5252a4aea9ca8fcdbcec568d3a8d15a227a12f4d0e2194a71609095cdfbe09c3

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37054813e3983f215f36cebc8466a5a6.html
Size

83KB
MD5

37054813e3983f215f36cebc8466a5a6
SHA1

0c933786915d64e11bed2c6128ffe1566bd60b1e
SHA256

5252a4aea9ca8fcdbcec568d3a8d15a227a12f4d0e2194a71609095cdfbe09c3
SHA512

c2057cbaefd776a2429ee7ec278f494844b853a38da899b7b0fb1a173497b36b614c6bfa483f8ac83ee18b68de0dd8ae9659cfba3b1bc9812f333ca0a6296a40
SSDEEP

1536:JMmvf0pJpIqeRwXOXcXqXWTGXpXiX9X1XSXeP1hix9J09V2KVsUEq+zl39bMRcD3:qZs0BP1hP/+zl39bMC1Jws6q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a31d18dd43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411063797"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004e55133933a1df72698024aa7bca7917de609b94f369a92cb6b66bf620802e2c000000000e8000000002000020000000c11ad08f291212b2ee6b82cd284d6c80e5de37b13a503d31aa14d45fe6912559200000000d38c45c40df022a8fce6359992030533d35ed0d22053c8281031e1772cf7eb640000000e11fa488f23dd321457fb127155bfd6b8563aa0ad3ee6c5005b37fad834a94a1e4e5717c232f5b0b9898c2805aa0cdd17411fe6764e7b88b2dfeae53c6dc97e9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000019e9eea26675334701e47f436e1b8c7a33a5b76be7ccab58c6334d43ebd47734000000000e8000000002000020000000d6277fbf87b22039e00009dd7a244a606091e9b75ece2d0387c6898a9de7936290000000621b22d63738e60d76069273066d2e227523f4d02487243785cfb394d19377796a9d323435772fd3d5605d9105d686b547f8795c83ab0925732dc44522dccaa08ce43b8273bfae81a80da7b0181852bb3fed56265c84d4ec6b85f3c502cd19a4de48fc9d3860c79d749bd9383763f2e1b9a912b50b13954728f8cf390cf84624f262ca39b56a62c9e2ff735dab76579440000000038578fb6437a22a2c160650d9aa1165f51e14f47cef1d4fa9faf841a72a5f9d49195fe971cc28e6737637bb0079b8da4e2a96eaeb777d57ebc6355cdcd437c9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33D9F321-AFD0-11EE-9C0C-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2196	1652	iexplore.exe	28
PID 1652 wrote to memory of 2196	1652	iexplore.exe	28
PID 1652 wrote to memory of 2196	1652	iexplore.exe	28
PID 1652 wrote to memory of 2196	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37054813e3983f215f36cebc8466a5a6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71C70614670097554D7953CB67F56C78

Filesize
471B

MD5
aa9ed25c989e0054a959737975a8f2da

SHA1
572134680c523abf122c7f753dc8f856390f3945

SHA256
bb7d27d40fa5644a066d431bd5e8c4fc1b8fb4b26a3c001de236b8612457800a

SHA512
a17ce40dc9c870024909f806d558c9dac6f0109e583ef97bf13b34b9c6cd0b3fb5cfa9ce94dcff3a376ca9c82939dc891cde1a5472c5e011618a6724d7a3ff20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a0f3def697d33b73920eeb26c53ebd4

SHA1
c137228816b513ff1cf75acc44d1384d56ed41b4

SHA256
293ddb1df487d301b90339cfa7ebc10116bf36579e185e1395c1b3141d1e1297

SHA512
c986282d2288b0fd5d6e87d959e320a04a7102511415df101b8ec74433d57169c13e9e8ccc30af16c41adf385cea1dfd6440d58e2860673819a8070295bd4e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34d17ce7d52cdb85cb1efe6e0cf7e9e9

SHA1
aadcdaf19d63add342019be9ae5c3b4334df8b1c

SHA256
b26d0cb1a84a825a9854d26da7e4046d7675d69e88b786770fcaa664f833c504

SHA512
9f07d64545fd79b16e8f5f11d523e00f81ba1c7f3b3268cafd0b44aae5623f8f11b40ab7f5c19cdd21b100ffbfd3cac72f20a3394a341c8102bebae7c5ef84f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef088ad1d528cc6f70c21ff7466613d1

SHA1
4cbea42fe5fa619614ae25d8dc172a8780819acc

SHA256
9d47ac6d7fddaa01dbab0735097e1bacae34a60b45952452d73392e74ecff830

SHA512
c78e87a2322c058aa43918ce7cd22fc8251ab507ad7b7a8e12a4fc17f1e0335e31b0df222a79ce2724fdab706838036a62187802f70c7fe82933e643e92c47c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fcd85c2a666e66f06324572969016e9

SHA1
b6683981abbb4ab8f9debd84e203e9ad596740b7

SHA256
07da09626ce14ff639be80cad6cdb0c47ba434675c10c3b21a5e265f5a0d10d2

SHA512
fb33cd53a57f766640d29940833d4268f462d6d90c05934009e5586818cbeaeededc3cbf0ff3961bfd066ea51f06a0cbd1352dfc9f7fe22376da821115e1a9dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03c40e44e267832716c49717a37ac932

SHA1
fab08961ea04e287bf444aae3b70bae46b0808b6

SHA256
91ad10f70e748a54c5045badccfbce156a82bdf811ca30fdf63bc843f0c74ffd

SHA512
528333983ed4be2aaa5c9ccec1ea4c5b445598e7ab556453b4a495e8d87eda0166ac890ebe37310a69c7d6dc67504b2a50207e0b27270f4cae833e933ed17ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ba54bf4224c9d470bea7faa333f8e5

SHA1
48af94df62a9bce754906f795117c7f70030b598

SHA256
a5aeaa40255994d7a3d13b1a4fddc340f00dec9dcc116fddb583411e79a75f42

SHA512
574132dc96c8dfeea475d19ea1d2af50045226f0636ff60bb2912aab69de2beb2e7b6505cfe91cd7554b2973deaf0b59d28cddbba10f1de821fd079fbe72b334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
248e1beee3943f482ebce29ad10c6e26

SHA1
734b6c7542bf37c5982ce36ff091be86908ac17b

SHA256
332c779ba45ba52b1b78b55b9b2b6e3c00395dc07c42d5c67b54363d26efffef

SHA512
a00d2f7179c07a98ff175d814b388ecccecc02b873f22e22f5d06414a4c2d8e283e688566629cff2908fb5f0eaa446f54beac1c4dfbdcddc856d90bb2ba7dc57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34c24ca7342bdf5791dac7b521ae6f62

SHA1
1152a50cebd37ba55df322b46a463d0b4653a9cc

SHA256
74bc8cb26013a724ff98abb966314596d56c1392cfdd163cfaf017b41d2e5e26

SHA512
936b68b4fca5f3a0f973432aa3391def2f42de72a307b2684667400c9e20bc9b098c5bdb23adb471d5abaf6c4b79a262140ab930d22ebc436ec0818acc948fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eaf0aea90fd2dbb3e2ad5776aac789a

SHA1
8f91813227cfc20d7d6c05cf6e01fa2c995a5619

SHA256
91dc6eceaf7878d29fc149128d51b35614323a8cae3e6499965c853c860a66f5

SHA512
ae446cbaec5ac37c0a8fff68126b0a9723d1529a34b6fa0296364b82a7b5381e0a098d739a91ab6c51fe2f2f98a6903af3299fc0131229db30378b181e2be865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07454349338a4d3a36ecb040643d29d2

SHA1
d5ed74fdf7ea4ca9121a3685ad405879bf63fbe3

SHA256
c75bc4ef73ddd42dac3dd71acf193aa1fde614c2cf7bce3aafab64ae712de6a5

SHA512
d23b3fa1b8bdd3375fb5431bb04a9e56bfd9b769c8b3e92f38c45449a83aa82ed890eb130afb19aa61d60c3959af54f8307a416ba2454d8c183240d2905919a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2293c4d7c8c5324b21962522b26c6af4

SHA1
4a5863801ce351663e97ee658f795c965f3d92fe

SHA256
1ba82116d51f4dfe04ec128b03962c4043d548652047aa9e21dfef4c21faac7e

SHA512
75f70af614f43c99ed482247cb110ed0e06a67db2e6fde1e41b178402227cbf7346b66311bbc8519f135b72fe8f04eee70b7d62143eb5339434f6f14dadd94cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\font-awesome.min[1].css

Filesize
30KB

MD5
269550530cc127b6aa5a35925a7de6ce

SHA1
512c7d79033e3028a9be61b540cf1a6870c896f8

SHA256
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

SHA512
49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14BA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14CD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit