92a76588bb190a3380a65f8521c20119cc3925571a26f811505cdd6aef39bf89

Analysis

max time kernel
125s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e3af9c614055888241fd2eee98ac247.html
Size

12KB
MD5

7e3af9c614055888241fd2eee98ac247
SHA1

7d3998dad68f8c483e6bca3bd95e3fc9a47b66ea
SHA256

92a76588bb190a3380a65f8521c20119cc3925571a26f811505cdd6aef39bf89
SHA512

dd553deef133b0949eaaa1d382e7a9b28a9ad63ac4f5a81f297d0a1d348a2c3991443c765974c61d8bdb3a5012c01611b2dedad0d79dd72cb8be7ab79f27204a
SSDEEP

384:0Iw1Hf94+vEld6rTyv6Rb+nQKrlibQmYMH/pMF1E:0t1Fbv0gyvCAdhi8yfpe1E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC66DB41-ACD9-11EE-9BD1-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000008b29fbac3af8e92c44a075a94572dc149fd811f92579c1ac2b7476bfa92083f5000000000e8000000002000020000000f632753ee5954e15dedac979fd440d38632f18db69937724a8e04b6cff7189eb900000003d5b1f8c2bafce1dd3b63db53112c3e4d29c0376ede652e9ce585b0aced1d878b0ba17349702c017c59f91f45a56491d16b35659e9eb475745a4cf4aebe3301064e1630f54ff081a7be8d528ca5439f8415cd3706f87a6b02875b33923dfa6133f58a5c7c36c65aea663488ef95fbfe47e9b83222371047a6912c76991ec623e1fd435f68f048fc0e98ef6f4f284b49e40000000c144871bae6bfd606015e1d30cc158d82e6ab1f6059905bace2791cb0192bb1d239c5697d9dede068d6f123d3b56d3cb0a5592c2233170c30a13d3d1fddfd0e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e1c9fe5fce2030b3bca7420f0cb4e7a9f691030ca8a1b88d1c1c0e10ddf18307000000000e800000000200002000000093ec53490961174fb6522620f9edb538800b3951ddf3e86393873f3fdad12fbf2000000023695271f9b606b9b84b613799bf4005d92d336eaaa271bd1aea8773e99a6ba14000000042a33b448703f683f85789e5286dfe6e38cb18d36e92716dfb74cc5fcc0839792f38080abb557a38198d54aa07d68bcc60f27ac47354ec4944b8d5752feda6fb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410738160"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90963bd1e640da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2300	2736	iexplore.exe	28
PID 2736 wrote to memory of 2300	2736	iexplore.exe	28
PID 2736 wrote to memory of 2300	2736	iexplore.exe	28
PID 2736 wrote to memory of 2300	2736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e3af9c614055888241fd2eee98ac247.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31eb420c7e85355009b1f8ea30219b84

SHA1
272762b9eb35afc9c69e36b782b52f713cbf1f50

SHA256
d26ea733b1bcd4fb89622dd57ad94c50d0133ec10d4630351ae66c4864c05cfe

SHA512
8710557c9cdd0ff15bcf65e216a3e0a1d116b0fe9bed78e3a04525a9e55128a77e7ecdfa92d683dbe8ab6bc5598a306f0379e6b60c5f93db2a541c9e32a1595e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59ffcca79d58e450622edc7b4501ed10

SHA1
9d49774efc705eefed64cc0adce519e35b1f3cd1

SHA256
ec56695294bf261f72d031ec563f933f853a6bf59fa1b16975198978c6ec455d

SHA512
1b08e1814dc249816a4e0021757fab5cf836bd8e2a3fc88c129c44dec53902561395c5061cf998afad489bc05d8929eed4660ffdfd17b545c1e74c05aaa62af9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82adff228f1888532dccf0d242907ed2

SHA1
661495099657e063da9085584bfce131b6002738

SHA256
31d1dd702715ddec120b5713f205a4b3bd949422801ea41f4d7b9916befcdb60

SHA512
6a95c8ca0861fa185af0c7ce0d5d4835e89aae42e217f82fea91745da948340296778971aae3baaa7397ab1d1bf8ef3d951bd3dc847bd95993f0fb54446d6010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3ef0f0d6247929c73126f08da7f5d1a

SHA1
1689a1e07c3c5145305fcf9947565ee9b0d421e2

SHA256
67994dcbfb7257b7f092b76ee02f6db4eccf0c85ba2c2f282edc4b05eefc867a

SHA512
8f9f95619bc86fe0cd4b477ad43d91303043f866eba70ce5db1f82dfec165181a42051d59bae49202781d816ba961ae32bf343f7cd5a317c02713195c8d18e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
183a38368457d5b88fb7fa544af1102a

SHA1
acc8b64a0d4bfb0a73b65f5c42e906a6ad03a85a

SHA256
fce0ac0bdb4449bf52e05e9520655df0fc1fcb61837a1c510fc959972d2d7c22

SHA512
c31b65052e97ccb3df244a925ddd81975817f1dabcb27557f993ee327e57a435dd051f108d8576de6c872d64b531b0555a3f1897ef8410b794cd56d64ea37e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
914c6ec0c0325dd98ea9b4a60a3382fd

SHA1
659aae83b086c4430e401eb24015042c90e9fe6d

SHA256
8ad9f60136685c469a5aee3b689b435b7a2d287372af8521f191d1088374dc5a

SHA512
e12d058c3bc46ac49f889feb291eb64910b8f9beb82418949821220b2bdcdf7356e204a5dc3e64fec19cb979b0916e49b095f469286b77741f40e02975ef3aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f7e770a488f5c35d8b59494c69421b

SHA1
024e9f6f54c9a4dee9c085fb66eb3af6f3c1c2d9

SHA256
ff6b11bd355e3e3eb7d1c19eaa15d1d015903c7a87049c8e743bb3d7e4c25a04

SHA512
e6103f04503921cb542334012ecf9d1e473a534d4ec196682ae313856d265eae894e5616836862d2b92b5e085058cc61afcfefbb2e586156eacffe645c326518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d70d6a6b732d4a22001a77a8bc4bdae3

SHA1
e36385043e114bb71ba7c2a7f20efa5a1f519fb8

SHA256
5eb719a172d671efa719c3c360b3348250c45b9f91ed8f42d6c6ac3e701cc988

SHA512
66d0f0d7c4ae72c6b3f3d0fb50eb1e446144ae5430bb4fb9db102452e3ca7e5f166ce3959c84fd425e72fe20c001ee59078e5e3c4b2cac44247480a81776c7e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3ab1ea512f7303a55684471328cd2a7

SHA1
774ab8660f5aa3b8a1ca6be1443a4ec9d6cdc8eb

SHA256
8723bc032e061b0a6a0ae0590b5cbf4ebc7fabbaae6f4f39b7064352c9eb277b

SHA512
868285141634f0a15ba0c5c2a22217ce9a64963a36c877b11f5e4e75162e07e328ff0675b46d4f824e1369398c144c5a7341a30501d637afda628e2ca993b91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0cd2f56527e7ba7ab5960038bbd481

SHA1
42109d4ef9522c502da332834044e80d351955a2

SHA256
4cf7a9c2688008c53453a3df0eb3ab4c7f6a4817abc5b761d1efc199e65ceca5

SHA512
6e800e0a132e70bd918759d39ce4b3f48400ff40f42646189edf1434d098267367e11eb6c6749ae31896e2009a2a53da5a3f8050d69fae8f9450ca2b0bb079d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDAB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4C1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit