e908f8e8cfc8a61f07ca5ffa9e2c3aef1117ef383ab302364a0ca87fb7edd34f

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0638f43a182afab2384c4297708d8f7d.html
Size

31KB
MD5

0638f43a182afab2384c4297708d8f7d
SHA1

b401326ca882236684cda5833a6c0d6b2d2b5827
SHA256

e908f8e8cfc8a61f07ca5ffa9e2c3aef1117ef383ab302364a0ca87fb7edd34f
SHA512

ac7a69085696e66139e159593bc582648343bf17ed21b5481f3c2dcd5d67c22337a42bb3865ba45a4cb86e34759681baf0b5c88d0c94ded8434fc0625a766143
SSDEEP

384:uu66K4o0lBHsdgvKZSd3NITHLy5pQ+RC3XKOSx2NaG16PjQmsjfH7L:XlzH9loDRTL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410101167"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E24CC9C1-A70E-11EE-A7D5-D2C28B9FE739} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3032	2040	iexplore.exe	14
PID 2040 wrote to memory of 3032	2040	iexplore.exe	14
PID 2040 wrote to memory of 3032	2040	iexplore.exe	14
PID 2040 wrote to memory of 3032	2040	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0638f43a182afab2384c4297708d8f7d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e8058910bbd6da964467db0c43872670

SHA1
26ccf58baa7dc1cb11c4bad68d13ad252d489a37

SHA256
89c5898d8a204b252ebc985232b97e77740706fbab8a5fe8438f7747aafd1bd0

SHA512
f5f0132209f4b547faef65081f2ea9b76b00ed0dfe275fde9db8d0ab44c79a7f8be2dce6fda29928dcc80c67011bec2e91e9e95c1335e76d8dbd17f647b6eb83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f3aa0fedcdc5676f4e2d5b1936c7275

SHA1
07551ef70e22849c3a41524f5e829daa83115157

SHA256
ab28066f46931f60532413169f890e96ad8d87d69aad0c60c55d55d77c4fd59b

SHA512
f100bcfc9414cfe0b966aa93f309d7451b4ba43918810317aeedfde8d9bda96a5d14c1a7a26b1cd83961853c0c71116120ca500ced3832f0f58a4a1ab3bb74d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a162dbc7516b418a18a14a855cf14c1c

SHA1
261c14fa790f90f65758c85457bc0886edc0128b

SHA256
2b8a88454cc2cd32c42bbc2820aef1940f9621c6a7c6953f4911d7e1b030179c

SHA512
eaca0b1334f37ea6242e478fb164f80548f4a444a941dc1008830a21fdfcd5bfae7e3a68e6b9f70dc8e815f318072c05bc36949b61ecf6f584ab98169b1ec98b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84742e59fcb9eccafcbd1d8ed5f9a4f8

SHA1
e8a1e55bbfe5b1e0a914654ae76f0a8ff088f319

SHA256
72a5da3da84a67b6ebe6464717071e974b48caa22a53b29bfda43641220b913e

SHA512
5069fc39ea04c1d61511706b8e63ef0a3084f86c7e20828569c1e8d437290ed5f01f13afe40db3610d3c9d5772f49bd9505450b4b664aa966ce8f359ec4530d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188e0267791e0a0c86eaef51f0153724

SHA1
fb4353bbb8ee8cbf6bb5faee8e264ad381603dcd

SHA256
a2ac64b83808a52deb34bea676686bdad3e8ede643ee80dab4021a090f93f795

SHA512
3d119b02512980766b4d015882833180f9c8574bb1239de005e4bc1c3a740ca39287266cc873bf053bd0723f9b30ae985947311947d0e528e5171eb5bfad1adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d83356abeeb29c3c0bb219aae353de

SHA1
b2488fc754e9153adf2578add4ffd0cc930a77dc

SHA256
bffeb41ce4ba3945d0d18590a53e733d63cff28637cab2e7fe6d3c041533891e

SHA512
b99a729591fc90a50887709ba6eba088a9aff7fde666e4d121ec550990fda74cf472e106af9619a38be5dd36ea39a3faeb3f6d076004dd70c7c7bb21f9679a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82b376c97fbcced2da1af7e4d8763005

SHA1
92356a463903f88f7f6a32a86dcdcd1f93603aec

SHA256
1c3f85e353402de2fdde63f31211f61dfbe340281ae9e3266eecd02a9aebbeba

SHA512
d170f1ade069f4b89a48ef4afb59ad05ca10b29552ccf725540fd04da074d8afb08fe9a4f339f5e5c6818789541d33457f659cea9e6a2cc19de1208365df03d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ae7ea7b8f5717527982b0d4a087f65

SHA1
5beb40329fabbd49d74dab922dcb184509150b2f

SHA256
6421c7c54e5e94ce93c05284c2409a18c8804b9baf6ee9f5004739c75e9bbc32

SHA512
0092a79072d4dfe5998c422690325283b0ddc33ef424021c35c34b8b58ed668feb04be3c42f9c6a019c13a787357e17e2d129dcae38345920b32de17d156617a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d8b345093e83e3048423d330de0108bf

SHA1
bbfae4fd8a5081fc58f4d00df9e12bce2ace5563

SHA256
ae7ba39f84ed393786e6a9ebc7c58d4425591217fc4384ad9afc83694d7c3cc9

SHA512
c6e34928807311758f54880bef8d76dbf9dc2f78a93dcd58636706fbca6b7983cb9ef35b4720f4299e3bf94f67f6bad97fff6be87f960fb6981d5fa81cf920a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit