9b38b31e7f92907ca6a7558c489f15fc141008081df3a6332e2f2963b10831d4

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2004e7559e7b37cec97868711fd8977c.html
Size

184KB
MD5

2004e7559e7b37cec97868711fd8977c
SHA1

7c8820e9d1dab4609ffac7885266228fce6d6002
SHA256

9b38b31e7f92907ca6a7558c489f15fc141008081df3a6332e2f2963b10831d4
SHA512

b8b45eaa1762b3e76216aeacea787a01a92c76d3acc18e1b03622349569aa09635cd0743933fe2bc209accd66e138dc2ecf4fbfbe4c47ad3ab7dea8d670bab7d
SSDEEP

3072:SNSaEbyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SIj+sMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004c29ce84c6909750d4ec73b9ddf7a05a64d02f03eb8462f8d09fbcf056c0d40d000000000e80000000020000200000008b73a9a55a3dd91864e07fa79e929726cff07eca053d3a9a3b3d9d5d1bc196842000000091765434ef49d0f98bec7d27d0e4f831047b6bf896c483d1607b3e5d731fa84b400000000e98ddfae3cb01b931df81f218314f31524a99afd230f633c58595690fe0812604059bd296844bbdfe7ccc591960137ec4c9d47a10dbcb27ac8fec038c423e88	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CFAA9D1-AB3E-11EE-B751-62DD1C0ECF51} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a51ee9dac493e71eb42579f5178e4df61da23fd966011f484337bd93f5d36a04000000000e800000000200002000000096c90f0a09d16500b440705603700e5ab86192df784af3405b7e22bda599529390000000f1815354d253a4781387e4888fe0bef389c2827b6cbe5fe1c5ce0ab9f5ff850e898c2278510f14694ca6c6a5797e280fa87d1382248cca94e641d05b44fd0705d5daf5af5dbee380ab31460d3874fd8fbfaa815650b669d66d6aeeb8dc2c54443ff534f50bd7d9a710332773af1648ef260342593586fa61188fc6c8bbea505e20e7643dc4631acc3dda7be60c40d20240000000943c216cffc73a573180be503dd87766dd7efbeb302073899724c54ca3cda1911b97a993be278522389bedd89369d9be4569ef5836ff0d81cba1d41c976aad8d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410561326"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907991214b3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1804	2976	iexplore.exe	28
PID 2976 wrote to memory of 1804	2976	iexplore.exe	28
PID 2976 wrote to memory of 1804	2976	iexplore.exe	28
PID 2976 wrote to memory of 1804	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2004e7559e7b37cec97868711fd8977c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bcab3157412dceaf9a6c5dbce30fe94

SHA1
bb3e7dd35aa808e7e0f3ac72b199d288598dbef0

SHA256
0f38d846b0fd3bb1b0c114bd021f0782610dd791ffba6905606469dba0d6715d

SHA512
f462510bf6536c2a25411274653dcd93cb21e6b3c0822b222198d2664fbc97b82054baa7f95986928f8ac8929156a6aa3c7621e797cb0eaee7f5a7326ed4acfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f086a674890007cb21a9db969f63dde

SHA1
95327f6e76ac772f2f9a2877cc51b24696900b98

SHA256
87be60a0c46ceff286f9ff9b162253c389dbc8704f21cad79efafde5bed2b062

SHA512
1470d745435dd17cb434d44febfc67b395e2fefe346b594ecd254f9c6ea6b3ea774c01129851457c3c72d98987b5757ac277474496709adb216a7698fc00966a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c5f01c16ddb5b4c22e27574a1cb762

SHA1
019830294ee80deef7dd0edaa94d1239cf49e6f4

SHA256
23534342ed9dde28da34d0d1aa73ee817ac643c3769da1aa44b69e584cb34fe6

SHA512
207b92ba455de6d305191fb158bc7978317569abb2bb273938804c293f482ba0037970c4ae505b1f2bd7b4ad03e191ab8850e1d0dfb6ce0ef1275036a82f3881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5506aa0591838aed8c163aef5911e84e

SHA1
ff525f8e6381d9a1e25fd2e5b18ca11d8cab1b69

SHA256
37b13926a3b124dcd1139b5a10c7cfe58bf22710a1cd72ffe0c476885ebed379

SHA512
5c4332482a376a4c882f1531f35c3929cac17e2e17cf88be5c0926f833cf93dd1101dc9f6b1196e37fb63c24728302aa66dea91fa66cc09c7ba3a33a28be867c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c9f6f6642c482c8dd8c3a966b6934ab

SHA1
bef84c243a850d464d35704891c54867b370ea67

SHA256
6de5c90352e514747d126e7875ce45e14562d38965b143eb0b1d02cf034301b0

SHA512
e09b964de0e2c3bbdac19e429185ebbc0baf67ed0f04036ffb78c335b7c7e339625954221c97258bf267ce88bb5e16e6aece44e357366ec83a0fb5c69a1dd758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a37c3a40b83df97abe75fc1dfe618a

SHA1
173614edbcac9bf47a6f436ac441cebd71f65c05

SHA256
8b656dc72b30d4e115e245308fa9732ead4c51372eb3a58b273bec4131659c72

SHA512
c86467d20e57a55e198d7126e249470ff394dc4d790763fdb2c147ff42a19f755ea9bd3a5e0341b06e017063c5128306205fd1f8e50461922b566e97741c059a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f78573ccd19259e10daa65924563df9

SHA1
1234a9cc93ad0e3824520e044d42fdecf2b775d7

SHA256
1581b8a69fe1dd83ec7b664432dcf682492a9172a4d6574df3d083693b6af216

SHA512
bb67fe28e62bb9d11981a9437ea4c36a25402bf17ff93301a6f13b37489a568478c6e51552388884dc8503bf311571f5587f2a0a8260fa03831eebb922b46fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38592468b876dcdb76afdeef936f2e0f

SHA1
2c6436536b149b2d919f70f18cb96b8d1bb78d2c

SHA256
23589c7ed7a83f52c32d0ee66437ebf9d2155d899a4091a62febe72d804478a6

SHA512
74b214a6f4c884afa56150557ceb6671106d0527c3c48321ca04f32f026487a9408585be55faf15382bb6854a57085c834e9998861a2f489a4256391d3e2f2c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95325aa955dda553b7359fa0d573ce7c

SHA1
dabc8a339fc535ef0137aaa941f1815151283027

SHA256
dbec0b76ff0d24c7ad4556de9dfb09a7295efb4c783c946dc1eedd87e82eb6f5

SHA512
1afe049fd94bb4b2c4f02e6b74d66309d70c60b0a168ddbbf95243828c60d8f6e6128b6ad8187f60ba422d9f389e63606ed7f509edab9de3d1c64920a61844ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e18730935fb067bb2bee63622d3787b

SHA1
57dd136ca335f0809a4202e9c8a18a14e6ddb27f

SHA256
187cf2676734d280f99ff199f41974b6f97d8a68aeceb3f6854646f4233260e5

SHA512
89e23378de48c16dc33946a6a48296a153cdd8859d481a39ac9970f7bc994ffa9a2a99476dc0ffdde572f4604d906f9542315a77f748f3a1f5cbcd6b946f61c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad82e481925531d44b97df4fe9171835

SHA1
71676b9d3f07e3ee6fae75256df39160427ab814

SHA256
8b9de1b6d8ef207b59fb355dd2a631d96b2d8e974083bec4d11fc6d595c61dd7

SHA512
63ba63b90a3f4b1343e548d1ddf1cebb741806dcc359cc3cce71951fa399895ccc00563956ccf563db0ab2276536e85ade65b82024b3bfaf707c3c1a1b91951f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
908e97aed756f97b2c07628f7a3ecb55

SHA1
491b2b683a11aed07d0289e1ec835e0e801a4ba4

SHA256
d85cc18d2d113b253a9e5944a27023451d934ca73abbf026663884f17b0ed52c

SHA512
ea6e6cac38a9ecb974d1260fa6bdabb53b3df967a50adbd2dd0791a271464bde4d4c7c6f14ca5d28fd2146304a37d72d59974061ca07be714f2d7533afec4a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6204f3b0db99ae5e9fdf8b13465b480

SHA1
d7225f5250476936a149326a4beab7e7ea4a3a2f

SHA256
8ff8ac07a2532a536659601941805cbf94ecedf8a5403ea8b2a0bda47ceb6752

SHA512
72d9f7f10f05d05e11213a38c1126dad52585feaf806a808b6e497305571ee51ee533b9ec89c1b4f18afadeacd8e052fb4a723e1418588a2f1d9be96c10d4352

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3728.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37C9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit