e461231f4883379f5e8f7bfd58ee3efbb1294e9eb97e57da8610c85bf7a38994

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03420e0e184812123ef5b0cbf3ddf119.html
Size

6KB
MD5

03420e0e184812123ef5b0cbf3ddf119
SHA1

b3fd65fdf7f916b1324b9888cc86ab3deb8f8341
SHA256

e461231f4883379f5e8f7bfd58ee3efbb1294e9eb97e57da8610c85bf7a38994
SHA512

d1b276358ced52866aec27ca49b933a9d4a884af45176bf24ea20606140b33bdafaa60d00c2ac7780e215c18b669de5b25f983fecfdb001a51e1d4e5587df44d
SSDEEP

96:uzVs+ux7W4LLY1k9o84d12ef7CSTU3LcEZ7ru7f:csz7W4AYS/cb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5082DE31-A6B4-11EE-B5A2-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cb2a34c13ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000056d8e11cad4f0ef02e9d47a112642e3ed38a2814cbf1e9d39d2596badfe669d000000000e800000000200002000000091d25abe2e29ceab1d31961a194141f32a7dcf7a301f03ec9a7f33ac60b7e3ec900000000ae3f54b5dd265b86025ea06d0c533e163e0fe618efc10c1c6720afd7885ddd77eb68ef71d17f3708f18ed26c6b89cacb590a0a37729e3ca0295dcdf82c0128225d33c9437dc658a8960477d30b80f9e6cbc1586e006330088627c5f239a5a8b364a0caa3148c8acc1162771744427aadabf2982a83aca45546570ad957a040c91eeb5332259a36da6a85f5db206219d40000000036dc33b9869cd616b930f21a27ec87dea04ac64efad62475228f84b48bc5caf1933c95e9072d47e1a6b09d06aa04119d996f6b135d6a4aa3bcc92b6e2c67eec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ec2bc0da93cd472429b3412430d7f0248f0c3795d2cdda1d544b41c90910ad12000000000e8000000002000020000000f9f8473e9912e5faa55a5226a7291644d6f0be8d7f757a8981f012ca5076e4112000000090362d4a2ff443ddc66fedf3043aa2c1dee1e3f672ae418926c06d48ff230c1f40000000c383c9937a09db5f1f6771f033137f200e4b59a71864f43f84a8bd46c66b7acd4407081bbaf8086f2a21cd4448796ae4d0b691611dbbec0c243dc87f52f28493	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410062267"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2264	2316	iexplore.exe	28
PID 2316 wrote to memory of 2264	2316	iexplore.exe	28
PID 2316 wrote to memory of 2264	2316	iexplore.exe	28
PID 2316 wrote to memory of 2264	2316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03420e0e184812123ef5b0cbf3ddf119.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eea659396f9616f5c58d0999910262b1

SHA1
692b9798a384af0c1bdecdc36fb867d5adacb619

SHA256
1015509ac914c2578508560a8db7e14c6eba83b421e991b30d8be2c49a073147

SHA512
e5244662fd4e35f38658ca246240a17d1ec0b612e236a3b7dd20dcf465de9987a857b442f6faf760bba84e9a235deffdc3712f260042888d077fc7bc51cd7a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e18cea43195a77ecd958f58f10881409

SHA1
68fa71cae8381e3eccfba7cb9975a4ba35008f32

SHA256
3185a1206b1958f958c00ac94147ac586bc43eccd3809a1703a9f81c68b2959e

SHA512
6222783c130161104f3650a6c1368b22454f1bab90a609b6da99008446f9ffb83af1348b0e841419f48bc2c30c516edb98bed8fa2c19caaf18d1f1b703e462c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53c218f9fa2a01156d0d319e38c184f1

SHA1
20bdc261bf2500a85105efe313c705c99258395c

SHA256
f1e1bef9e7012bbae1c0590b986fe195f881d195a910a2132eef62dfbf30a1e5

SHA512
28a3291cebbba6cccf30a481009f6c7c518a51fed02933e18bfea4d0d7016c7dce136f4acaa1deb388d19562031b58f1b4197840a34cfaa39d26a0c063bf4da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc521654727945599572ecb9f3a54c6

SHA1
5e880ab5c2d863c3fedc9395221fbcfb1e967ab2

SHA256
9945ff3da76b47ab05dacc9e1bfd7fdd39f9bc8f01b8a83ba55012203bb1e964

SHA512
bbfa3f9cd5e5a43da4fce606eda6b836d04c4403b7ff52ddb6ba192a7bf61ffe35a55f32c07d601564f2ff583cc6ded654475a0b32c207a8288fe2f14d1a4d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461a9e119fbdd70ca90e6b7343db2e54

SHA1
b5b7d30ec91136e06224fd90ac0586044397ea02

SHA256
5c6a577ce7633644e32e55976429b52bb1c670dc82ab79a6306a7e813d98dedd

SHA512
2cadd9b0d3db2ae544364d99466a8dcc3e869b25eae87ceaa2fea5f5f21625eb2a94e388d6aa366a70d8e4b92d2a7536e691547fd21bf4cc5c019e07f6714568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb6351117f839f5589c64ce8ef94c814

SHA1
9e2043a59ee1a50beaf08578f284ab19bfe3565a

SHA256
3eeb8cd8f941725f8fec8b8c579b5944d9a54186b4da4e1bce9b74501f6c5fe1

SHA512
23c69226962db883eac119fd1f3a8359b1d4389ca7af1ec8b1ad55b4a1ec4da4eaafcad5b1a5476e4257951b7cef2d52fc105f1f0dc08ecb08c3f424ae13ed5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
280ab88596d2b48418b5bef16f8a488b

SHA1
634a01e3c0b1b988c04054b7879689617da6d12b

SHA256
964831ad08aba92afda7b10e31ba0c436267c069c3d3661d6669b4896852f3be

SHA512
d383ac0592bf5729913001c9616ff3222de7d52f841ea3b9c3a0af72e54d64941de28d8adb33d3e1d573c6db4ee939d0f625d45f77a42fa2d06372739370a81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afd72402e0f3404950a473175da7aa76

SHA1
0fb7b7eb950680fbff5a141ad6f73bcc553dec2e

SHA256
3b6ba2369712e74e657ebf7c98f0297eee1bde6cee5652af3c196e285d78dace

SHA512
4282393dd1a93f9d452ce00b846c2cf2ffc223476b21440fbeee912bc831fd2f14307a91e8ba9047ad711e33eeea378b74aa53505445712e7bb8e74c67112300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6d0bbc112be54bd6ebc5fc0e5892041

SHA1
0e80787fa4e6e8d10b372ed09d62cbb5fe575e17

SHA256
2b7796b33377cb139d9d5858176dc287e092f243c21b516632d3d0b83b14d84e

SHA512
169828b484c64ac7f898d617ce6e0e01caacfcc7b52920e77078c908d92a764823532da2c679e09478ecc061b825ee068a88a32fb257de59faaeca9669685a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9179551b49708499bcc3e3c78ea4d0f5

SHA1
721c4a19b72f84ea4777a0ce462bdd2171e26837

SHA256
b4f814cea7928474e7ae15d4c5ec8bf7ca5b32ea81985a5a3fc523855e46adc6

SHA512
47cd08a06e093b0de2ca6d68faab4d4e4bd236ebdbf6b3e38b4198d966e772d3ab8804f28a0c501dfa07cf594135dc5b2b6a2cf39ed85771c8204d70ad4d40be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ec3a149c78b3265bb59f47798ea2c4f

SHA1
372065480eddccf6ab81840a3b4bc1d5b1fca5b2

SHA256
339e1f38ff283feca7e19a3bbb05ab1d39fffac0dc6d4aefcbd78c929d3cc7d9

SHA512
daba25f39166430d52c2a6bb61f7d287a4fa493b75ca701abc0172348b62cee46657a63a0b1230e4735c082eee3feae99cd3179f8e1c4ac1e8f591216eb100ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf11a9dd9f92dc019a9269d374582565

SHA1
fccfd6401a92f41279d47a5e61aa1e942dcc51d2

SHA256
8a294b55cdd1ef583d0717948e15037fd12a9023be572b41d789b7969d2a9290

SHA512
9c92ee05ddcb20285da92d597db02ba5fc3c9ef8abc4ab838d7348c86b7714cb8ba95dd51e76c514bac211ffeb16f85324c17e1a2a752edbf287d227fc99e327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae02bdffddad040669b6b47899e9b6d

SHA1
01eae736874acd11697d0be47319d2a7d798df06

SHA256
179b6631f00cd53c348e111a225e88428d384e7e4c300aad2706f89abf5e7e89

SHA512
91f929577195516f3972fc126cea5e22d262e33c1f3e32eea5df57b1a9cdabc2bc5a180661e7a0219a367f583095c194a0af66be5dd63031094a75755a30c897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f810d378f8912ec44283424f8cb829e4

SHA1
86dbdcc6da319b5dcae2a10a7754122ee877123e

SHA256
920ede4ddbb1a3ee8bd096f5637cccb4828de8eb26a71caac7585e83647f4930

SHA512
3e8e703f60d45c976a127712991cb17dd7e0a746132775a771b6a2dd208145a914e900698d19b0f52f39cb0b054c1f05f5fc465a7d100bef7ca7d72d23ae1f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB58.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC46.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit