fd37754447087797c5e88e8f124581785cb314a7ee5a0f283c62df2672357346

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36e27a0750de17dac5cd01a1dd962a9a.html
Size

2KB
MD5

36e27a0750de17dac5cd01a1dd962a9a
SHA1

11fc3f206d0b3c1ae67e540d77d5f6132d6c85c7
SHA256

fd37754447087797c5e88e8f124581785cb314a7ee5a0f283c62df2672357346
SHA512

2daa1f8d99a55504963c0f7b58155136a6d6b85520792b779fe61a31317f96b8d7a044da2521a894ed4405c172e8cd6306620928cf85e0de6a6d4f721fcd1ef5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001511a7478abf066f5d00e51e5bd7de8a7155fa388d39ae45cab03052cedb6871000000000e800000000200002000000042ef63e0a7af9762d788117813b7c5e7c6dc61bdb3c0bab94900ebe9b1698cd790000000c5bc270216f4b0b0e19e471fca2d22cf76a3d2ad771d093a2e477eb1768d21422fa0f7bf7d86cf8936bf7267b3ca3748b7a51d4acf12f06cd60a03af9b01adf8764d4cc14437ae5e68528ddaa548b2c8d48fec6bc0283e3b786e28166a4252ae7a6dfdd79f6e8def3119128c85eec085572958e5e0310fb1783a35b4e95e39d5fbd35d332aac79222eb1179d2c2713cd400000000d58e87f2fe526756e731e2df9e10c42363952c91c2d4ebdf3f9323314caef9922456102c50ea78e91dbec4cb88e9772c37ab911cf40e0c878f1d798ee90128d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000148fb13c01bed8fb491fcd48186a1d2b773dc12d45df08c0459398607969651e000000000e80000000020000200000004d863aaa164080dea968ff3052b1b7d56992e2de2b590ffe41ebb39610d6a9af2000000093b32b5d71f03746762430747ceddcef22f04c825b4ae143bfdb2b16586f5c0e40000000c009f9f8cc668c95cf629f1a7fc2c11fd4683ac8d16ba7b53b8d836ffd7fab0c685e6319241ea20bca712b9df2da0566ffdf1b885f6f7c50bed5e70ed603aed8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f81c9f3a3fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410554239"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA6CEBF1-AB2D-11EE-9305-4AE60EE50717} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2364	2296	iexplore.exe	19
PID 2296 wrote to memory of 2364	2296	iexplore.exe	19
PID 2296 wrote to memory of 2364	2296	iexplore.exe	19
PID 2296 wrote to memory of 2364	2296	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36e27a0750de17dac5cd01a1dd962a9a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
961d53cd41c201bc638a70e89cad04ff

SHA1
8f7288dd6594b1e8cd8fb8d8863a74a8afd1e40f

SHA256
95218099f8c145670bd7868f02eac877795f36165d04627a7864e61a86c9b19b

SHA512
4b00222989150f420f9f187a1ec00c9f5fa23184c3c967336436defff5b4ec835affdfa525ab4577ce10c3336b39707a322265424cf80c0d8bfec801c881e85d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa63486881691ec3700092cc278f1a1

SHA1
10af4446397f70dfbd76e4de0866c55641ff3105

SHA256
e6fe377068b8338d03ab351b52f41c625130558f8ca50ea85336179f49e601c5

SHA512
35dca6183347e115842a08b73b731dd7d403805a431f9dfcced9fe7333d0cb99277b7f2261ce8db95b7dd144a10c07a5f623e59a8b512e6312b602e96167a004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f30d41c90ae681e9f7d20de8fc61be8

SHA1
95cafa7bccac0a0ead4028f563566f2b33a2dfb1

SHA256
a93df070bb03215e90ac3e03338aa747c5f5fafbd159d69903a3d34f12f8e587

SHA512
4cb83732d785a1b1b8f738272aa962ecba91a771ce023ef374951612d3aee5965a05800bf76a2228a6efc4d83c7d87907474a51982be5187d29024558faf34a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ec9d12a49062a3f33f667b42b9d47d

SHA1
34de1167d9a8bc5aaf866368520b8adc52678df6

SHA256
6be73771f6bfc1a78be0a071257772b1b53a148847f057250fb7dbeeb0043974

SHA512
75aa7e6e6417c8266b590db4ecb86b796ee699fed8a6a402fa713f69a62f2112231c1c078626890ede802f7d2ccc85765c2269bc65c0d8f9cd6cd07391fde772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c21f20440a9280d18de996e264978787

SHA1
d869e779e58ca1905a3005e372cb972c2ab8e66d

SHA256
54d64a6170f9a9d6882cf8294b85e60a5eb2f39431171e4962fd8dcabd5e7186

SHA512
d59604b68eba96c9f58579fde452e93a6f901d36802f1f19cf4b9fe595e44cc6b2d72a68f9aa4ff766c0c292f286ac6c2beeca043d55351de26d9f7c95d03f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be4369ca9910dc0f222ddda03a347f28

SHA1
07d202390df6074ac775c33f637de1d9cfa08a4b

SHA256
d98256636827858a1a3db73d3f11ea19f3d7efa3f11f146efaf7480162c0606c

SHA512
878275c4c90e7935c7bb736dbf66586ee3772fd4fc98b73c8ee07358a865e6276a24f149f065b79929a3608b1b5ffa439d85e35257816518ca649cf3ee3bcd41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ec5061fd0672c61228d5a9a5e8edfb0

SHA1
795f96aa9ba812738b6a10c0bfacb09c42b7e972

SHA256
3b3888c8fc8e9fc743227ac985d2172f177931cb9ee8b520e763afff1def655b

SHA512
9389f429022d8ccef93c80ca7598d6196c611840d833677f3aa37814d414f2e4e51f32c4111af200afd59737e57a970f14d343a7bde2d219081ad7359f16115b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6da3032f6e69752d20a018b54ba60fce

SHA1
b626e51956cb9514bb6d03c12b6eb8793161ec32

SHA256
cd097e7b029cae7f85c6b4a7291f639cdbab94888f53ee5547ed2dc06a2d7d9b

SHA512
ee08ccb77a6b4824d5c990c354cf7c4acf161a4242fbc52298b938a85e3a97003f2d87ef982332f89b0842141d56712d9edea575dd09fbe5c1596ebbbe213561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72b0ef7cfc21d6c4f748838e585d6db5

SHA1
7209443ba1e86f35081e1d592d04910af36d0fcf

SHA256
a3cad093e489cfd7a2791f8169d66496d813d9b72c740f0cab5e62b5423c9d50

SHA512
0714214762fc513bdb885a6e32710873082a070e4c83762d18dae17e61e13f35834a319fc60b4b3c4c48d578bfdb12037237667f7250fa63a3a95acad2ab412d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
918b9e99d1bf5c91b1190cd31a5c55b2

SHA1
0d3c41413ad4031140566a24a481f8f533ccb8ba

SHA256
d1cf9f92db75e938726cf74037e3c12d7a320570443f9f648398d9dfdf910526

SHA512
895c52fb320e51b8dec73487c5fb17dc7f90a5be82c7791d3ad24b69ce845c7b008506ecc8ec611252eac27d0620de22de41b70b85e51d25c8359984fd168443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c8b628229f4c019a1b27f9e594f55c

SHA1
63d965884471564c51c331c6c14e5904df83d14a

SHA256
b144aa93864f264d62d9e418c6517224ea41c39110dbe8c3b35cd804cab828bb

SHA512
d2d3c60de629d624f553331d25ce0173eb99a50b0d3a566710a8caa3060de9b735dd1b5b3e1e2f3ce24605192081dc261cdac08a9730e031592bbbc0f84e1ae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f109bd337058045339e10ae75fb47e37

SHA1
9acd004db45576b135514ee26785ea0c1052f2ac

SHA256
91fe1cb6938d9bbc2f9fe72b69abe79c90cd3a537bd7ebc31b0aa967304c139c

SHA512
624fb194d955a108526d83b8059cd4e43c8c4acb7d8d65e41ab62d970347bf172d15eca86e35f72416a9bfbacca992959b800f7d8678632ae477b2846615f0c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4feed6df8db1090f41ab5321cb6a83cb

SHA1
71bfa7d3a766f2a43caaa8dc018b44efb3679dcb

SHA256
e16de4891d2901c6b34d6936d230b3d071eed9dff2561941055594f50985de13

SHA512
d8d919dbf3167db94cb75851ad1f2b6d3f71ba9736b266f4026232f0fa6df41380e0ebcba230d71355b19645041ae43cc25fc91a42d4f43df4b3b7c82f626044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ace0a28a2d61c548947526b62207057a

SHA1
86a1b12a0788c25729757b3c46eb709425b9e12f

SHA256
ce928e739cb7c4f123bffd8172a362e05948280029d9f1a114c532bb47782bdf

SHA512
ec96b28b57fcfc5a744dedeed06a773822e46c704e2cc481afcadbf95df85ac63a1d98bfc251ed3dd0e031499a263d95c6c5fa0e880ff4dc3d1c778d0fdc2641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df22fb131d198379753f4b81431fd2d5

SHA1
75439e6446ae76c28d1d7b0ddfa88521b5f3b3bd

SHA256
72e86e79e6f0e8551e8c45b791854ec428d32a00731723afeb2bf3044c419253

SHA512
8f5bb9f38e7eae130864eb89e98fa5d2b15bf679bcc514314bde69be8bc15e8630c9edca67e7e6c795c91e64c26e75ef9166940a1cbe40d9c1de8e7df6553c2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab237B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar238E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit