e2e3455324ad6bf387212049b55b9ea57a24795f39e9a682ee300597e03dfac1

Analysis

max time kernel
240s
max time network
286s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36afc8c2b59e45e11ce29d7020e3b8a4.html
Size

6KB
MD5

36afc8c2b59e45e11ce29d7020e3b8a4
SHA1

b5390837f5c8485238ec3d738a54cb8ac07aab58
SHA256

e2e3455324ad6bf387212049b55b9ea57a24795f39e9a682ee300597e03dfac1
SHA512

180f34b37ab680d9787e8008f1b7bf21d353df3afc4d24cd1b9cf1f3756fca078f0676bd91bb7e3d127cef82a6b024d2069d10b93027fc18d680660e2545d7c8
SSDEEP

96:uzVs+ux7N2LLY1k9o84d12ef7CSTUSZcEZ7ru7f:csz7N2AYS/1b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000c9e1227a178ecf25a98f5204de8cd8eaf4d986528e418d52dd72e539f613081b000000000e8000000002000020000000647de64f9589a0a542d3bf8cfaa39956767d7428305f00220926e0975322064520000000cc2bd1afb11c19863286050256ce188de3bdbe0e043b26e85bf26ea55f78f5b340000000ec8deba379bb61ab40879beceb9cdfc24871d111de2895c90dfa14b649d3ab56b23e30f1161b3e875036291deb275157fbe8c027a1d613c79b4bdcb6dab55bf4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f61d39c8b91c6f74587a808886019f547388fafaf9f02bf0bdacd73e50f9cc2d000000000e80000000020000200000001d2ab818cc065a3bb8b9bc0edca8396b216eb0e29a0c4b7b795189cc17b7867b90000000b5f4e6dc97e02b0cee6605f1b0bf2b6ac75361d12d6fa997669ceb428ce026ebbe15bab0bda825685381ed063472040ec551b8775d3d29929f75aef9ad3f3f5ec037b4eb7cfbc5296dc99c74566d0fc9f11094bb2664469000807fbd98fe3859d9e7d94a84fecb5190344b9ccbf21e4ce4e43a5052e4200e0f9838b9deae5e64087f1800ecee91a5215ccade606b300d400000009cdd8921193aa94977334ca1fdaf0599c8b7e096114d0bcdc5455ad5f93a2e60c691367826206426c5a4f691745da5f781471ba6a9db3c53f4ec44d0270782d0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411061545"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC6A63D1-AFCA-11EE-A018-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0771ccfd743da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2840	2948	iexplore.exe	29
PID 2948 wrote to memory of 2840	2948	iexplore.exe	29
PID 2948 wrote to memory of 2840	2948	iexplore.exe	29
PID 2948 wrote to memory of 2840	2948	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36afc8c2b59e45e11ce29d7020e3b8a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36813e24461f7a752eba62b3b4ab5e50

SHA1
8aba6bd7afaa6c3e9647d128240a90ee2f13fc0b

SHA256
96a010534b5ad62169fcb8cca35fa0da8b154632a9a503078252bb9d5d898a00

SHA512
9488342ccdc472d0beede0b649bd37c3b6ec0425a573c94361c272afccbace9b13c4b702cb98c02312259e23274befd779fb04789b57974e70417f350dd5b8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ed8667411af69b20a30d38ca7f80717

SHA1
7ece2904516288d22f0389b576de23116d75520c

SHA256
11ced3cb34bd05cb6cf314e1f1d6e88ca9dacc2821f5a493aedb2fba889c107d

SHA512
12c68a99269034a22dcf02a7f5fe51d221714ba3a7477423098ab88a35fce46c41a8c72a731e549a44b37e2d5ba4295e863bbb09e3155a39532de42b7f16e7b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93277741d15daea626d3e9a2daa3791a

SHA1
c53914142988456dea0d774bb4c4cd67fc9d70a2

SHA256
edcda65d2ad1df299bab0be91f64c6369d71bcb8b8cb8f9c5600cda6d4684257

SHA512
4471aebefe2db3b4b733982d6c1e0856132e5a79f6576e053681f879a27ecabd4dc310ada33b0c585cbc79f1c3db457dec4bd40cc4a733419c27d161a949bf27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac5045683b2b633cb42854e0a48096e6

SHA1
52c07f589f9ea699dbbf0d39934609248808ad5f

SHA256
78ccfd94dc46a9245600fa04aa1ca90339263ab41900001306431257810b176f

SHA512
759c15de08bced19dee43f26d07ec179fe66a8fe6ab87a481ac83c1a8fda9be0ffc4da74c07f050f5a0ec839fa9fd751fe7e639a574c0e349ad37a7327f25543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d14b9469b5581cf6daabcea3a41700ae

SHA1
3fba803ffeda54f78c0ebec7d69e99b6155e66ae

SHA256
167ee10831a322d3821befedb2ce238e2a9708d636cdecd71627115c4f04d05d

SHA512
d257a108c3d9a2fd3843cb0323d49340b742b3c8ddb73a07706f06474c43b34c86628bc1e6a64694832d214c7a3fb925b94bae96fe937596e6f0a372433b056e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a00372f596f208f6c22a0ecb17b0bc11

SHA1
3936a0ed82ef227393ee331140762936ebe2637b

SHA256
73fc4fbe136ad22ee64d4a37b0be11d339600649d45019f6e7e4235bfab51080

SHA512
7faac84d863470d967533432f7ffa922030e1ee6fdff3fac7007eb11b8c85c643a820d8677feda8f394ea74968ecf1f4d7ada52bdbfe01e126daf26cd2f67118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd13bb8eaeee2c1e7238d1e99e0f8ae5

SHA1
4ebd07ef5363404ac92faaf09475df9f69cc4b03

SHA256
4c39734877fc8ab4054b4e86dc9c542c9fdcc53771f9bb1ec08af9d038b7db36

SHA512
aae166e3a253c20caf37283bc4095ecd5299b1996c50d2c65358a6306e5ab462370cbdbe77b113026583d74e2e9be46d2a916e0173b1f7688f407980c4b3d0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de8009e563f1f797f5e51c1998e63239

SHA1
4a0cf376a20c5de986afc2ae19524f4280e9a2b8

SHA256
c9828aae5b696d10c5d1707b517f22b2fa7978c6e568955424dbe1b3f7f069b1

SHA512
1a5b16ea8227434ee2c3c4693e43eaa4577ed181bfea883cb306e6dfe94c0b5652b58cd9d48ec2d28a1bcad3bfa2ee827eb6399be0cce691140500cf583d4664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d6dd03c9256d42260c3b73c8da6379b

SHA1
1544247ca566970e1708750ba530c0060af717e9

SHA256
92d0c8776496550764c5c3e580bd8378331c93c36e4dbcca228121abf4a7affa

SHA512
39c180b1d9eab2c4caef2aa64dee43d4abae0ca6da5ae49726840113912c30b5ed20f006e5372b1322ab0dd6a2bc28a215dd89a29e77ad33bceda8d8a38d7590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40d452db5af77654cf60d9085fe85507

SHA1
a426a3cf1f76d59afc60463d1d14c361eb3a1002

SHA256
f45b77a8258ce94d753cd28338ffae6fd91fc9db029a670990496a63fa019750

SHA512
290669abc6c5997f3861afe104758cc94dd4d786d7ac5f02f79c08c75c3dc6a66e7335e38c0e986590f1de130e814b92715f724a4d1994e9be9c01a60a0aba04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1803ea63b7321b7c4bfe283af5c810d

SHA1
7ca9fcc9b648e2a6539bf7dcbc6b670e06c7b06c

SHA256
4e0bf33720b58e9ad389105c815883984d051e42e0b101bd257b099569b720b3

SHA512
6a1dfe51916181a9b82080d2b9d59d522fdb0389ff20367cba188ced5bfddba794e1c6426b690edbf2989e40adc361269706bdf147dd54a826a2ec6dd8ebe943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5faa2b2b2f376e7cf26c29c68992052

SHA1
52296051d6aa92306cff3b97d6de420e32c6b7d8

SHA256
e295394df04a146b22346c6cdb2eee8c5b2c2b8a51fd62d1b868c7bab03fda64

SHA512
81cc5d7e689f26d8c4a8de8175a48ea5ae40911e60d2022010a2a2408344168256049eaa2171479152289c71dbaecca45fbdc75aea0b720086d1247ff7d9e2c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
573478194c25c15628967050796b797a

SHA1
ed816baa9f13184bdee627db8ba5ccfd9ac5d737

SHA256
5221f7267e07f261a79995bdafe804421f2d75cc3c382b01a324d604fd66d66d

SHA512
4ff62e9818970c2eb37f17cde3553f54659bf785a97918dbdc09008697517c17a64f1d5f4637b38dda48a67776e826058ac1e8aa3f06be43496afa39298af599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
118a7691e065c8f772773aef5d737272

SHA1
839d3cd16adcee726f600c931cd2c7cabda69392

SHA256
75650578c2386837d5b248b43d1a5407a6d53d3aed79e12e06a7eebbb995b34b

SHA512
e03caeafab933fbb1eba1a7815b1b1ef7771441d3bddd8b2c668be64ee37be8f4a5f9f83f9cdf69333ccfa8708f5e12eff7af496a6fd04321b3fdd4a6c57cd3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC37.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE4BC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit