e232cfd84e409691319f709571826757eab88ca58bccd6c9e6db41972d7a6e46

Analysis

max time kernel
136s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36f7562f6ec0cdaccc6cc056a6e9b540.html
Size

57KB
MD5

36f7562f6ec0cdaccc6cc056a6e9b540
SHA1

186b27461fcc012273d2ac2ad87f059b942a81ac
SHA256

e232cfd84e409691319f709571826757eab88ca58bccd6c9e6db41972d7a6e46
SHA512

64ef0388c5029c414ee375f22f433f2e8420b1899f7eb4c412f0d713699e6e56fef6406898f53f67c1abf4851c97462d9703170425a7237518f01281ae45f2f0
SSDEEP

1536:ijEQvK8OPHdygHo2vgyHJv0owbd6zKD6CDK2RVroLYwpDK2RVy:ijnOPHdyh2vgyHJutDK2RVroLYwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7037cb09dc43da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000084ff5bfcbd282b79033474de1819fc8c7eb39d56a8cf4216098b6ed10f35de66000000000e80000000020000200000009d547f7cb2d83c43650a2b3f03f0432565035fe37a57fac39787f219398767d2900000009fefc926a8e6fc3e5ab31e8e8cb2541c3cc2766cd433431eb9b974559f4337d268e258982587cc1fc9837d0903170db7cb81c159a34161400485c910ec9ab6c1fb14b236bec59dbab954be7590a23f22efa4e26f10e89d49402347eb6a189158c557cd173e98a1ffdb422dd85ede9b03f1efcd34cd96537b4f5c7ad7e69f19b001f4ea7d787e289a981f492e9281e8bb40000000f8e7dc0cb9c28e88c01126e9a7c35d1865912beca76afa64dc91e0016642f291552bfe66da55ea53c19e827167c266595558032df3694f20eb5fab5ffab0ebb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ab8b0c4bdac19dc81871070f242960bcfd01e0a1d27cb7528159fa615b3847af000000000e80000000020000200000004ea7488bd3f0000a2311ab1ed6cd538f8eb0a4a04bde57d510584847cb8e829320000000489a88b30ca00e435f87a9a8fadc9100511ce34ed942d27a352a782688d24ca14000000087d73827c6eb8ae35398d1496195d06e167438bd4f4f20fafed2c8d38f8743147e7193e94041acb26f1f23f275c06d06879d97251e619a9ac3954eceeb654541	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411063344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23673EE1-AFCF-11EE-9695-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1072	1972	iexplore.exe	18
PID 1972 wrote to memory of 1072	1972	iexplore.exe	18
PID 1972 wrote to memory of 1072	1972	iexplore.exe	18
PID 1972 wrote to memory of 1072	1972	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36f7562f6ec0cdaccc6cc056a6e9b540.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b8178dda2bb360d683b65da9348deb3

SHA1
57039948eafc248681798f3518f7d6f49430eec9

SHA256
384b2f1e6f519850c4fe4b21cb5ec1ea0c7d52657921cedfbda997915d4d921b

SHA512
1a7d1f2ddb910dbcba1167d5ba66a84a30adee6ea5863b8f20be3b15cd9ea34726b10d6bd99e695071c4e938b2738c91edb059320801f189b80579d7dbe7ece7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0431bd42b6e830f1df7a628f98d5bfe

SHA1
df717a0c00662f11f40f0cc806422d1c92cd7c44

SHA256
42e6314334e2cdb40c3e82b9ace1bb4314c1b6fe15cb3f30346ef19409493291

SHA512
cb363638eb33df2e0f2e161a9ed420fcf1364f057c7f3cb17bcb26003f80b7f5fccd60f98d7e2fa56a266b6c46edc839355943f30085c72aa5e6365cf28eed3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
488c4e94386c908880d543a50f883064

SHA1
dd1431218a366370442a6ff897fbaee44b6dc6ae

SHA256
d2b254c6cc367ea92d6621042b6fa025d58572ff110af5e7559430c45c260f82

SHA512
dcd50d6d207029c436957a49fd4dcca923767d6209b392d09fe0cef87f322ac02d02fb06277305efcc1d03a0bbf1de4db67af57d0cd59cf948cd7bb32925375b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cc275c1f1dded9db3292af5765c25fe

SHA1
3c0b17fa410a0b4e4eeb19170022786c763daa50

SHA256
d0e0f50b8a958f30534501b2462f254d637e088c4bfc2a363d5d4fe3475a12d5

SHA512
3b78a324794c04ec401c01bc999a07b6bd6172bc4057d33d43646fe7193a2b4d462a1ea63cc7572b336b4eb28424aa9f61231fd31971eab70661a66667fbde76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a4d6233811709c82d5b036f482e49d7

SHA1
d5599eeb7ac5e8bc73eb1bc53531dcbd6917c66b

SHA256
9562cebcb7a7c03900932f42f85575c29c5d65c2a4d485cad3a3b164cb2b4e30

SHA512
fe2872974f1ec903bc71d4992973e50fad7881729caf830f19f5e0bb99cf036fe8c365ab8537128e687b49503f32f706254f896dc050e8483ce52d00a2fba132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f11c178ea26539810995ef3b86be8e

SHA1
904e7060ee3aa622f0c5e36798b52739547e0f85

SHA256
731bfd84d49b475162a6b5d53722d5ad354c8075f2d3f1badbb394d70ade69ef

SHA512
4168a8a5692a9f99b9a05485eaa4ce3e77e2b1aecd69e50299390992d224bbc1cd902339034752894321b61102a3f88d50f49ce664da4e13d54e2735bb4223f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b611b190dd76388350ff684cd5a51f

SHA1
eac22b761c04dd0bca12daaa7d7ca5f5386da1b6

SHA256
8b689829dd7f807db9bfb70b11a6533b08ce5c664fd42d8734450eebefe214df

SHA512
7d5d35d6aa3ebe2743ce44c2de01553b9a6b3aaf0dad1e7ae6fac4a765e6e3c6d0a3aaa74f026f031e988a4d24145b8e83daccc1da7360dff410f738de207bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8283fb98cbbe8f32abdcc5107c349f95

SHA1
3fe285221d3f0a42d6c18daa9b1b815a90981bbd

SHA256
19a742f32fcd931401bed7b387c7d7288d952f30a3a8e1fc686e1c6c6a8360d7

SHA512
b69b0703a5987a3584c4e8df7887e4dee1867bc37ac743eb3d97a281a11c9ed0a129c53f1d0d9c00f42835134ae93920098d097e87cd8ea225622ba329fde540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18746788b763b58751bf11eeb54de50f

SHA1
238afe51b3b080f31ffd688b4111685d68c8f596

SHA256
998bcc6c9990532da9213c8defda9fc18fbac885006d47684e79002de4512f83

SHA512
ea5454170dbd19d6d769aa541f43edade4ca10bb2ac73472a9f1f9f681aba89eb9f90eb1a5db8da3af6fef5a55706d31e93caa07f0ce868265ad55e60abfd4c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edce1489b9d5a2fbfd882d0f5d65fc06

SHA1
fd6b73873b3db0b58ed964219f257529c78b5da0

SHA256
5a10766eebbceae475219988a017327cde9bc9c5e654542aede55a83e0da480c

SHA512
5da40765a77a762612344a7bbc606a4dde3bc313e13e28495d38f67e31e9cf0292947f8ae1fe06ca5a52fe4a6eb2110659a8d1f18989941ffdd0eb7dfaf87c01

Download Submit