333c36698b66982bb5874903ed43d64f45ca70e7a0bae525a885bdebf3b393fa

Analysis

max time kernel
68s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

142179f3279650f31025ef4dffab859d.html
Size

23KB
MD5

142179f3279650f31025ef4dffab859d
SHA1

72ce19fd99fe7459b2f31f5be234b109fa64bfde
SHA256

333c36698b66982bb5874903ed43d64f45ca70e7a0bae525a885bdebf3b393fa
SHA512

b13df86bd7b2b6187969f30ee4ed60d410b8bf7f410225fead8dd736663ed4583cda240c23fb1f5fbae09e32ab59735d9aa4937f01b9d1e6d304ac41458234fd
SSDEEP

384:sX6nA4ywniI6pjA48zdztvukeKXXTuEw75/QiiGaVEKL24UTpNyOcn8tvG5nTDuA:sXS1hiIbzVtWkekz4FPQEKc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3604B161-A7C1-11EE-BB9C-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003f50738ba085c4821f9aef7f81082d3034ec8179880db28cd48d7c9dd7dfc74e000000000e80000000020000200000005906e76469b2234b9357c6cbe32c85c95a49e0a027eddeb7d4c07a270619718a20000000a1f12e534da941ee100375aec7147e21dc20a726b8567774d36e609766f8162040000000a83072d49586aeb1e4ee358781dea949c087bf17eddff4e9d464398e1b988d2e2a53d9107ab886c7b01a90532a64202e2638ab7c5c4859f7af17319a04e14c9c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fc070dce3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002c4076b0bc53d6d1fd0a3fc0a9a710f67b277300ad5cde35f3bc81fa52589024000000000e80000000020000200000000da3203a53d40d0e431f91cd21626dc1b032d9a817eee6b00908ab90b35be2ce90000000d2c5e7697d2af880d1b3c1f17f6f380601c82772c8f8f7b08de7db474c066a70303fdb1c7518709f28f18ac66b8d2027dd651492c5bdce99d8d88435a16fbee878c378736c3378e0c6d2e63a767e1babe1b9d35670e425ba2035fa9df89563ca9a4e4e0bc934c13be0f1d824a192c705c0ec1354f5be442c0d6e7cf49052475f83a41c5d67e7bf08dc7f83820396211e400000000d26e34e47224027d7bfa1d54d8ffdf616475666745302c249cd9311b8d332a9ff58d219728c0dbf6d0b838212bf212b0369bbbaf7718d2e3ada1fdd2591751f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2772	3024	iexplore.exe	19
PID 3024 wrote to memory of 2772	3024	iexplore.exe	19
PID 3024 wrote to memory of 2772	3024	iexplore.exe	19
PID 3024 wrote to memory of 2772	3024	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\142179f3279650f31025ef4dffab859d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c56313f652ac73c7b5dd4a174df69e

SHA1
1a9f27538386338b45c198a7adf82a9a71f2779f

SHA256
e9a2a7e29b063d1c7076e039e9d89b507812bb89def15abad054b0b5ee457cdc

SHA512
92ac2d420220da042cd97dca3324d9d5cd677e504d945fce2dc3507cb5fdb433a1ca0018f09dfcc668d466d53841ced7b24d2954771b8676bf1a0548beea9eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02fa7420eafb030ef31a4d65e39e0b8f

SHA1
5963449b7452f5fdd4670e5b8a31aa9088f09faf

SHA256
59b0dbcac4a55920ac2d7d1522ab4b8477081ac3cdc19e940ca067aac0c47b6f

SHA512
e80b82f1850e897b990cf1216808c3386661863b8a0033783157469eb5d419e3be5e987e8a7d754f6d1e14c16d0f66bf5e37b260e5e77d956ee8e6f276b34c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c93f352024fedb6cc6a0c990f0df2518

SHA1
51d4098ae64c05953e34d1370acc230042e56c5a

SHA256
4d080aebddc869bd88b13e516e3a632a0eea1c3352030b24ab8142f41a77d818

SHA512
80044187cf5dcf66fe839d61a8d0876759d482768af908142a012ad3a3b6118acf1325184ad3933c9148af0924b4410067a8826c72e1d795133a81a33e16a3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e905b0c334006e593933fedac4fae6

SHA1
8573a96e1455c54b1fdaaf9c7195a478950b3749

SHA256
e84e789fedd16c86a187dc972d0b422d6f562115f1f2b126cf6e5a7a01e35712

SHA512
4152763faeed0d267b9bdb2ee049e4266129ad3f73f4f6048598f8f9ba620a7bb85792a5daa03705181f8d8600e765a5b43f1411685626895cca07fb7fd190b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0723d5bbe355b3aff7551f2f327e2d7c

SHA1
3cd26c2ca596c54c35b0cfa422f2365a04a70e27

SHA256
b430487dfcf7c6ff92c7a91c9954f54cdb75ee5c10ff7c8c4e0344f8a93bf11a

SHA512
5fb7a68fb0346af606ecebffbbb474178f59cc84fbe83cf30a8c0b7d4847512e9af7ff8cf1d12337917fb0e026aee211a304cdcf5d7be7a8b8caa8813ff20fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ca26f3c3cb8aaac30efb3fe0f69c65d

SHA1
f8d1ea0ebbdc8daede25586e373e33ba0dc3ea1e

SHA256
1f47366f4631df60535c2e22ada9526e08a9e68c9dbe7ac2a48601050cf44b60

SHA512
84ec35cf67f6dc47dd8edc15df2a0d9d8c143e50b53321ac9a16d350992c76a700f7c61122b4ceb06d2f75dcc2198654748308e0a0c1abfbd7361e3f46cdef0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a12d47226fb2600688bcb76ff135edf1

SHA1
76cf979f234ba16f518c28a5cf6237392beaa74e

SHA256
b9997bea974a0fcd22510a438a425a7a43a1742e30564adf28c12ede37f0f145

SHA512
521721cc59b9e9b2972bd591e43cb8e68341767a53f8fe714c2583a04b0b5a68fbf007deca5dbf558bfc9ac51a89e15088258b30ce9099d734ce654df21d7ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cb149d1bd097953edb4b2768ccbad2e

SHA1
5a493ecc242ab9b5f3e6d5d2ff95f5e1a6c7dde2

SHA256
bd2e6f8c16dfcd8c4366a32cc0da0d3441ceb88cca3cfe9c7f6a4c968b670577

SHA512
cff754ad581bb29a35a6a7d72dbc692ef1b9521576dda370e9fb8e3d4b539bd03c28bd2dd1d2d17a8bb402d26eb213026cc77df4e53f55d3f4eeff1293b58978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
481efb543b277a5674000ee9884da1ed

SHA1
c0dcac6123e1d8c7986e477a062159588e0ad76c

SHA256
dea5d611acf379ff1eb2619e9b71c39ebec5fd1c24f03efd29c3dc2e5a66e8d9

SHA512
f462172309c7f01e8654880576d463be1ba702e432d2ab0fa4b8edf9f862d0b3a53f2ea092e6f13c844261a282fc45e242aa1ebafb3725035f3b289526709199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
193257a96c9a77e5c341099e08fb7a6c

SHA1
13442896bba4d97f481b5f9101db48fab8eab4a5

SHA256
f00b97bd9ef44a9a6ea27929ceca36f9d9964510b7889c27f13f76da13ad4548

SHA512
e64e8f0649cbd3b37b12c96ae05f3195134c8a6ce421a0bf58ce83ad5a5741efd687db68543fba9001a4a7789f45585802b456600b8c96dd76fc29874e95522a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63729c4b7f4366e4d65fd76a5d9ecdb6

SHA1
efa16bce4f0f0d274ee7efb3ce07bf39607178fb

SHA256
d47d1890933f0899f6b1c8d416c6e9643326d6985ce6459a76c1bae66ac279a2

SHA512
b65a46601448e73350d6745d3b486add0503fe5bc66f1e10fd8ef5f6d229c1959bf2bdbc7ad60bd4974eb796d900f33304690ff5193b43abd5e1e7c7bbae109a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab70CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8108.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit