82bc2c32e1e0954ae838c148070b92924a0916c9c2bc776a7c2e4968200ab1b3

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09f37effb1c720e03470ed6fabdf9ba4.html
Size

14KB
MD5

09f37effb1c720e03470ed6fabdf9ba4
SHA1

5b5b22d4bee28dd29eee4ebca5569986df86b013
SHA256

82bc2c32e1e0954ae838c148070b92924a0916c9c2bc776a7c2e4968200ab1b3
SHA512

7ef062fae6f46fc7a1549b7a29c95c6c63275a6dfdf547ddaaaa55af6574dc5ac695e0dc3b3df688c70bb58031539a58c49e4880207266f148e5d99b61e78b82
SSDEEP

192:4heXdgBb9juRLR9E3o2PLXAij758IqXF4F/UT6I3/DLI8H2NQ2vaefTg8gKPJYUp:ZR99ERNaefTg8g0DPrVPb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c5c146ab84e1a1714b7fa2587322c658401514a8ff10fda64f3bcf556173a6b8000000000e80000000020000200000005ce70d26db17ec5ebf680ab0fb26bdce94eba8258315f60ea54a223491c6fc0f20000000ab3b02709c476de293fe105937e67a8c956afafd311e8e51abbd31ab546b735a4000000068c0fb58f60bcf691028a0c0feba58aeb68dad9131dd1088092b521a28918e7e1b4bd8940235bae6a4c7deec78c8496ef7652877699d5a2e39dae9875422df69	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CA797A1-A716-11EE-9BDC-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ba876535fe038a7674caaf1550e39ccdc83b0a5e3b6fa90a4e625c403314111a000000000e8000000002000020000000fe82c106003a9cce314824fcb1ed57d88aec4ae8c65a2ad24741dd99ce1ffb24900000009ca75a73715408877f99675b08edc2ea1ab0ab310e71e24eaed758e890fa305742dd362b43c3569c3bf94ded652661060da07dc5c7445222218722f90f41201f2827a8ba55ec1d742a0e5ec43930515d85380c7a06fc36b2645eabcdc9ef46547997e623ee858cbc778ce405a37c35c75f7d844ec2c66f5dc91d6049df78f5e3c79f2a9b2157ef00d2065e1f657a272940000000ac32523283e7c2c4c5c0e867538cc05ae9c8109928b60955bd132e51399563545e7c823ae0b1af02217019c86f3666410bcd931d60cbe050164823592dcb3291	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410104287"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0628404233bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2672	3064	iexplore.exe	28
PID 3064 wrote to memory of 2672	3064	iexplore.exe	28
PID 3064 wrote to memory of 2672	3064	iexplore.exe	28
PID 3064 wrote to memory of 2672	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09f37effb1c720e03470ed6fabdf9ba4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f64e214970872e7b098d04131c26fb58

SHA1
15ae714a69e3c19b55de2815c8fb780f9a94cec9

SHA256
451660a41a076fc7d8a77e79b70ead034cfca7d2c6cb203fc78474cc7bf982e5

SHA512
d861618348c6a5d47d5da62023bc1dba940041581d1d9d928c81ba690d17e6f7b4557531b7b3ef129183fb04962827e9502034b40445bec89127418b2cd73402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a658554a52e05cd0cb8175dec06d5c5d

SHA1
1442af9f507de5fe2c5fb06b10e7c7280ecf075a

SHA256
8d171a9207787a289eed1a7f3982a6b8fa10b02eb712a4490bfce83a848b3fe0

SHA512
9f6f6457207a533896562e878810e60ab3b00a58d993245e46b924dc384b97a6ee2c46087a6b52addb3faca2a7be5e888fba5b74e655cf454cd4a054af6436e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a963ad14e726fb7859fef024cbaf126a

SHA1
abc1cb452cc0fcbb2da5c164a6852b7c03bae758

SHA256
95b048c2818df72809b48a9752bb3a5c92bb8b374974c309a09cd6811707cd4f

SHA512
19655cd93654b386c51119b8574ee59e6bd53003c1e8c2b48c558ef22782d3daa5ef7751bf220097fd9153d44859501ef59f9ef67c381da38089c12d328ddef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f3c6fd8cab6ce9da6a3e8e349cbe1a

SHA1
b1a406b063513412ea98339bc5e09458595c771c

SHA256
910f691c8653bc434eeeae83a1b92e77ed1096f5457c74195cdd59e5c6ec37b3

SHA512
9a0692af617be69b71db70e353f3e35907c82a0224efe41f1f01988ab100b48a30e74004a10ec256b567b413bed05f1451da170cb2525529302dcb314a1b2e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb24920bd6c1511ec68474a985084c4

SHA1
977a00fdae3f521d4cdb6d02aa4501a3ec0dffcb

SHA256
77eba37c704f5ab0debbe6bd0981ff7cbf2e6742f9fa88a24868725f93feacb7

SHA512
4ceb6a2c690943299981f1f7107812c6bd6d11ea3169c399aac4550ccb0198cb6f532958125c3fcecdc8b96ed9a06297f8d43f9865e7119da3a863b9ed447e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cfbcbc51363a2b1d7a383550094436e

SHA1
1d29d361c2d66e4c5b8fe80984d81c134c392aac

SHA256
35b9eae1cbf93a6e364385718a5f6be9949aa724965b6cb271fd5879093fb133

SHA512
c1c6a739e3b8a21cb5e55aaaa88ee847b7e111abb13cd3eb0569623468d39b6c70294696d7e926ec2609a4d11d26f8aa51b5b525d57d61414ab56225bac246d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5420943c8f42a1b5ca76dcdd4f44b82

SHA1
001eb55dc4b8e827b2c6394c8a2b52518b160fcb

SHA256
13dc79e31501f948bdae965ae55cc02319a383dc9d3307e0dbad23e3b75b70b2

SHA512
ccd45c5dd2a04c060ac37e6ff587071e042e55e65bd62cf58e92bde00456c3995f341fcebd42bdf42e47c8db7f73402c58632e7d3b43fa2735c15c663a0fd50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2d1020e21c93f08089e0a19b7bea387

SHA1
4553965918ecf7a12bfd419618d06d4c94133eed

SHA256
1eeb5146d68adea6edf6f340ac740f171341adb7b02d05f8696e7c00d7662045

SHA512
22b5f6c3bcdc97dc944f664c26dc3ed76db1bbdb9467b95ad108c32d7f57d92bce184399e0cebf1b121fa97888f9e96849c06156d9d2810b03b3d59807c6e782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c9479106f09e5986ab14fe1ab1328a4

SHA1
fb15d75c1377267f3b26b4b1a5cdbd8af099038e

SHA256
29688a1ae31fad3030f6171b3a2edc6aed4eebdd6bca458e39a8eaef6d4e4dd4

SHA512
8cae907048662f6ca877cb020540d29152be406baec46300ef4d5544a93df36e8edc65d189a129e35cf722c0d8f69009610ec133f7c48f86d007ddbeb98a1aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73511610e7644bae1e7f468500c695de

SHA1
5d6e5552ec622e46f4f058acc8d9da8276144d0d

SHA256
c593f4af41eef0312bc255618e599eccdcd2c2e693e7a56a49eac69e98cced2f

SHA512
782cb93e04cc4e53ad29409e55374fe1530b2f2a4dd83359e602b1607c9f4b71ae2bd537bd22056acf75b854fee652dcafe9dfb8d155f080a7bf9f637bcda7fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61eea718ec3e070b286610310c18c78a

SHA1
818c904f176f8ab08c89209fc8b1084a9c9982ee

SHA256
31a1947db926699c4ee815f5acd264a4d198258a0680545e35706e47a0bd95fb

SHA512
1331d89ef93bfed261d0f852da88335e2dea6747b5c72e3e54c7846d94c3b0880352fd6c79b10611c0e97924fc274750ddc1538eaffaebcbbf35ff16bfc9e27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A3C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit