0a490256f30481fdd5425dc7e98f60581be0dd1bf0c6932b276dc2e98ba8609c

Analysis

max time kernel
85s
max time network
181s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

032ae8b96927ca2b35fc211face410a3.html
Size

2KB
MD5

032ae8b96927ca2b35fc211face410a3
SHA1

f3706286340e5fc07d7fa48d16d0b3138d548d17
SHA256

0a490256f30481fdd5425dc7e98f60581be0dd1bf0c6932b276dc2e98ba8609c
SHA512

66a5467dbf5366011733ad0c538c6a4f08a88b912d74c4970cacd16ffd224f6b46e8684bc3ece8b776f5d6cea90c0b563253d98e579d83475ea88548e4cb3097

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410052510"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08ac06caa3ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b91d50eb7409a1c329ae96747d61bbfd86de92b55e861ce27fb2a09c9a8282c1000000000e80000000020000200000007b9ce5d6b57b6580dd264d38f3c627b487533859523af9b2d5df3b1411cb5def900000009cfa274c30d67fe3ad3ba56a790f8334b3c7bdf7717b8058617a7b77533c7093e06050bbda0e713967e4a4fc1dc4a871830afcb2b85159fa4f854a5408f3129fbd9d42e2c7f370b8474bdfc221a21951f246dbcea3d96c0f477296fbc9032ad98734e3b9f54e0d446de8d4dc45271084b500d7bd3fdf1b4aa8ebf131d12ba843bedc7efa8644298d7e133d46e69bd5c4400000007d0a3cc360c61a677f98e194162af6531530afac3d222c100cde23c8100c7f681865e6233d3ed697db975410c36a2c54fd88651230b676e70121249ec21b67e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000003626df503cc38fa2cc711a170c0fd92c39742acd56c798b9df2527832d9e0c35000000000e80000000020000200000009f031afb1afc0d21e3ba6b21746dd0af738b84e7649be826857966c9074786e620000000b552a8e8acd60f2bfdd38a168e5ea6ca2e7f2dde7a67e6f73f00868947c5b9f64000000005646933ee5872112ab5d3afde41de9e85153f87a9abc46a04e4c118be999e768ae5ff91be192e04b17391cb6de040ea21796bbe2e2c192a9ca0f68532dc1ebf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96BEE041-A69D-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2712	3052	iexplore.exe	16
PID 3052 wrote to memory of 2712	3052	iexplore.exe	16
PID 3052 wrote to memory of 2712	3052	iexplore.exe	16
PID 3052 wrote to memory of 2712	3052	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\032ae8b96927ca2b35fc211face410a3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b39ea14c0dfc18fe4432468121e9dd

SHA1
ed6c82421aee8f625db19c9f56afa763b63f9add

SHA256
c90c9fa5f4b52f790bc0490c7f0aec2b848ab0e206fba4cdb262ef1acba442cb

SHA512
1e540572ff9e86a30c4552a2559110f6cc84e80397bc1539ae28c0babb4a918e5c0613a8e76d8ddb1a31f66105d6ca27bacd4a3c3e8918745e090a365e90ca99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
913b2f9510ba302d775c4891563b5d39

SHA1
22ee91edc47f863125af2fad1e1d93350aea36aa

SHA256
ec78a4405d13d6850373e60ff58053669e3bca4018b7569a419f0c4f61e63ece

SHA512
334d0d67c9617f2f7ab8b23e37b471b2fc54a3b00ad8f1b862c8cb08cb1025c66aea9737d5ec0a088a0917959ceceea83ba7315ba9f0ed5617256f454f550381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae1552fc4b5774e12dbfa257d6619142

SHA1
2101ba7e0c2e8a5e1fa4ca7e3cee9e068523943d

SHA256
88d9ccc5d3593bca62f10e3546a7afbeec095cba920d0aa31766a8dc713d3fbf

SHA512
409ca99be496e7505efbb5ec346bc6519809cd574137779d6a59819374f1f0c14f5a867c20fb521c3f7b2a7491b6653121b08c59d71c92dbf9dbf4609fa687cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6d6e1669c41ce7ee2b0e1adbb89e96b

SHA1
d7b62290eaa19e88ea1d6f65c663d3ef66a12f87

SHA256
1de3b7d8f293a327f32e5551efa75091f48492293157684eee0a3179e428f479

SHA512
1f069ba160785537109bee34d69e54c62e54dedf937f41145d21babde410a098ba907a6eb33401f698bd91abf28d9046a049d52ff613a1eb8346e1530462f7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d574c25d2fc71c6185464a53fa71368

SHA1
8846e348d9ec254beadcbb1a59998cf0c20078d2

SHA256
e61bd3daffb04b8723105b0a712e89b76153bf86ff69e5b38589dc5bc15d0a2f

SHA512
a33beb6739a34c87922fb04a55137086e1e7ccfac0dcad0f71ec3c46177ea8d66915c537b4cde2dc3e573f42b561166ab732fce46fd46faa141c5d4fddadac6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71eeab99f8fdf6bf522eaae0e5a517aa

SHA1
721ce862c8fff5a3941085062cb58aef0e5dafd3

SHA256
296bb384ad85410979b39b9f8ea6721425da10334148ca3d5dd2276346e44e97

SHA512
24d66f7b4651254b73ea37d1193e2802f5c9f9364419648ba13d1e448c93763b1f7f7dfb9d7f7bdcb68b9f7d46c7b499a9f440293834d60a0b060afcbea74410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29af244abe932961a4c2b6ab3dfcf2e7

SHA1
7eaaeadf934db711f21842dd7e20d888a78b505f

SHA256
665d33335c040f9aff394474a113d473284ef90453cf4aabaa12a89337518188

SHA512
42941b2358275c89609c3f626860d75e7eca5630f428a18fdb843a2f3aae702b183111a980db49d0ad383902815fd68d3b6b0a36bfeb80bd73569887e6c2be93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d427d2bd01d083ea8da4e1185447b59

SHA1
a54c471b3f714751129cfd42590d7c10430b6cbb

SHA256
5a359c52fd6bc26cc3ec5c3fa660f7968170ee5c20c1a260825882c96d16c09c

SHA512
5131488a4e784654eac4e2cbf1ad28dcce424991c6bb1a8f308141646f3d4fb7622678ed4d8d2eacc7078dc0fe279679b15c3bb1b16d1aba8c993b4ad609afbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f24a04e3f3822106501ea38a78b7bce

SHA1
ef0f391880756dab3252c1c19b5c63025999ecec

SHA256
64f21c28c5f838bd20c8892b603edfefb26e360b6516cf6429bcffe97e7240fa

SHA512
2cd33a78e6834902233f1c30d60f44a2a491885069bafbe941bc7115543b92bd45d9c689ca78359eac5dddd5fbb342d775ada242ff905b73c76c3f255130be00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b22b34cdd58d6ef9f31d40f351e824

SHA1
5cfcc1f22db9b07cd8312f848bce3b35ae8b4faf

SHA256
df4e9cbb5d8f98e271b91e0bf8b3224b7b32b31674c8111bd6d75e53d9f615ab

SHA512
fd1e7257ab90b8db07aed28eb31b738401bbea4d69ccfec6cce13dcc280b841a7cc6838955a1f60519b91d41fdc4a3b5bad9951e70082dfc8fa6677caa191b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb5e860be64e48fe535928abd04ee9a9

SHA1
6db1fda5868f054b348eba091b18aff1c9795992

SHA256
b2d0f7a888debbed271fca35ec8adaa7e28064b4ad3dd0e79518f7d98de63d1e

SHA512
a0e6f0b772749f8f51b5a3fdee26615a6103c55c4026e244a916ffa8db04d59a63804a46e171e3a1c35fd5b6919488032fa1b4ea2a29d2de425ea4b658912dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b84ba9c8b74ca4470286e8691bb4bb58

SHA1
89f1fb87064be2f8000555dd4b0a38ae066d9ea6

SHA256
a1890d585ebbfdf0d0e5b1a82793aa5955a510a62e72b41baad82576a1c5d833

SHA512
4449db5d93011c2c432bea0b9f1cde498b1c6baa04ed137456ae7a11a922adfc947fe28e8df07a8e7e6939b75253fca8218dbfe5ee00e4b7dbbf030edde130c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE14D.tmp

Filesize
32KB

MD5
c12fdb130cd4380fa7433c394a6e6866

SHA1
47de8db639292b9ea0783c08a928970f794be353

SHA256
de2b449babb8d4615218145fd0640cddbc2381c3ea95296a57dc783295487bf9

SHA512
b01ab3bb20e1decd42fc171e8dd4effabdab30944c8108447ade1d9e87957e4b4f6ab15dd2da1b61f8f2fc081c7abdfd0f4fbcf5d83c4fdcf817da9b3df1476a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE20C.tmp

Filesize
34KB

MD5
ac128c3b979ec15769da110d90d4fade

SHA1
c6933b51ea6ac7f629b1f06d0effd317021745f7

SHA256
10dc995cac0286b01f475e7e063641927fa5d66ce32f4007690d56aaab032825

SHA512
501ee12c0bb61e3367a8d28ef9c8257b2092bad63e6814082513de944998e851d92e6c08818035882780c66df5c47b84913c20d6379e018c3e868e290ebd291e

Download Submit