1788fb345a21349ddb6b8cce3e34f65ce9c29a6ad450b0a3c36b918787c57173

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03448ff935bc6a061ea7e5896b34235e.html
Size

14KB
MD5

03448ff935bc6a061ea7e5896b34235e
SHA1

dc8c0a2dcdd98f7a014a0636b32f2c3fee027061
SHA256

1788fb345a21349ddb6b8cce3e34f65ce9c29a6ad450b0a3c36b918787c57173
SHA512

d02d19f3175d590ac70da265a9a9c24531bab816d94518c2df7359c44823c9832cdb37cac998c72b2b2b6db9df8ec1d1b7042dc6e8c1d2a9e3c1a8bf0c88483c
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vsmlKt6DvE:aioWD/ZmXg8SZQZmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007bfff2b0b82ed3b43164827f876e7f47011f9a532618f062ac944b3c472195d2000000000e80000000020000200000009ba3c3ab4465458679d4eef92c673a905338f2d95a05c401239a75a22774587620000000af1f18d1ddf9bccbdc0dcfa229a08524e7783581d57c966d2b459a31e6fab483400000001b671b2cd2a3ba16f2a262e07b39ba22b1db7b7c3ca3f14c5365f92bf9b44062e3ecca2e951402a4eae1daa302790586efcf8bd42229e0e3e8f910c33111f8ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10859179c13ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A42D0CE1-A6B4-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410062402"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003e11c262b93c79a30c75d7d0baa39f32d4ce700e2dd4d953792a8e37e5c3cdd8000000000e8000000002000020000000f22ebc9ce4a2e54a49a6dd39d5d985eca101a1235213c63e34174181af9daeef90000000a9dcbf4d0ed19f2e2118d06947471299efea74022768e8a3c9a8a3d47b333eef3abf89cc8f5541f8f0f34c44b4496577bba24b8139c181b8848d0111fe01b67bd7a758b561b78bfbfc2ef21edb1836f1219a910168d7df5e3cb8ad7acae3e94d66a73648349db3d5662bf74679ab4bb4212eebcc590ea3aa13a4124f7d6e6853c2aafc436f68f6ec4986a7c64808472840000000c17399c133f561d37bdfe70334dedd1c7dc5bd287e2c79afa0ec699c53b212594abe4772fa0bf38941bf73c1c8cab1914bafbc114dece26943784635b40448f4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1064	iexplore.exe
1064	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03448ff935bc6a061ea7e5896b34235e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa5b4e9f3d20b386394f91b00113ab30

SHA1
1b4cbd81b138b17ccf8a53a41f3aac3946bad4e4

SHA256
51b5c4a6758bac5fe824a7aec724c3c38ca29f4eafeacfb0614571c39954b898

SHA512
b9c6dd4ace5538d230937c74b29d9a415c07a79bfd9091cb89bb1de6be5d50034e767033fbfe9748764e5332fba45e5eb79394d458d3b51a714f5d9ea487104b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d5d2ddc01ad3b6b2326039c13980f6

SHA1
15d2e9c660e2b29c2a8524947b2260b483aa9696

SHA256
004e123b15c2713b73ca45180b3c7befd2fd911af6378d8cae8ce57c5b5fd7c5

SHA512
e2ae2f07ce0dec0861741bd14b88f7d22ffc7165601dbc3a1d5dbd3e19287562343554f0a29a098d76267ac2dd943330176e5cf546a02c723df27886c4a99b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a58993fdba7a5954c1b6561380fd1ff3

SHA1
223e24dbdc67f0bf6e306a307d6439b89e5644bc

SHA256
a8abdf182c51d8dcbdceb85fc7306c35023fe062ace206b92c33c5644c14f4aa

SHA512
8c918229e7ea2a2a0c7240ec5b06446f07a0d9f9a750f47773118c317d06f07b0ba8041f8ba0ca9ce06d1738d5a0cfbd94237c8d9416c88aaf22db1cc10ee164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ec83fabd8768f7162346be109642f2

SHA1
3244f08f4cedd691c691394fcbe0651f4ed072b5

SHA256
23cab0e8be95f9fd91aa01df662efd13f0b3434704496083501787b18d6c2f14

SHA512
665759572c6346ee413819e152cd82d9e22b0d44b4414aa396dd212b63ba8ea326c01e4f8e6622f49fdc84baf2af200fbd7d6044fbd17a426689e95aa43d16d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa147e09ba3c17d6d4676b1b6cbb32f4

SHA1
7e1ffeaeca62c326be041afbd9f3f5cfb72c91b3

SHA256
e419b362e98924ef24ad6a7af934a0ae117981423eb36139fadfde9d3725c606

SHA512
3fb67be33e4a314445631be9409e547224b7941e95517cbbc3077d0fbc962747751b39b9e6134f935638218b68ecff1f708ac56a5402b6c2b0cdda3534f8cfd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe4a01c00c5045c3a5be1ab712e519af

SHA1
df72aa7111e779e2ace9b1b7928a22962d32cedc

SHA256
491a3b712133643efcf1fdfb7a7baaf28ce7338fe7ced384c01cf066ebbe9501

SHA512
7fa21843d16f85a633eb916369be54e459b0e0b50115b18096ffcc981bf05009b3d514f1120e09c6b5e26d785a372d9d3561dcf557211b4fb83ae41069e0dfd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d88ca2c2a4074be3a7c4e161a3e313c

SHA1
3db14e8a2aea01e12093d7dd84efc23535b522f3

SHA256
6386f037fddb1aaa0b13fd3d76e418c6fddc79cf04ca7db520cc4fef501b0b8a

SHA512
0633fa640dd2ea4510853f4a3b066650f58a47e46d8a6afba2b2ef2348ef6435990391b73e798b7c25f93ed9e8143bf1779bea3ae86c19d497bf24b99bf5cdaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13cb145ba6f5f7d5a4c13a3bc12a3047

SHA1
3287ca7c18bfe737a5b89f0ba1fb47fbcc17c375

SHA256
8634f8ef9eabf4c55bd8857c813208b542be7d6e90c51de88088c7c49ccacaa2

SHA512
edaffea2ef0c0312b24e529803fdc21a955b5fdbf43a8d888b01ea67f974e43686a4fe9f1581ed3d74788fb5c41f1d0679108a95b2992673bbca2eb0202abb6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0ef50507676d772fad06004d5f69a76

SHA1
70d3281f067878f7e0c9a23c4e1e485f1e185de4

SHA256
83455434210feba68c10fac731f6cccdeca5a45d230065f26984c667825b7818

SHA512
7b9a3ecea63e2bf3f68a1319e2a8ccd05fb7d10a2bc341cb0c3e350bddd0c091d0cf4e82765a530937ff5a4f71817f26605d601c7e0a81fa1401a943d78cbdce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03020222b5ae7ae9879e2707391e17c1

SHA1
f3ca0c32937b8bb5f9d39cdead47af448015c4a0

SHA256
03c96f562577bc65a7a137f53b232eb50a99c23703645de0301c0fba882e5479

SHA512
b9f6e00f9c4c29fe5fe18e028785f1357aa0e6a0672597f111d589e363307abe04b5bbd3ec1ce6c8f9841be49a69f0f1939820504ce9c261875e52f01d82d32a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82D9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83B7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit