38752beaa066326b19a1eb2f94c354130f5d704f1f24138bbbda0ddb2f7fd982

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03d8485f9815823898853f9da16d31b7.html
Size

2KB
MD5

03d8485f9815823898853f9da16d31b7
SHA1

f582350e4176da1eb885665d9a839b411283cec9
SHA256

38752beaa066326b19a1eb2f94c354130f5d704f1f24138bbbda0ddb2f7fd982
SHA512

ff35ff91335a655298926998c04d793f2e5102118c21d4f97b8337fd9db7e3d96b96948323a6e82563f4f63a8389723499f1578e2cc667c6c63244ef3d5f5687

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c58d7bd33ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410070135"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006ab19d07dfd1ae0febf51fcba85c65422d9fb9dd85decedc3f3ef83b797a4fd4000000000e8000000002000020000000e514712cd6f1d99732bc6b04f2c84667a63d5acd72eb6d0a859d8e15a34d9ca8200000000987b7981c80d2ba65a6bca3e9afe46c5c98ea1abcfa14d7e0bd2020b956867c400000009a7048288f6576eee70513ade496f996c1f49eebb1dfdf818be903817a8502aa126680fa42a2d188aef2ce35386031f700956c88cf4cfbbef559c1739982248b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A673A421-A6C6-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c4db17f8eaeaf7125b5a33cb20d158445d626eb53fb46a0c8549127d72d18e0a000000000e8000000002000020000000e07287660564ec9414a778ab28b78941c963993f5d17c185b9c1c4dfcde9fc90900000001f39078813530b73242fc3344e87696217becb80303eeea12895592d1196db048f683f3d299cfa6d047ed56c8fbb8ec87681cf1c5ed4e0589269a7560ef85d0833fdba48b7f932d78b5a78d4551bb083291748fe6ecd0a1fd17e02e771f60eea40d839304a8440d99bfecea9ceec4adc65d2c2f83a34388aa9be704cf4fe71dbf1cf5e3cd0fb94e9ad8a24e3cac933e540000000834e84c6d91b8b334b00296a6c303e03113a1a1dc14fd145ffb2c454daf819a6c020ce02fdbfed251b034100e710318590e7493a87d7cb1cba51bfd53625f589	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1664	iexplore.exe
1664	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03d8485f9815823898853f9da16d31b7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95d733649f47b248d47f67e9696956b1

SHA1
cd5d4d7a7e3000eeb83e39d45b11305d3a0f6687

SHA256
4742d94cc63b6512280ece70638f0bf463816c1ce3278488c1decd0a1916aab6

SHA512
b1cbd98146420e788b26b952b8a14f1fb3cfef26292bc9dcf2825d4a60bf0d877c9c377e27bbece5fdbe5f20fae686a3320205798b8663cb8521a6afebb85a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
321c9e556b4cc6afbf7b5d0727d295ae

SHA1
b6f03d52281dfa10670b03a63355e5880f7b4db0

SHA256
4ac07812373779f748009e79bafb704db7cd7f98c359dd47b2b25828ab52d7cf

SHA512
83b82bc383d182af8ff016a2612e5e30c28ee2f921035cb3fec821ac391ebe2f89ce512862ce4bbf5f81856e20ef748172b3b32ea9abf02257681f5e11f4c6f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae6ae06c9e007537196153db320a1f5

SHA1
d8ee90e7725d38533b7ee0d8919a9cff316cede2

SHA256
7e80a3369fd32a342de61f6b030066de5bc880899cd5d32a6f24b87f1b8a65b3

SHA512
f80833a0fe461170d925aeef0aa64c885fd7e93c5aba3ca817e66a47afc6c2b0d37bcf30923f17ecc6f35402fb53e0fb3fa56b6af7db8e9a657740ab940f9f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf8ac875170477df7fd405e53480e114

SHA1
b6360c3fabb14a42e40b0c45f5c177a4775b7ef6

SHA256
70c8770e9249084b321a189d440f04cb05f5e6b23556af2e4911fbd2de50049f

SHA512
b9c9d9264162160f858d609800a22bc3f790b2bee687bb7a292d1c81f4721bdaf87f47756416f4e2d08950f87a9e4ee0eb5bae829e81b0796b53ee19312b8f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd04102d9ceea06c91fd5d0b370b0ee

SHA1
1d69330fe0bc89070e8d90372d1aba68b29476c5

SHA256
4cdc2f1c6666626305e633c7078b4bf2d213188b578aa351d21c5b8b2050caf8

SHA512
b7053b23d451dcb3957b3317a8868bc7e8ba1922ccf8bd3c7842378691c20eaf9c142363621ac4e49b1c7dd015cb1ae7f921880bd7c48a500de8db7e5fa9ad8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ef00e93db13f84a67bd78c8de519a7

SHA1
c9479808d58959bb889c271b663046b7cb60b52e

SHA256
2711778628aa36b30a3a160a00d2c36ac3595279c97726655c31cfe19d5e67e9

SHA512
6e002d93b4a9da8ac1c56fae0787ac8da1f1c0a27efe8ef396853bd703c54bfb9a491f5ee64d0620b38201d77cf47a8e99f8c30632391a885702e8c64a14c22e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2212c033704722d8e0750e3136a7fec

SHA1
7feacf4ff16b0d5eddea740b7340c527dc682fec

SHA256
0632f9f5a08ad6f6db80259ee227925c19fbb7b58275f7743896208981de92d8

SHA512
6945af4a7d06db2bf788df4849d80f6cc784c1f899285bee4b9fa493b33853f76133fd406c592629cc6f3413d8e705edff59267d6e52e96ea6744637d997d78a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d940830155b2b1fb97cddd8a61850d3

SHA1
384503e9b5156c4542e2d28851510e6b6b892ae8

SHA256
9125ffa5cf8fbc95eaab53e6bc2e68cc8c638cc56dd4fa9a74197edc98abce87

SHA512
b46eb915384e8920f909ce0a37a5fda4e4a319f46ec02c8a2822e1c68d114fcf9a0ea4d4b892c19cf3602b3eed13a9b75fb1d7faa415a7ddddc677c0b5434684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d7ccf181652ad3bb97091388f62c0e3

SHA1
523e90aff2a9782a29e6a65640efb1f3cb1c7082

SHA256
7b0d57bbc845f8b66cad46864859e6db49a2af50b141ad99d2a6dbbd18d134e3

SHA512
acdc8fa4026e7ce11779d2af7d617522dd465196b10183041fb97ef06b063bac75c6deeec4a49dac704cbf9931fbfbf9b0d77747ec179814e735dc2435178786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a6eb865fb9e79d7cb599cb67618945d

SHA1
add275f112dec7107a105092f56030918c65c69b

SHA256
99aa8f88d3cf8fd3cd4d3cc1004e015db4328bdba7d17a0fdc6be32b60c34010

SHA512
72af8085a5240330bc92f5ca46a882290a76d479c0c9b33ad41f1cb54a4016e4c456b6383a2d7b2824101c5e98fa6e70845af685a93ec248f67d35a1aea4558b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed7a5137941ed43590d6434eb44f1330

SHA1
df9344daceb1b7d348e278ac478ac18dac4b9576

SHA256
0779d511d7be5bf6f7abdb5cfba10f60187a7b76fd1b184a0f98c2e34bc7c40e

SHA512
b0734b2fc46de8ec664d4b809379c36bb80818131b454c3c615ce8becbc274c6e52f125380bf56090d7cd71d0743eb2aa931eb8614443a8e2b606e621fed01fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a052e551747424fbd9228920e0590ed

SHA1
aa92749245f9bb1fab61d7d9a6f6c11d66a1238a

SHA256
9583336dbcb222ee7e6cb104ba08d7eacf681f55803e99116338402fc96b19c5

SHA512
ef2e1cb7d7f8a86b3956096083b61f5c1fce83244eb436dabbd279784eb0e90b1895cc85d070a884e5cbc96cfff4a37c0dcbbf7545d25a985a156d539e40aa9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce343c133c5ddb028bb6201589829b9

SHA1
5bba1f8867820aa9a308dbcac6f49d30ede78e35

SHA256
8dcc26842d6821413b676a6cf1b3f0bfd3477e50c9ebd1a181f0b447b2461ca8

SHA512
3470f274e309fd0257ac68b99aa6e940095b62ebb0bf9b9c0df49741941049cbb7599327e03f076f08f72c4bc9e170f44777c0965c33e4a0a61a92713e9a4f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3c0bd6f466309de3fd49f3ccb4105a

SHA1
c55659a673614ea54b44df18879c31034d8fb40f

SHA256
683066bf03bace2c80d0964d60e55e0428e5d9ff31adcb22bb66430c893605a4

SHA512
a40e54178f8dc971fc28362add1c0a9e0c54b0e7b4fc7166ac4bacbb58d5f010d67947a770a444fd0de1702db4532993c0e45fe1cc0a4205f04f8258b3ec6145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e43dde86e908dc5386543cd4619a7791

SHA1
0eb33824c2cbaa3b99ba2b21ab17e0a6658018eb

SHA256
6bea3dfe24624e22874dac8b5f9d8dd6bea46d2fdc6d1eb4f076afefba2ee69c

SHA512
68fea20c8d663d73aab0354188d4f20721772e476d8eb3c71df615a307a5b478d5ce181ead13f3878d92f532620a29352aa6df43983d11def4a1b464e1810824

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE34.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEE2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit