1ee8a89278a1b88a28a6a6fcf68ac56b06f5a488a91ecc4a6c70094cc84d8fb2

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b3f2837cf20b8f187faa706416a922d.html
Size

21KB
MD5

1b3f2837cf20b8f187faa706416a922d
SHA1

bc6f010a7722acc2c30101603c8b188d91fe01b3
SHA256

1ee8a89278a1b88a28a6a6fcf68ac56b06f5a488a91ecc4a6c70094cc84d8fb2
SHA512

ea724db7b35d52ae08c532bb10fff312b1a46277d062f081080e24627bb96664a2303157fcd886d9c6d2d5c5fb212e5187f05372db0a47926de78deee7692a6d
SSDEEP

384:C3gj9tc6j0eeeeeeeeeeeeeecnHn7pYnuRxW5wuguJmpQ4d:C3gjAeeeeeeeeeeeeeeqn7+nPZmpQ4d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FFB8181-AA8C-11EE-AD90-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07f2d65993eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000db585c803426e99be582ddc8485ae462a2572699dfcde5285499f56049e9f94e000000000e8000000002000020000000acb3b7d57bc8e2f3059b69a48d0a36cac15f9005c6bbdb0cd82dc3921e975bfb90000000b054734da5fa1561b4edb8eb08833c1546deff42ff051c9b340466a79e88d04b25a8b362634565e9d08dab0a7932d9279fbfb86fe19a77c482bdda80177edc8d54d21bbd029e54fc886e0c9e9cfac7d9e424b9158462d0edf4232e59968e3c55e50a340414efb64d07c38ff4d893e29e01152eb5b7995f27479e5bcd42fff79d804582c91cba19f24939fef7788aabf140000000750530967e2503a743b8bf56552f18c05220303ea98ffa8b53e0603d82efaa2d33f5dcf1e5ab3ce31c2328f247c6354b75f6be9cc60592946c0a31fb51e0a049	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410484998"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000003d4753b92acb077b7605fd3058f4eb3c79b5856ed36862762346e6f96fe2fc06000000000e8000000002000020000000265497fd61bae54aa411d73656a92478be8f97a8f5a28f292f03a1b73d18f65020000000ab26dbf49b77b79e2af1e006e5051ce17a838ccf4397a078b64fdf57d547558b4000000001023ab1c4c4410a3588a2bd532e84012994a209b96c8a8d7cc5f44ae799f3d392dfe876536db9a7245f9d1fb84513e8b862d60caf2b2cf3885ae5933b8e3ece	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3036	2868	iexplore.exe	28
PID 2868 wrote to memory of 3036	2868	iexplore.exe	28
PID 2868 wrote to memory of 3036	2868	iexplore.exe	28
PID 2868 wrote to memory of 3036	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b3f2837cf20b8f187faa706416a922d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4059e377d4642e98ae785da59508b638

SHA1
9c9175090720c7c788993d3764391fba3f0cbfe1

SHA256
32f1da42888f2fb6714255f9047beb6081d81f7e636f13143c20c362273cdf28

SHA512
817c899dfd87c351d03c1eb2273355377f5546dea6a9c1f71e43ddaf4d4be0b81b6c49d794838b1a9edeb365e106fbf8556265a8dabf93faf93d2b56a38e3b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b181cae9493c7f072fbeee25a6ab189d

SHA1
8858fc04701f7ba01360648833f197f7e06c0fa7

SHA256
1cba93abe89aedfd1a034d10c9523d268fec545c32f683cbbf02c9da51bbcc18

SHA512
4ec2a3caa4108e4a368358894ccd77990088d5af3627c952ffc64bd7ad788e9ee5739bd1a7ce3db8d4e59184e81b6117650fdf9d85c17de8e62705a48daa1661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc53ff329fdab4c346ca1139cbe670d8

SHA1
0947fd5bb03b4980a5e4321d129adaa2ec8a553d

SHA256
d9f11e96affb4b26338603e246ae7ae1f06bf6dca1cfe770f0ac8a5e12d90a57

SHA512
f4caae5c06e125d555c5c1b0ebde225d67b476d9959e29d662f53d35c3d638e283179ea7a101362796172d5c0f53cb1683987cbe10cf7c35e6cd9a8a9e4c27a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21715c8f5b7a9d79a7b0dbcab347d472

SHA1
74e8ce997c200e2017799aa8d40b32bcd3361b10

SHA256
84993b897fd4b9afed339011db3b406ff2a59a0f2fc6d19a57c3dff7ca11db62

SHA512
4948edfda86a8d7f4e693ec8e8b6ad21402aa9b6366a0aba12ffc231e6ce0235c196168d0a0947b4eead29adf39073e5478b1c466a8f782bfc08a5a6dfe2d2ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc41326fe1ab4b627ac74931c67a406

SHA1
b70807e4a4e04320284d55efbe3273c3623df754

SHA256
3bcb152f5545faf920c828592a4558c01867e1e13624d5d427d6f2dac104a9a3

SHA512
9d294ff8854328d0d251f07624a86e11ef795707dfbba05568b21ea40cc1ec1f07f038fd53bcc0700af8010ab7842808c4dee6deba496d57cbcf488fa3728b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9af6c1a4b579d42e1ff026f2d00d914

SHA1
f779374993ef2026ad83d39ab959c79903382f6e

SHA256
a21991a2c7dbd0c4d11acf9098ef89e53ed1e80b774eb6532c3e74906090db8b

SHA512
713d13e578196cb22b2643841dc3c1ac1cef9ecf97109e13eea8b6624f40cde28ed614dc8b49e8e11d8dc51257ce746a0893e64735d2b27a9fbdacc56627e9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3759bab9378923c6202f053fa0ee9e5a

SHA1
d78dedc744362b9ff124266bd7b702e036849eeb

SHA256
c723138a39826cccafdf9a0859ccf4171b337e10664a34ac318e0d74666bd5d4

SHA512
e301ab66b6093ea1ba6bbd00209feb11f1f8e616b8d979069dfc6c4e8770e6c0c40bf82c546ad2a5268b5f8b558761921746ebdf5c59bc4d35716e130412cc44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a82a8a7a4b79834740b1279c0d88476

SHA1
bd00a4e6ab8ce4101300ee8ca0da2969dd16491c

SHA256
d51ca44246e60e379430cae93bd966abee5efa07bd3f2abb7d7b04c3257c977d

SHA512
4d3ca2bf7e9f9de584205756e27e6995a87e4dcb575ea127bdd29b79ee89308c2eac18d0713df13e4b93d4efc051f82aa6946c646b3638371f1efd95613cac31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6069acb56d179c65a380488c84316d1

SHA1
1a2ce45db5f6c5b7737603f192d4daa3c0413860

SHA256
91a3d2ccfecc12ac373dbd651bcb157972f675366167497f6b46c91b89df24e1

SHA512
ef49df1d0ee4546dd18de99b3465f95b1f09e95711ddf7c0edcd8a224e8ddeab9f87066909f5304a4f0e3b7c772c9eef975b38250f2fd019d992283646f77c06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f41391bdd68e8f9345d1ae7bf4b9aa9

SHA1
f10790cf19527e74036c2a0d3d1255885ae2891c

SHA256
21ced507b3bda8f225421912f86807a3c20ee10a14969150a7b12060f7c69539

SHA512
b62830013b412f3d8b6b23b1e368de6e5f644f81233103fdd7887d1932b1edc4e844bb53abb92547461774b6c08c5ff843788fa43b8210f6d288b456fb79cb71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
171b7d51436b1ab4b45fd1dffbf54647

SHA1
da7f894bbc4e83fe0191efb4088dd41a09d5f6e8

SHA256
93da7650cf9860e73ae3522e31a3dd35b70e030bf8d6b03eefca2cce81b1da9e

SHA512
e44e32e54ef02a5441e752c60e523c47329a99bb915b517e6c2ad3386039fb2f553559d4fcc3bc729a75dd7f9255be7953f9fe754fc816b3ebe66eb9483c3ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbccbd1a21a98b105e95a9e32148ef4f

SHA1
c1310e9071a85034c018960b0517d3c4d508576a

SHA256
ff56ca977fa401993a580f653a928cd9e21fa37743ffc442dcf9909d0a6e0e37

SHA512
699a4bd8d06b467b312595f46c40647200d645fb85345bbdd3148049d6c51fe87cc730c0748dd61ed822b7b27ead1063f3abcfdc2bddd8f11b85887a146c9584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07bfe1a5da8cba15ef69542d172a60e0

SHA1
fc5d427bedf80aabb8e3e3e062135d6275c01b2d

SHA256
e9c6d1a917b8944debffec1cdbd877e6aeb70cdaa6552ecc942cd6ca260aef3d

SHA512
d0dc52c567e73b8eee81a7564a5cf6206c54aee6d581d09cf27320551f23eba5d561554bea3abf8fb187a4afd0a62f31b9a3872727ade347196b85cb3e86a8b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C59.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E4F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit