48a1de5f0d0943c03eb04fa53780f96ddddcc46ddddd4a1ff818de0388db2359

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36e7bd9adf5eb9ab469a91289b82ad08.html
Size

48KB
MD5

36e7bd9adf5eb9ab469a91289b82ad08
SHA1

87dce2a1734a0ef828d60e18ce1f76b96b8092b3
SHA256

48a1de5f0d0943c03eb04fa53780f96ddddcc46ddddd4a1ff818de0388db2359
SHA512

e2fe43873748f0a882170f75346fff9156815db70c59eb00704a5752328a73dc1a07d840fa97d61f9aa8206b4db04933689dbe7cc462111461b7d8a87e78761f
SSDEEP

1536:WlbXOdsJkw0hzY+OyT+xATF/L2UxHByXgIYosG:Wl7OiJ19yT+xATF/L2UxHByXgIYo3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29F64041-AFCE-11EE-AA51-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411062932"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2544	2672	iexplore.exe	18
PID 2672 wrote to memory of 2544	2672	iexplore.exe	18
PID 2672 wrote to memory of 2544	2672	iexplore.exe	18
PID 2672 wrote to memory of 2544	2672	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36e7bd9adf5eb9ab469a91289b82ad08.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86a7152ba7ef19933fa5230516b69b0c

SHA1
007cb2cfa6ba1cbcccc0059f56f9897f744cb79f

SHA256
88053aa1d24179bf1f3c086773b9d66ef8cfc85efdd721163ce309385f3c7701

SHA512
7169f0e27863caea1137c6a5d6bb1f0deaf478162ab04040fec2f52306bd1880f2858dfcfbb4d94ac659922aea988e231d5f32c4a5d0297b36d645cf655e1380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74dfbdc77793cec1f79407b929e3065

SHA1
231c0b2a6a81de434bde26d7389e7b7d84c95973

SHA256
0f9bb23c26643ffd767de15aede357396e5e77e6c69134bb198097ec5a017ff5

SHA512
8572e2b96380ad69023e752b1557ab91af6e3be5b070c52664189dff089991914887826db7feac32243c97d0a0c4fdaa85755ee899d53eb8a5b924fb4f5391a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7a5f9c3f163f77d2400bee063d1ec67

SHA1
cd84bedc75e4b83d75d2b4be968d9ce798d0b9e9

SHA256
de6dbddd52139fa486a1f0db9b679fe97e68ce97338c67a3be0fc3c4db276362

SHA512
7645fe6b83ff7ad47c8fe6a52c4d41842fc9004298aaca27db23f881160da3872ec9c3e216ac8723539d5f1f4aa34836d20b4b02b4ecb560cec1b192e989464e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7d8a8c04e7d9eb7554d52c3c50c1d33

SHA1
359752aebde94286e17b730ad26a059df8f18d26

SHA256
add531e012e93a0acd111f760c1764e189cd9b57af73953467dfc5398b0ba443

SHA512
1ab0e9585008be3e7a6f7f7938c5f436a96cf15d5f15ef7b7d597faea6de370a78dd4a515b3890a9e624bca74660f334c3a09b04faa48a9021d928c9a991b491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb8629e0acbd80b942d87f0f60a00db

SHA1
f18422ef8328d1dd438fb24df1ea9cdd7ff7854f

SHA256
5218ca095c9d41399f7b6af54316fdd74eda38d4873447a22d30a15778261bc5

SHA512
f350fa3987a2ed52695132986e8846b718a83b3be476d653366c61d346ad09d7bd386d22296e358bcc68935dcb6378bd2f4c630d853d97554ee68b021f0065c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d79d74daf74abd02a246117ec05ad6e1

SHA1
94facc382c5365be61fff4cc9177095188a75fd8

SHA256
c5b612f67f805fce17489cfc9edea8dab95a39b03fa374fa4ca36c35fb165ec8

SHA512
6dafa45a2d0a92131e876ef8e37c721098badbe949d8c06fd052e51c74d5bd0c0f9a9ddf66efebf5102ac2ec8090e7e826fae1c394ffc732cc293edd3ef0e44e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ad399f13df46d4beef4af02d8a2a3ee

SHA1
6ebce4e8de2ccdd206eac1a71ab51a0647a1a470

SHA256
84aeda64ea431a9927ae42d9aa0d403d48df80fd685f1bbdc41f492a201f21a8

SHA512
3333cffdb0a6237f311398d52d436378eb333155ba33d63ba671b7c6b3c869a5c744c0052ebfe6d48e0f753a2b0fb39325b5e956cc85f86b78210b65a4b6f375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba5bc5589467ef0ea25e99d96dacda6

SHA1
3004b07fbe509b468d4a9a33b05b663b17540d61

SHA256
ed77db4c385f2c39e178eecaf2d2280a2a4187da6bb5325518965418f8e4eed6

SHA512
d5dd02a07de4b25378d28a701e97b8c86ee703961f0e7a3e134980cb73aeac33ef386df7a495e0f775c2c639c83bf47ee8b46a8b01d3caacc438ecf83af51792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a097d8318b95fb14fe4ff267ac886234

SHA1
a29362a7dbd39097628f05e463287ee494180c93

SHA256
bd975bcb7280006bf7ebeded6d71f2d8e2a99601d9152275407b7abd89d3d152

SHA512
8f4c4bcd5ae9964dae8bb314c10dd363de0936a981e6f77a6d834201fbd2134bac3f1e12202fd2358fefb0a8677ecb43b0ed293581df9fd8811453a37403fd66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9a4841c8ef13657e54b4c1186fd6b77

SHA1
8f91bcecf0af2ec9573b578ec33f0e15a1ca6aa0

SHA256
088ad8e85ad37fc5596bba339ae2946d5049280382b3f1f304c2fca4fe48b72b

SHA512
277ce0a6cf2f8e8d8e26649f75774d298f74abf7c5ed7a554e11237529ee6759121b4c35821cb775ac7d7ee80d45fd049f5223ad5acfac17792ac600f62b0ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b831844823a37f96cd6894309ecb1f09

SHA1
d01252fcf6281f302f6f7158c61722734beb3966

SHA256
2d5903a84586030b48dc48f6d58e3bce1064e344dfb094d332a1fd7ca60c8568

SHA512
9b4c99f117ecb101fc64d680bbf4a189aebfcb2ebb695cb4db5c614b50c254788c35beb565893b4f46d4322d5166fd46083a0323b08bf58045a6ba0979faf8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8b6513f236da1c66f4eac115cd3d032

SHA1
d17afb0d092c0d12eb093bc3233b2230284ee007

SHA256
3cb9f0194cd1657764cf4462fdd30431327d89b54170f97cf727e197502a01c4

SHA512
7437215bf50f0b7fb2a21ffd8c550854f674486c33c5c16e378acfc1f32a6317567688ba5416bd525301c08cfa842c6567af22ac061e8cdf72a38f73175da120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
318222707454ecd55b47b11fefc4e9a4

SHA1
d71e2f54fc479f0f8b18d5e55229cfa3846e048d

SHA256
7b22379b3013a3e50cec163aabde148f37c7c2eec278fced52b446afb75e8ffc

SHA512
e2543401ef6284ef977c0fea6f30c5f3f38a52a629483cff98dfe16f2a5a6a12ed3003778c655564cecab9c0d8955f1de24f613471c9f3e9a533cf4f93ae6de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d74bbe5794b11ad76c86efc504bebb19

SHA1
7f988822871516d28f479bcf3cfd03736e757419

SHA256
06beadf7055c5d52ff5b0baa27f20a882b7e72d3c19a886d64feac6d84fb0bd2

SHA512
68d6442889ed7a9627981e75b4f3d954b6491bd545e98203e18bf0896568eea5fa7e6295aaf0830fb16650230e784c73f64cd37dff11309a503f284a4bc36747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d34e2595c913affdc59490cca92b8b

SHA1
62fde6db66084b65ee44040d5f736036141b0aad

SHA256
45735111651ad39e94dbf9846291458408f3980e0f6a0705ca34f272355ad8a2

SHA512
c4678778fb9245ac8126d0f093cee65e5c60d1fa1253dc269579746680029dfe7b2bf0e5a601cc4541e22dc106017167a8248397a6004517077bcd24d6348f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4990.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4ADB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit