae1578a0a752c9d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bda2f1dc2775eb24ade2548b6aaf3f4

SHA1
3af907811e9c887949cd6cb8bb6832f77c0d6a29

SHA256
30871be205e491eb77933b0a293245fb2e4f2dc0868c5f6782c41c482a9a8825

SHA512
d70983c82e7bc8982d465a963e3d375b98291186a8c4f36561496976977ff2426b625f63e5a32c316bcc0777c678dc6f9f0b3ab7caaa7ede17f7275d61bea0d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40d2bdd31f104dbea1ee8d17fb9819e

SHA1
c9d27fc6802836d5efd2996c03e622cffda86cf0

SHA256
0d26c22bce6cf366c25b6fa453c254091ed5628a4f5b9ae36d7a275bd8089f95

SHA512
f4b3f501e764588db95f70872660c25b513a84dfd878b35af997a2cd3156c3cc3de46aa496c6fdd837e2d530b42463d0180605010694e0dbbead06365501e040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e1eb9a5083b46847a53c05ccd53927b

SHA1
37a8e7dc664d1b1bfcc3477be0d064eb969b89e3

SHA256
22257a44d028f906c2d42d65a9e1e803c1f2dd54df2ea32e2fac73d8aaa6841e

SHA512
5707f0083657da304161ae1dc89f4c73f70f84133c42b8840bc4213f43b1aae1a6892f5e9255268be901a1b2880a7a4e87120c94141a3eb68e992836ee51ee6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a6c17e81dd9e5f3dc615febc9d008d6

SHA1
49cef35271d0d57ab8adfbaca4c1fdfe57d4140d

SHA256
985c91c420e6e56baf1600dcbede289bf617538cda5ab9780ec8640e5dcd1219

SHA512
acc76b38dd57c931a12877f36ee2cb314dc50c41cc399c454a3614ae7e83d80b91a21a8d1019cebf44e1fdc97006182754ac281fd7281a9e2228c227fae64976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2d8ecc875a36ed5fe503906194ef53

SHA1
5b5caa2d7c097bf04c597a87630bb67642e398b2

SHA256
7a8e2ac91f8704ebfbcfe572dec85aba35432c355f1343d79d25b4312d375b3a

SHA512
91fb386cbe09e735b4924ca017b6f7f6ea0872c2e5e742d53ee3b2b6298b92dad60acbe7d63ef4964f20a767cf6d5225dc3101faf1a7e8ff2a49a7960709d0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be886e6aaa066f9f2e1b411c5b70e193

SHA1
343c14830c62c187be6b9b3f91e8c77f48ef987f

SHA256
b50d9547af4898b32dabc4fc13cde148a78c05577643d70621ca434a8d34104b

SHA512
c7a8ecc896a879eb379ec33b6d94328b65f6771b98601da59e052b838f6b40d6543be0a6b2435fbe95243e6c34f773dc0b36fb009f5dc3b7cad1b7fb9179c8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f938b2825512b492fdcff47348f0b14

SHA1
ea833652bca5b11acdc8381d8e6cc5b4dabd5c0b

SHA256
2e0575a7dcb20de435b2bffafd7fb5791cd4d4c7ddda208924de55bb0c532002

SHA512
a48747dc3e01a20c551ad7a3688b13eed6973a760a5b93d685b68c590cd3ec2373b1586e3859993062e34e2ce692837a4fb469482bb4544e41f8ea2bcbe444f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3b1eef1cf48dc0c8c9d24b86ce6887f

SHA1
120cf830987df7ddeb4edc6281a7b499fda28345

SHA256
580c17e8765261cc9d28582622aca1f3b649d6dcd4011e7e968aac7a19568598

SHA512
b73dd30f73d863e9999890894d677ccdf9815441b3380c6b32a7937deeeccc2cdadc697211aba174a5d4b3ca289bdc9251d8ab6a239a835e71dbf2cb853d8bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9B4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA86.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit