cba38d74a59ff10ea38ad4ef7c7dce37ad62cc262bd5eaf655bc606156d4f6b3

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2956e66cb330f38b08dc2eb5193ea456.html
Size

798B
MD5

2956e66cb330f38b08dc2eb5193ea456
SHA1

7e1616412fded1cdd5b8ca5a3d95f9e32bf4a86a
SHA256

cba38d74a59ff10ea38ad4ef7c7dce37ad62cc262bd5eaf655bc606156d4f6b3
SHA512

be4701da5d7df572900f8dfc63d163b0e79aa0dc29d6403cb46c68f75be03d619aea6014bd600f939573cd812e8e8a7f9cd58491c6dc0195d2046e59e5ff6aee

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80eb8aa6493dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000157e5ed17a0c0e32d9dfa74196e5be8b1e3147a753791c87e5a0860818c08a1b000000000e8000000002000020000000a5a83535677f00991778802d03929da5aa3ab50441f37eb2ed325ca6f104b70890000000065e977f6039ac253dd424d2d7b5cf0ae9c05ff7dfbaaa5efdfeb80532a87799b78bb80042f3ab5128ad53a0cb70a6c4149c7af0aefde44e14cccdef73f231ac61dc4d7fe19f658dfc5c11d42ad16fc25440c98c7a9dc640ba7979a5e518fa33e866bf8e3ff8c8782a0ca11f35a478e2e67819cceec9cb345c353c4a686561f4c3a7196bc9c9040bd2cb0d04876b9f6c400000004fc9c22a983e154f483d88a8fe861f2f0fcf8d3702eef55329e126d363660faf0a8c9bd64a3d44a757e32d33fc35f2eb3e1104d8c1dadc909c27af19197aed10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410340790"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001d380fb14a9c38b218650719b3160ec90ba10ee7195a9c89633ab38fce1d8a2c000000000e80000000020000200000000da57fb920657ccfd3056a840e85b28a59c0156d03204d0458726c57e61d21ff20000000216c67943982d1a19d9d3c284d801d8bec6ad6d0afb8b810b0964457f7b60d7b4000000036303be7d70d600d3475e7e587a8fae18b02d7eec730bfd602dea8103eb13d17fa3acd58913b3fbb4932556769ea792a96d62c3fada601047de7b58770740662	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D17742D1-A93C-11EE-B751-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1724	2964	iexplore.exe	16
PID 2964 wrote to memory of 1724	2964	iexplore.exe	16
PID 2964 wrote to memory of 1724	2964	iexplore.exe	16
PID 2964 wrote to memory of 1724	2964	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2956e66cb330f38b08dc2eb5193ea456.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be3bd9d7ff98691960284cf8f88249f1

SHA1
f7f0eb2a293e876ef35a5f94059b96ec8a51dc40

SHA256
1bd2c2177e0dc55cbebe4db8e744a1f45551524788ddf7513b8691979f56a633

SHA512
ea769619ee30b2b86fcf80cf56145381b07f449ff1cec87eba1c696f7b5e694abd154f2240001e16334e45dc0438484f788fcefb2b15a29cb9a8f38986f81269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5010277b5f43b94de61f99a6255e9c

SHA1
e6102581a0041238789230634e7c7710c826190a

SHA256
9563a9407fb5cbdb4807909c344e12400fc279c2def16dd0e78a8b577dbce89f

SHA512
689f59aa7574d0ea21d1a79b8fce85956e2b15a67dff563ff4cda39f43831176bad06b43d4a3a7f9d63f8c5ff65f6a2f333f361b78948ed2fa24a1c161637f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7e70ad985155aa9f645e74078fa7ec

SHA1
7e6b4b3a78c7584218ff1703b442f45822fed53c

SHA256
446421152bdf1665acef492372f3cb1591901d99ae81206323b1c8a706ea2b6c

SHA512
5ca20c1bb5125996ed9cc7bd7186d3cbdf4faf8efa448a6430b7a251fd2e294139a5d34940c76170acd8827b23144647dc9a3ebe12df3ac4537a0e3e327366ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fddb8304ae17c09aa7ec400e5022eb46

SHA1
c00424a20de48e592c33c8c0f0e753c22ef8d981

SHA256
de613b8a17cb8be450abe1e496621de936b675bbe662e3b0cf43dd31331000c7

SHA512
b922cd1f654604da37653a4e5d3c0c5a8b3e26e5c405f916e71dd18c56cfb77cce49d02e0ca46321d0d03d2a2844f3bc0676787f245a435991f4d3e4df7cb4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968578d8dca06de2464b3d1d4ce8d193

SHA1
02a9af57b8b61053e112c03d55277154426e1438

SHA256
bcc4d0289b1268bda0e0a3fe1f5e1d59cc72dc0033ce0a9c87dbd4d337abe2e7

SHA512
22830f583b3f2bfea12f3d5e35b51ea8d6ce32bdbae5f24ba1e68f825a4c1e96689e2eb19a3173fc8ed88d7b3cb536211fc2f9ac9e206a10f46cec07268223e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d331fa0c07de8619f71dbe7b1f36297

SHA1
fd2314dde4d568375d6108a5233b12a42461f792

SHA256
0223a0e4a40a8a1fc66f7558cf2574f10a93866dad6cf7224ed90bbb0c1f755b

SHA512
742dccadda08119cd96675cc932b036e950f13680d46c40b835f923d4b8d9243eb7071f598efb3380f5c49b369dcda5a483b735af16f980de20c6fd3a49ffd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be893118275fe02d445214ff3a65658

SHA1
b4cca194b8792185792fdc13878029f1df0361d8

SHA256
4699d5e608e694652f1f4712934f226e015f89cc8c9c4642ae47d097ff4d9404

SHA512
1548fb0d25f1b18c50f92fe60606c19ce6f98dda3fc2f49a1f80cf2bb17f7df1b6d5cc8a08cef3f18d67ad3f9d5885d05f101691cc330f8b098ad109fd3f6a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcc5912f3ec2e9526b2a8a0174779d0c

SHA1
915ff182d7bf3e0e5c1ef90df81b7dad315d0958

SHA256
8d582a3dcf266b5a1e044de6bec89f18fb975579f2cc46a2c67b4b4e1e922302

SHA512
6461324e146a13c2c24478f9dee0c51af3291a643ef76c4b1c5b6b21f16c4f9ff4789d057a274c857b80e450a89e10ce02f76ba858ee22e523aa165e755d8eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba4c7242c1e30247ba0ac051cea04171

SHA1
73532739a1beb13b0b52d43a431f9fe96bea7ca5

SHA256
5e612f79721c2b1abac26f8dcb24b7750ea3b9c8fbe76afe080c801f3a87337a

SHA512
3d9628afc20bd43d37d07881870e71d24d605a85eeafd1ae88ea224e0cc942641cfbdd2504d06142943074d07698657aeb3866358a5cc800cf37ee236f468d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab393C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B71.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit