666420b36971a416ae82435d3ad6472b9b2ae50b3a30b1494b9d2a49cb31d261

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36ef280e166cf821c6515cb17642f114.html
Size

31KB
MD5

36ef280e166cf821c6515cb17642f114
SHA1

17406536ced0e50ec43c3083ba7f0b1cf67f4e22
SHA256

666420b36971a416ae82435d3ad6472b9b2ae50b3a30b1494b9d2a49cb31d261
SHA512

96619da69fe142da2d6c2b14d8b6d7006306c60f24626426062c2d6d02c1dfe74bec7f5b5562b791f96476cfbd0a72e4a0a128283690043c932b408376e9712a
SSDEEP

384:EH2CEo5ZRM3RYufWj0eQtM4TJgWPQ5B+m1L7WXWOMqAKUSAMieaQvlVjZUvuae6:m2Jo5zM3GqFfiEmWPQf+MWdjZUvPL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000004347db70f9b4556818711943d294c73b63c69652ef346391c5efc1de653322b6000000000e80000000020000200000007ff324c688c91ebaa184cdae3da2789a815eff1ab0811538d1e4da004254b6e49000000025145bc266fe97c880cd901b8803d44e82e8658aa0025f859917c4ea277968065b18e532c22c11e4ec92fe39bf0325057deff4f0364e58d90f029a4cadd0e41de0a0b7b9699c1eb1608703f8a318b0590107ca5802cfa06e12e9788eb64915532c2de27ca27e70e8be05eb6b7ee19b0702f71d2991697f68f59ff137601e1580fae18b322758d509da5c503737310ae04000000024e0d916fc1a7207a7eb9263b72b8b346fe68628f7f65f5c9786f38e04d54976c38d2f8800b1f55eebab471ab3abf6e266a65d59a3557d54c3dd9a3db113bf05	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09f69ef3e3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410556040"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000004fa6d46f2a7006594c6b57a905e4d232f4c78c1fba2989277f843145f474da2b000000000e8000000002000020000000dffee30bce9f72d9493fe14ae5355849db38dcea40bca051917ca909904959ae20000000a60d4a693e415150d06f5773813971486d93ef31fe179d0597c217b9b53035a940000000087e43bd5ffc6d8f6ef63ed9ad55ac3633379fb7cdb856db496a652111369cfa1f846b679bcc9637566fafd288f20b2c0c2fa861c0e624616e8be5f609e8de67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF5D5531-AB31-11EE-A29D-C2500A176F17} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2508	2192	iexplore.exe	28
PID 2192 wrote to memory of 2508	2192	iexplore.exe	28
PID 2192 wrote to memory of 2508	2192	iexplore.exe	28
PID 2192 wrote to memory of 2508	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36ef280e166cf821c6515cb17642f114.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
691c56a28703f0aa9f888377e48cccfd

SHA1
e39288055c2ae6604d9a04d9c90ea1f69309a012

SHA256
5f7ee19ad22916fd200cbdb60b1ceed1ea5043b354e30aad49c82e31df522913

SHA512
71245e2b38f677284fc03ef3915ef1afa2f905d9cf38cc7bb83cdd82bdc3416d14641d214c2b25e4f2271fd593c15fd372761959ca5210a06642165a3db2310e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58e98b26b966d24db06e83e52ca506bc

SHA1
92d01a17f0ccdcf736d1f201a5676cc69dbb34bf

SHA256
a18b11c66c32543fda4976aa6d6b29e361178012f1797eeddb4ec9d1bed31ae5

SHA512
c5e9abe63a7eb97ad2bf3229b3fbfecd89a93eb7f3342c7700860cebe97999e21b2dcc6e7ccc0003791286ff4c18b8eaa3f5b3531f636c9a60db396ab583712b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f2ffaa4159c985352882b4cd4262eb

SHA1
bb1d2d262f89a0117b1a0b4f79d269ab0c5644a0

SHA256
b9e7946ae22b50ef79bf0d8552e66570f817495573432b29f5d11fecb6b1b460

SHA512
186e1f49b57c827a69086d74247f42faeecf87c6f19ccd058b0f874f0d5f4076c1a3169fac3f22ff4c34411638ee0d22755949ea2bb38f573246d21a2beec8ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2004be60508a7e89d2742603bd0156c1

SHA1
95f9af351493d776573187e008dd598694a772ee

SHA256
4b90610c2971a2c8adcf37023a04187b79f8cf2bfc26bbfc1c9ec04e02656d5a

SHA512
da42e4c478caffa78ab2d38cf820c36f04f64346f7f8bc7c8c6d93162874a029187fa09fe04de173f2366a578e3dde3398d92abbfaa8f98a53cccdb246295bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9608e51b7efc5c2e69a1578a4862c8db

SHA1
0a4ad3cabbb117ac3b3f3a844cd3ed6e0f0d2834

SHA256
b954e475e6008d73aff4a4208014ba00318d69574349095469283aa0137b629b

SHA512
492ac57b7fb6f78a9003a7f546e8fe8b09a02b5ff5209df7a89ebb794481be832ff6f7613eebe1f2fcad17e954420dde636ae608712275be3a07984bc392cd3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3909c55e3a3e8e43de039339d914933

SHA1
591d904e3c2678a290830d15e3f1b8da8d1871ba

SHA256
053f21b8693f3034392a947ce233f0fbdd81e026d040210341cf29012d6d6ca1

SHA512
80d422439a10aeb3ff9138395c12760470d148600cdae6f6283eddbe65efc17f5270a38ff42cee80dddc1ee0fae0e2d04962ade01450dc8ad82e3222ede643ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\ken-robinson-tb[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7928.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7979.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit