737d02d4b4d29824f72e46f04d2ef42e93c6207f47b476fe2ab4d0b65e27a976

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2759adc91168e2d290f4f35452ffd7a3.html
Size

30KB
MD5

2759adc91168e2d290f4f35452ffd7a3
SHA1

742f29421c1f028ac04f80a92f5c7ebbd5f9b898
SHA256

737d02d4b4d29824f72e46f04d2ef42e93c6207f47b476fe2ab4d0b65e27a976
SHA512

b2c642564c2f5f5d95fa7ebf1e6777fb2219bcdfa1fc8116a56650d69ad81e14e4842ecedc2170f8b947e00b287ee785f04d38a7b9444d7f0fac5ce341ee04f8
SSDEEP

768:sysvr1eoeue2e/e1eYembvoia8+l+Z+02kAcZa6ai+a7qa0Q1QTjNKVl7buHqEGa:CFTLeIFZbvDk0fqVUtbXGCEpApX7kP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410615338"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f291927194af07da7a140555569557b8bebe9010a3ba425bf3aebf244255ea6f000000000e800000000200002000000016b25823a2662085bd84997e3f6be9558e23b5a5d611b70d3a2408388ca43ac9900000005845e0329f51543be4259fc6688cf46f868afd4777a2c9081be37570bc550e3156ae79717e5f0f110aae7ee8f8fb90447ec870a38223b7780b01c14d506f28030d00bf5fcf0c458c93a94848213f0734c85020a0bf1d690e0d65505bbd80d9a90db12aa42bd7b73d0b299f96b8a3583f1abeedd04dd67415722a45d1e070e2ea3f8031c00532f324bf472fcc86cd4d1240000000218c13e205ecbfbeecbc4903b5d6a95e36f96b7ad330b23066c94fb4acbc993ce2350163b6e9d925536bb0b087d0a404fd5647e23ae9bd27529acf1e8b1c6160	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08984BC1-ABBC-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000be9dbd8ee65d1f3610d69d10e5c310b9d6600f1987d71b455fa6cdf57bc01807000000000e8000000002000020000000125a93ba05285a2ff4d4a46361ac6dce55241a7388a4b151a2e32202939aa6c920000000b062361a73de12e7ffff0ebf3d319100d700ade40583fc540cc8864c99fd1e1f4000000043d5c465721149e80107ccb6b3e28882d2a51cf11343f0294a83b3256aa66e6b8ccc30ee0990cd3c4af3751707fbdb6d7ca373007400d815d7d4dff096ef8d02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9005db04c93fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1608	2440	iexplore.exe	28
PID 2440 wrote to memory of 1608	2440	iexplore.exe	28
PID 2440 wrote to memory of 1608	2440	iexplore.exe	28
PID 2440 wrote to memory of 1608	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2759adc91168e2d290f4f35452ffd7a3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e02b288c9d3ae00a9f7e5cf4cc069654

SHA1
4c6302d13e8d1339ae7e810e04287d6618b43096

SHA256
4ba5cec715a8219c38e71abcc57bf8b56eefec78118abe5e1b92c5ceed964950

SHA512
f50a466304718e82fa2925bc897189c8e710a1178c77e8b300f40b56496040141a6d26bdebcb978599df3499a1cfa61cc5037a401178d65374bd82b566e0111a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeb34c0fbe844bfc967ae06fce8ca7fc

SHA1
890228452b6e349c97165405c1e7962aec8a5151

SHA256
c0a57c6bc44874000535f74f05eb87a011537f177a27571a26f924e0ace41ddd

SHA512
bec37f933e19863784a07eaf44a3b8cf48e4a5163a48fd9b2c56eb9b2ebe4159fcff89a993c9e90a03ae8daa475d57fdb7f51c2a376d051b63c15848282ba116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31d9be583f10444d659261a058c43cf

SHA1
dfe07ba0792bfa6fdc017b44e9445efd00a54b30

SHA256
348d6ad6c1f9b91fc7c3cc8b2294c33f35ed7561386b529354090d556f9cf330

SHA512
c092d83ec7b81e2110736dede948f1d27a507d283d8ea09c8ccb89f1d90e944a6295663d9c9a5ad379254bf60112ce9ac2fa4c4b5315634c18238022e7fac532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64b04fc807445d66e8ef514f688df0c0

SHA1
dfa799254b1d2afe042cf391a4f7994789a89793

SHA256
90264794265ab9b76e87fe0b9dab447087fd750361b0933229d116911863bdb4

SHA512
a12920a9a1649813bb961f749e751cfb103c6459ce97ae3a059a8cc72ba8c7525522cc02359af6fa2c61182eccf749f846e1f07a91c4a137a5905b999df9af14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae3c15709641f7494a8444da936fb67

SHA1
1d6e5fa10284609a3596e5bca47ef1aad8d91785

SHA256
a2bcb3b1e840ddb10228ff2b90ba7a3b1f130f9f9787c1aedd525839de2d17ec

SHA512
a16ca6aed5bd5df1566344cd05671d06d63b8bed5ce97f980b52d7b9501a938adef0e0d382a2a98db8e66c0e1630f795d7303f7126982ebe83857eb4743a6d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c77bc2067fca34888a698b6d8322309c

SHA1
7f4b320153f9c2d51a38061dbf1b60d6ec37ad19

SHA256
88f96911e2e5192c8b54691046497b4f0ebf42ed6834c8df213d11a63695a260

SHA512
1c5de07c8619b7aca1b080ae690065b17cc9710705ee70d543b7e066814b0087b3be78c01903d809f1cf970f016d39a32091a4ba934fa9b944eee06bbce4432b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62ad658629ea1f2fdd1e1750a027b425

SHA1
9297010e356808749cbe2478c35a720e7c114619

SHA256
58b397f00aa6db921980e0bbef3a870763d9e9f9e22410cb526463f188094679

SHA512
aabb3ffcb789e9434d19ae34b35b6218c8150d67db15a99b5e1ee95c811003f4919d18aa094ca881c68564fc78ebe732790eee05223d82c7e3e68b567acb59ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
569c9cfdc774ddf41f8742392a06dc1d

SHA1
88576fb74d3aacdfed6e771fa3bbdd75366216c1

SHA256
d8636050d89cb93bd36110bbbeeaf90521ed0b940ed54c5f5e79ff2a89109bb8

SHA512
1c06488c5d63d0947bfeb415ee32204e2c309787a03e944dc190965e1fe1856bdde6202b405f142d4068cb327fc91c5b6d880b0b9f52a53df931ec7c2604a120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb21069f4af14abf760e265ce23d101

SHA1
436fd2e86538ff5f435bd6d8d00c069f52a015dc

SHA256
0c8a33aafb96cef723ac9c44125b8f5002b04fd3bff108e8d87e04eb79d22dbb

SHA512
1d4d130563c510263e0f7d0ab32f6d35c1d7639eb534eebb10d385a3339aa7612fae80cedd9b54a2d0ee377124237d8e279303c6c28062ff511c3b62a89f95fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc9f6fd32dfd76cf72308321d5c03957

SHA1
644f603a39674ba39633de89b7e5234159fc4684

SHA256
a012d4e525174ddb18810d4118580c01d5478ed3763e3ab490c62e59d3435372

SHA512
4582358d00accaef4cf01ec0c191e5605bf4869469ac225732c2eaecaa6b19dbd346db72e79b0d5c457e5c42ac637bda2f9969a2121c7ab14f0abc3043f25789

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar288C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit