424746af0515ab963b956fa7e832f757e8f9857dc1c523d720f7016c97ea3be6

Analysis

max time kernel
156s
max time network
186s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

368856dd9aba21154a4c61e0a06137a8.html
Size

4KB
MD5

368856dd9aba21154a4c61e0a06137a8
SHA1

bb3189c25d0f36ea93b1a88fb5b727af7b3cd795
SHA256

424746af0515ab963b956fa7e832f757e8f9857dc1c523d720f7016c97ea3be6
SHA512

073ce10bb89d5a354ca65f9fe74c54a2abae55c79f4ff1c3791f7090c34e4b4f19493773f701e53429d25e4784f7eacce12445f053da9d8c4d0f3e63068013bb
SSDEEP

96:0KqpWqtWVgsyf7GFShgJGGti9uzlNoQzOTlnR5UwK8cdHKONMQvNN:DqphtWKBfqFShgJ3i9uzlNoQzOTlnR5q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000c6936d543da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411060415"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000eb11ba21546baf462ba9788e3addd6e85ca3c28dc098fd637734ff721fd80b56000000000e80000000020000200000001ee85b95038071bbdc20fed6909f1920a86cbc1204bbdee5c30ad8630e05b11720000000f365db515517b550841da24a52084eecb42915ba2cfdfb459df84bd018b76b6540000000debc33651bdd1948b4df13ed7f8bac9d8197dce06f33e2fbcfe1df5ce0faa4e916590ebf6aaa198cd04230fc2aa1a277f4b5ee4d52bd5849d9ec82e1411de12a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000534e40435f3aa335a04f5fe56e013059fc19596998e349c876a6bf763b0bd5e0000000000e8000000002000020000000998f6ee7cc15d2a129684e76e52c3167602c36662013d6756c310e6fb0aaf5d79000000003e27adc1fcc87afa7588160643b4f4678432be6d58316228011854c7841e19e937f7418bbbb10256bf8e393e43b6fbd359597ca3b145e4ee37189995bd322e1654f924c1a390ebd2a03b26eb3f6e34b04f5e374e6f31f8b86db1524ac5611abeeef6c39d79813eb7c00fb03116db8affdd4bf86007e7361c9ed5200c4a0055e198f4cab905d5ae26a52a082c7d31c0f40000000efe23c3147136066a16d87983eb6721ee9294cf1a0796892d5937363af12f1f5d7cee203e9bf60471c449387ac790308e0a948e9b91ebdb74c412fc43251896d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{536DB9E0-AFC8-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2564	iexplore.exe
2564	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2972	2564	iexplore.exe	30
PID 2564 wrote to memory of 2972	2564	iexplore.exe	30
PID 2564 wrote to memory of 2972	2564	iexplore.exe	30
PID 2564 wrote to memory of 2972	2564	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\368856dd9aba21154a4c61e0a06137a8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8610a1c3324bd807fcdfd1d2a4006582

SHA1
752df7246332a43213a35c5beff1cf94a6b9d3ce

SHA256
7b7bbdeb1c740ac7879f5438a40d5a3f466935f3c01e1e08b60f89a416913b66

SHA512
d95b9c8dacec187f17e320b066d180d64fb8cb707d28cca2707554e76da3ab7ba14d80e226a38895b761fea9c6b107aac8c1d27a92b904b3068eca0afa75da6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7251208bb1ab2531367a4936ca752211

SHA1
7de240fdee675ea79c3803bc0416977f9bc9d913

SHA256
a63a60fdb574aebcfc3a13cc745c7d828c2527f26788e6f0c21e7928de20546a

SHA512
e805f337c7633e307970e2d8ca67c2c669bb93f42dc861872aa638a22db47affe058f908c0e6fc8e581c047f3faa7976b532078401db021dbf9ad22ee222fe3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ed8425671f59bdfaf68e497adf2bc71

SHA1
3dda8fbc74c058d3c1950a4e6dc027d8618fe43d

SHA256
0129d10f185a259ced6fedcc94bec61f3154aaed0a03bcbba7b1d404d7dbc371

SHA512
af011afea9e58cf81b4e815a223927a4186bc6bb6c5b86df48bee254062f1d5d5d56abb6b5ead4600f7611baf31a1e53b01687d6bd5f265bae57955e1546a001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26584bed04648a221ab86e9ee97f298d

SHA1
4100f01b08082631c9fcda80d8375ddea5d0b56c

SHA256
6dc6f9ce935e6a582aff985341ee51adbfeffc01a4944fff693afabb6c38ce02

SHA512
f6f9041b8351453109c5108dc51de963afe0f723e53a28e658a624997794b835649f3544a3a3ec73c3ec1e1434a751aa1baafd6144106d5f5fcf5328afaf787d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2de9f17ad09be4444d030ec2d5a3219f

SHA1
b1c82858446ff34cf70f4efc395488ae333443e3

SHA256
56909ee6ae3d596ebbdcccd0c8869b71482ac3e14bcbaf4bdde13c4d9e6cfea9

SHA512
9ac304cea3d067d7c3439d07ef124bcd0589679f0b179358a5c263d7af0a1e8b7de0dfa1dcae1156014779bb89754dd9bdcb540adb0a76eb753d0f14e9b24621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fd0c81e5d43daba3d082c81d43d231f

SHA1
177c499d29bc043ea1cf680b86a0c57d0ebb158e

SHA256
abf7f2fee642bf9d974d6dcd99965e648cc97790b5e850fe2f9c3e7134b322d3

SHA512
786500452260dcb1f8263edeeae85e8636c62d78b8a36667dd461cac04f0263049e607106479fdc04509f8580582efdf668dea7dcdaf7adf15a2b92e12c0fd23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcbb1655ad79bf7b3f6ae2b9f1f06875

SHA1
4d3dc5cffeda6b7411bdc476effe14d6384f6c1e

SHA256
c3c12afaa61c9af8654c03974a708ad88dd90a5c16e3b49e8385d77f8bfc4112

SHA512
aa4978fbb36eacf53af7ac117ba5860711c316b5dc304e5b1017666ea3adf254b823ebcac7f12e823a15c797336d4223cfe449893a20f720d72d2d8c3582118a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9539b61a12e7db172f203f35d37bd009

SHA1
8d36cc77f48aed5dbdf390d3b6b8beb6dde055ec

SHA256
1fa4a983e5ef271421ad4807bca242319491b0138735d7d16a07faba74bdfc85

SHA512
56e8044cd66bcad83d3f65d0554ab8e5047524c010114dd8ddf074e28de03c85ba6150ebc9899351435d902caebda826dd2cfab0f67c0e0037db3a65788d03c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7585850914e5ee8a90a12ee39ba61f1

SHA1
de4c64a2a7a4ef549706921e266ce98dfb0b2cc8

SHA256
1cae31380ee29579a02bdf3a710f66770bbacde5c6431703a3a7184187d02120

SHA512
7d6e854b434a278a6aff6f2adcbc7987cdcc20a1ef8bdb200018356191a04e9a9db1271747bf9865fa2c07a125e9ae932f4d4d1700365263cb74bbc5894e7a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6334f05ea7b2c1e9d4092fae9bdc914

SHA1
9d779a40dbcec2f3e3e17faf941e306b61d8f492

SHA256
23651bfc9a8ad89349798c2cfc7e819c8273d421558d42a7dff59861e4035ca8

SHA512
a1af3ed2c715efdc897cfc2fc7ab079273d51a0d87d47f678bbfac404550a20d1b7ae224e2826af9a7eedfa28b4346dca98f152f53a887ec88abd5aebeadfaff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4b90ed243e573431575b3e028a0d5dd

SHA1
b215b7cd0f95b6f46a06f21b4cdfc6789f3f0018

SHA256
46996a4a362fb6dc406cd2f3ccfee41f657939663886a6aec6729d301ac41449

SHA512
577415c150b9850f3c76bbcabee9d989e8384c5677822464ce6be75c46f08a8115317ab2ea118e56a83fb7a7e9361af29ece7110cdc53f64dc108bca4d694766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed0db69abe4609fc455cf935b112812f

SHA1
9bed87ac2c5f796c029dcd3911715471b72b31ba

SHA256
a3aac575508ce48b60d1fb0c78d27e48892839ef5f376179af57cc928d086e86

SHA512
9bd06da1e184dde41f8f82c8a7ccd4042160ba4210cb37ca536d961c8a0b4823d1667f183648fe60e139917b89a73cd2546cf2de40605ecdc7f27f7296136e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58CB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BD3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit