e36d4af845b97122c6f0a4b56f412422beded979bb14bc821ffbc43cbecdb7fa

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c3df7dc43618ebc6835055520d5f1cc.html
Size

47KB
MD5

0c3df7dc43618ebc6835055520d5f1cc
SHA1

2f2e4ad60836a6f6f62efc8c6c7df319c2e1bc15
SHA256

e36d4af845b97122c6f0a4b56f412422beded979bb14bc821ffbc43cbecdb7fa
SHA512

6b5baed5b4422433344826a5e26eec93059a217373a63701b9f09d4c383584a55433cb99f737c6ba5e571ae16efff65c062b65e1b0c7e004caf2d6a3148cc5cb
SSDEEP

384:mu6dKmSo0lBHsdg/RKhGJ1bY+ITH0FBLA2PVirv/yKhUJablaGrJOkoXkHKhSJSF:flzI6nelZM7HBAapL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410120150"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A6D4D81-A73B-11EE-9439-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1900	iexplore.exe
1900	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2700	1900	iexplore.exe	28
PID 1900 wrote to memory of 2700	1900	iexplore.exe	28
PID 1900 wrote to memory of 2700	1900	iexplore.exe	28
PID 1900 wrote to memory of 2700	1900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c3df7dc43618ebc6835055520d5f1cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594218318f645c588bc00830eb0e00f5

SHA1
666128e8bf7d191853dc3ac6092025090075b840

SHA256
d37dd849d6c614740a4cf6afb39c1715c4e9137599f0ca118f401c504a28822e

SHA512
7d827e85b963cd8759b61568ca6cc9c6105655fd6787e57034d52f76b07130b0db7c21c270d7a04bd02defc1a3d09d47b918172461e1aa469991f549046e5fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58e0b7248127b88a7f4805720ec6eafc

SHA1
15104e7139da60d40c9897f15510daffe4de97bf

SHA256
53565d810e1610fbd77c246e3aa749ca13015f1ae9ee52f64fa7ee269c36e75e

SHA512
cc6a37081b863561e5a66c07260ae9237d552a51647de6d1e2a22ce74eb5e032b1c6935809b74593b54b79e042bd63a17c3afed36b2a6c771845f752e25e9492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6260ea6f4a0552b09375f5a9a5aadbf6

SHA1
0678d649cc5c0686039b248f47d2d5699a98c4f3

SHA256
0ac50dddccd05a2e0ce4c74dd5b6925258f9a1464cb53b3983f9860c91c30bf8

SHA512
f27fb7c51fe503f5eebf9717f310c79fe668e6438ffd26c2ac1323240a2c3cbae77a45f3c0d83f85f6779f0a2a3f8e0475f5cc9204864dbab9c2e636b4e18d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f223ec570c21480add63b4e9a11fb311

SHA1
ba21af2f2f6dc0004bdf16b506ec2a2a2a77f7bf

SHA256
52624d1b0d23573457903153242b189deeb8ca8fe6fe2cc888326be579b94012

SHA512
9a5202bcec03debd3d9ac2d2c1ca15efde44c06eb3cdc1d38a14b523982103258120f43867dabfe85842869243c106abe3830ce735d99392d5b411b7f17e8978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
179339205d8316bfcdcb6b383eaba08a

SHA1
c920a7248f0f4c9036ec8b8fc12303a57bbc5bf2

SHA256
fcecb0c39ed7a1a02a1048c0d92463c9aed855c6fd2268be9ba47fd52dcc08d2

SHA512
73caddcff3f590f940cafe92935f77297b76df6a5da1bb687380ff7048b8f954cd85165c5e6b123728b8102dc5d5cc8890bad63500fb1c4f2f6919553b248f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb6c65774b660981a71e362fce5ccb00

SHA1
2797fcd0fd4fa4a1130c8999a932490d0d9cfe99

SHA256
728bca6f44e390c864d06fd451f7f05f2944acae09b2bb4ffd68673027435862

SHA512
55491023b95cbf343668d44a09e13c8f81da92d26932e00ecc5164b4823b311bed257a0be95747d281bb4073001fd3d2678b295859955ddde02e29e8986b07b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d45ae79e446e243b4988f402a0fe4bef

SHA1
f5efc946a130e632c0eb8104e3bf2f2ccea17f69

SHA256
316ac75bd71bd0e8677af6b1a680ad38d7b7751b9b4fcf547bb81c988fbc35d7

SHA512
af361d95184f6c28ee4ca8effe496ea237b73ef283659fb452f92cd627f27f54b0ae2191422463d09194bffee125ae8b537631d7bfd023cbec42a56d04f55748

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEFE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFBD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit