7c10d5cc54291cdf59fdfe78d5dc86cf2f11e90f05d4d9383b242049ecebac83

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b28dab38ca4ecff3c5e9eee5fa5d2bd.html
Size

97KB
MD5

3b28dab38ca4ecff3c5e9eee5fa5d2bd
SHA1

a7c2085b30cbbce82fc56c873e3047d31f51f284
SHA256

7c10d5cc54291cdf59fdfe78d5dc86cf2f11e90f05d4d9383b242049ecebac83
SHA512

c7bc7ae2738267cc34710f750d7eaa1886e9433f99ac3dad6fa450adc443e902deb57e1dcfb509e1289acfbd6b99739ddcf8ad76b46baac66694e60b5999eb26
SSDEEP

1536:ewCqY+mZ3D8bbDU3w59I3rzZNQPjQYw3k9o/K8NVx14ZJqZS//Yl4L8hXO+:ewCqY+mZ3D8bsrzyt18I/Qt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0FD8CA1-B010-11EE-B683-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411091520"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000021db67859c27f7ecd5c3ff9242dbe8bc585b14250276b1c42273692a5c52a693000000000e8000000002000020000000e7a3c1536cabf38d618135b7d14915d9406bee24e5b597f5525fea4d84fb015b20000000e9f631628eb2bbc074aceb24624f79182fabfd45c6c7bbbb218bad42a818c14e40000000971c1aa7186a561e5ce363222f92adee19779e401bbbfda3de6441154ea14240f2049fc187fab5bdf3a7f75c12ad6e8800c246acec918c08c49f4d1666839002	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30033b9a1d44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000725c3e3f54916932365bd4a2eeed39e23b13a87c018d4bac820cafad4782ce1000000000e8000000002000020000000535aa23487132c98017ebb53b2a90492f0e05373a10a4e7a064321f2b0ea3305900000004b3b60bed2bceff6048f891e7df3d940c9cc7303b6f41dc1d8333a9a05824aeee27859d0eee82eeaee7dbb459a6513cfae218cb648554ec1270d65969f6e89a537da262166b56a17b7825822fcafde4b684afb31e643964a4563b431bfe71cb354eb6617d4bce71a246a5968a3d70b0449712d42f19ed0bdee5e96a7c00e498954580699ede578f470cb28b401f2013640000000305711c56856fd472ef2c152f53405e045bc57d4936cac7eb8b5e590b0c583b3983410cfff1fed4457e49cd93bcf6df8b835cd12b3aa0d59729bddd8215073e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1244	2080	iexplore.exe	28
PID 2080 wrote to memory of 1244	2080	iexplore.exe	28
PID 2080 wrote to memory of 1244	2080	iexplore.exe	28
PID 2080 wrote to memory of 1244	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b28dab38ca4ecff3c5e9eee5fa5d2bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cc1feca51f511b2db843b1e10d34200

SHA1
8cdda4286c7333b65030737e11ad0c35fd4522ec

SHA256
2526c38a9be22b14bdf0b3184eddac819514ce79654aae0da3358629e2b2e7bc

SHA512
8bab4aace323220171f4c4715e97d130ff67026770c2d0dcda61c9fde76256e97614bd1e7144b862fd4debd6db60ed5ac970ebd077b0cfad2aded575a7b7d2f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8d14d2287ef6eeedbf379369bc65782

SHA1
7dc385d95679d371aebb55eb7c4420525b4a5d35

SHA256
54655022408162cc5e4f601ffa853f420b9786e7f726748fccabbabd1d6d859c

SHA512
17395b5cddc954d06b0af49ff8bcde757dc08f1633b6b14156e62affc02544239bf7689b9540e229e7fa2b3e23b119c1e1f39ffc1ac7ea3d4d4351c819f4a04f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40614cd8467a40459eba22dd017e4a7d

SHA1
2aac7ca8d5de60202b63216f7902367a0dde187c

SHA256
e623efc4b8b57230fbfaa811aa331d1f0ca2d63c0d985135304e841b636d0501

SHA512
8cac77be263ed4ffc152e4907acc86bb3946ea6f7578de668a11fa495d124944f6f11926f977d43d158d02deca7429ffa7f76927d2c720703d771945de608d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
660569562abefbbf4657ad22566acf42

SHA1
95771cbc865de5d9ae82c350e2502e5c956c436e

SHA256
e9a33351a1a6591744e0d14f03ad1603d9ac3ea1b8e147ae011f5df008443d17

SHA512
b39e9a23e377bf59ffc85c21dad0d28ac99b8ce898056c72443bab4ccd27e343637a31d294c62af68009b8cb0bdedae809c17f27456511eb5b1f3cba8b8c70b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bdbe637e300eaa2ae2e6e77f26ac61e

SHA1
b63f41863d0c3451a177d98b4ad1ea8321a4e54b

SHA256
4aa14544da5d80801c7baebdc2004b353f35fd24d8829401d539129085f5378e

SHA512
201fd601b552839daa40fa1da16c09ec749113f083453981e5a8751f18bf980c5335aa5bd3e9cdf1471cbaf298c93a12cb709889f4e682832c8f4e55cc2ff2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
369ba3d855dd520a83b537902185f03c

SHA1
b6d3f018d6377a6762bc307e56e76e3ff47a42ed

SHA256
37b1a3491824b7c8c7e8de26f8d96ac3c11f9d63f73c49cb1eeb9af1b02850f3

SHA512
778a87a639afb88e2c487b3457f14706dabcab3f6092adbcbb9ae195b18376d6d186fb198c74ff4208b2a6f35c2ba705e4a1bbd926708a67bc86bcad4d8996a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
111ed2eeb300ae54c87cb6b96cd5d4a3

SHA1
f6e02e107ca33502e1ec0130324a27022c528753

SHA256
856757bbb220371291744d8a7f37615ea080e0252197e0a653353e3fb754f58a

SHA512
1bf175def5900cd9322a89a120bdac381616d68725a0d2a7856c751631ebf2a4429d4912a62b618099d3c773a82502a937e8fd794f41e429987f644b7a24d5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f32cbe61c329798d7877277e621f0d8

SHA1
35f5c53d87ead5debfbf30f900921d21aebcc85c

SHA256
4fdfd51ced7e177e95f973a7443f38b822eaea8604f5c4954441795b90ef1c47

SHA512
9fe3a6a6b02fd594fb6988374ea2cb56b84168baf0c244ceedfedc82c54de859dc981f68550840d69dd692b115d000166fd6891133eec30e01bac913a36adc4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
438c79cb6852d923fba777d2ed2d4168

SHA1
6902ef1cdafa116ddf29d2da9d024ccde65472d6

SHA256
df78de39bbe0d77de28177e92fe71ea678c70e3135a6c327ce9e95262dd04c68

SHA512
98ccf577c785885dcb6f47b06d8a5db8f25f44ab5224d4c9acc370191bd9e527d40acc2a21088b617a241f8e08f9511191240efda90ece00883983bef0d97fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a975e3258c7ce4e196e976793414624

SHA1
9f4a968c02b6fb0f43ce3dd4ff4caf60db1a86c4

SHA256
aabcabb63dfb103b4ae4d6ffcf55d2a19fd1ec43a934bb2cf0d183e90e935747

SHA512
b7cba06e47aac17acc4cce9fa7905a56f1f648b3f2d44370aab88c1c2a9aed58ad8491b9724e386a91af82eebf5bfcceb910bd35788f5010f5c2443622c2ec9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
887d793335af37ab9d389474ace3f72c

SHA1
5ec65a2df270a958e3a21911100bcd99c6613810

SHA256
7552352b9f4aa159030eaf2e4d2f4414cf7cc9040afb985de4d96ec3c62bc0a8

SHA512
011b9982d94afcc6334ff38251defb1040368a6fe1ce17259b1c524fa4c395cea882aba724ad24d2dfe4bd89b5b0da2d0ba2101bc40b787eccc1adaf116918da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6848.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar685F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit