376617da4946aa0dc1a61ae08ba4dde5b0ede987024bb51b7352325b7d4e016e

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c085ce4bd1cb25303a3ce7f7064e8c.html
Size

109KB
MD5

03c085ce4bd1cb25303a3ce7f7064e8c
SHA1

cd2518d6d3eb354a2a575f0666fbc85335764b34
SHA256

376617da4946aa0dc1a61ae08ba4dde5b0ede987024bb51b7352325b7d4e016e
SHA512

cef8c612d9eaf013c55a1382b0843df1620dfcf9847128022aa2a133b85d27d34e303fd2288bff66f5ee3335d2cd35f6bd8bb1e4b665888ddf03ccc99867a3d8
SSDEEP

3072:RTEdoFGw94pgSugfGlcFqZM+A/HjZ07rAHEzlF:0UlF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410057720"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000009d8bf4dec87fa1c9ed9725d6b0985855a533a89c07cc43646ca1d983f4c371ad000000000e8000000002000020000000c228988eb54a86f7557c30b249a78c407a29d22049b1c2ef817872de7d29cf0520000000484d46a57f0cb7ccf540e8bd717da957c77067668beb3b4ba0427e354f5cbc6c40000000c8f7f4f2cd4d5b3cbf0a257b9fbcd3acf49979a122536d0756dadd50d7674c73b5e71de40183752f08fc35ea920d99fffa63826188ef1cf1afc2135ec90129c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c178a3b63ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A915B501-A6A9-11EE-AF44-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000079c65946c3e95ef649515c2420b79b81b198dd6d0c24051aed39a63ec425d64b000000000e8000000002000020000000b809d7288a3333f9f899a1cf12d413dbcc963cdca189d0cd2cd17a7a33bf092890000000327f791304382d35c62d16bebeda8668f289b1af25ffec3ebb4f6d6345a0b41879e6fa8471cf14e649dce7958cee609b46f7aabb064b277e4f08ae1e8391a1859413aac1a0f434a2ef5b781d59c830650a668eb620b9db116a6c0474fe80613c263b7ae880ed02242ba487ad9f91570291a2e3a4fee7703ab5a766854885abe482bd89b506f20c88a90995215472d0a340000000e46db281060531b52e4e9dc945876c08cb807d0a69f2057b1ce127d13ffbf03202797ddec95eea9253bb06e2aa1f8d2b0b5a9dff7dee102cb10fbc35c37ae653	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2844	3012	iexplore.exe	16
PID 3012 wrote to memory of 2844	3012	iexplore.exe	16
PID 3012 wrote to memory of 2844	3012	iexplore.exe	16
PID 3012 wrote to memory of 2844	3012	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03c085ce4bd1cb25303a3ce7f7064e8c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a8b56306d915281abf49aff44a993d5

SHA1
210c17e5d7900b6d3e132d841350fc0ca9f5b5de

SHA256
c297dd41b476910ba2ba7da0f807718488712eb30f6495a2183774ad216b03c5

SHA512
32fb135fe28ed0e62cfccfa18533f04e2401a21fb478b13ef13c674ce9a3de791b4b0d272c23830148d33d196d54c345c717f19e6f39cdcfae4024d6f0e03b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de8a600dd00a4f71851eca93d755c24f

SHA1
00c85237210eea375583e2b95d864a5c10ee42cd

SHA256
e3447f7b275b5d5ee018d7b89115767d53426c697e0d6d56affac6090c5d907a

SHA512
8cda04e7e9ae2927246817291e45176ad0013928c28a85f7dfcf9b56dc0394c9503d9d791b27feb0f2ddfb3b1f1593dab54ce9825c1f7d4b2476c2d3013056f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65f0b9873392fb69a4365fe8378dd90e

SHA1
c369973c8674d628cc12c981100721cecdfe090b

SHA256
20086da5624a094dc971d6f2ab6bb1ce7d47947ac67d97d3b1927839624d084b

SHA512
22958a00ca78439bdfc329aba40306e6cebaa103121048411acb62cd953218971ec82d21f422388a16f678701c5ea3b255b83d3a0f6913e813d44534afacbd3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81c8a7258fd8c3151506479c14068f45

SHA1
6ba9b3c315a6ea80cc687c86219eb9fd9b2fe83e

SHA256
73140d3bb714bf3d89a600dd71a04251bd2d0e0a0db262b336f327ce9dea5ecb

SHA512
0b79f7ed0cf4e7b299b6f3286357c05db95cfbfbd704b22ad2bd85649818fe514a7577a93ccdc02d4234260a123af5ffa41b98851a16bf4f29b8603bace851e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66477f52ad92c7eea219f97ef9eb8e37

SHA1
14fe9ed506e0298f7c6898ff81055dae1c1256e0

SHA256
eede405bfa60ecfd13f0e1d1f38eade68a531b7e44af32a673724a84b123fc5a

SHA512
a3f274fccea466bde54567378dd8e417f4453f0bff2b7eec3199782f94ae6005a21a127bfc4fc08869adb40879217f823a98bd8efb6b1d3c254dbfef474aa336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d69fd45a3d3ae949bc73be01ffa7e427

SHA1
f4c0d19eff9eb2bd20f0398914c8621bad8da25b

SHA256
c265c1ec0df9cf84e863aef915f2a50c74c357b115dc9d03d095322183f920d0

SHA512
c67037e8e46d3a8e9bec2c6e8fb6f0711f1c85018ba6cad7b427f41544a7181e001e5d8a088cf561acfee1665f27d3bb34706f6a6148085750fb42f90323ee6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5092.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5094.tmp

Filesize
117KB

MD5
528f7d5dace9f8fc859c8ab65c93509b

SHA1
e3a7ceebc1ca847d7b44f5ad93e10af7cedc3e0e

SHA256
ae826a48da5540025b632a5016e5131b8c2096e9a61042f66df568afc6819204

SHA512
89c0392574d19c966fff295d5f3b33e7dc5b8b868db7414f77054668f39b8dafdf23a72a305983e12ec61971e24ba12d75008f9dc576496a5a6f1aa1a2e9effb

Download Submit