a1afd35fb5c1fd5e16371073dab18f07bfcc6c33f6affde4edc48d2bcc65c6ea

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38bc35f7b61dd4e75fb0175584154ffc.html
Size

90KB
MD5

38bc35f7b61dd4e75fb0175584154ffc
SHA1

59313c062cb50b0adeaf6d3f7e1dca40563f93fe
SHA256

a1afd35fb5c1fd5e16371073dab18f07bfcc6c33f6affde4edc48d2bcc65c6ea
SHA512

8cf1fe355239644f0a3e5f091c2e87b1bde1995b3f321d47439a8c455b7d57b79645ffd5d6f0e29ccff7d69b04c99a31f3683067aae16f6a3c0cb7403cb001d5
SSDEEP

1536:dVSI4nEu2WmRRqYIuVFwr6jfedyScDV12xwVKho5GjPfvYMl4Ip:unEuFG9Cy5DVi/Yc4Ip

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410618981"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\efek.stream\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000001dcf43a4986b56bdb8c87f37a8b41bcb37362dfb1067adcd5bab4cf1f4b43dab000000000e8000000002000020000000f9336f0850c77f930e96e0cfc9519bf06c4549f8942e7007e443ec428f129b51900000002a2b2f0472ccc941d1f0f7ad69d52b3f88407f362c1322ce9d92074ca1b81ac651bb4b484ea4a166090a89cb54b5bbab8e467ec84230cd4539a2abf5c3404c788b8e7241dcf53938a130b8bf2cc1c854c12c9a54debc9c77e304a34639e157656b37b88ed415a0b47a42f415f93c3d986610368e651fe5740a651ad06e5c381c8d2b01e058c077ca771416eb9356df8240000000c3b6215b9c12412dc3c0b71f67eed296101b117d1aafc085bf09bd702dff534f17d01677d9a7677f244c0fd0ba1c48fb8274911b473b5429e20fb0184919fbf5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80494041-ABC4-11EE-91D2-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\efek.stream	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10878898d13fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000fbb8f74af314d8b62a34d057bcfda97d5dd5157da8000f95983db1aa02b5c4a7000000000e800000000200002000000067ae4058f14804f48d659bc24341ee99b12a3dddac26f3f08a94659ba4a98ce7200000003df1ad34b2b73e933db19c93f245972c82cbd86eb5a3308843b282bf6b57d34940000000fac4d3ca2c5891a1db41dbf47b7fdd6432a3ae599845ba2b3b96c8e9b98c4b22f4df5054373b9da8558ad8f3139f511b59d21334dc201b8df37e5d85ef8071a2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2160	2540	iexplore.exe	28
PID 2540 wrote to memory of 2160	2540	iexplore.exe	28
PID 2540 wrote to memory of 2160	2540	iexplore.exe	28
PID 2540 wrote to memory of 2160	2540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38bc35f7b61dd4e75fb0175584154ffc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9543017b381782f041f40250ff3140cb

SHA1
c073729d28dbe764a00c7656724c2e0213c9dbfa

SHA256
05723e98a0cd501ec42ba656cb623e353006532921079de34cd7e13a5277e4d6

SHA512
8f0026a5a7dc3ed2ea33f9a1eb115081a110fead8bb2ab75bbe93e943cd5fbf4ed4de81df9a2e9455f60deac33b0752b8975c3e8b8da2d0b47c652ccdaf0c44a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ef65e04dd49673406122a05871abed

SHA1
c90647c3cfd39027efd39b65f10ad78ad5aa6843

SHA256
b104814c00a849f2b3e0080d3f1953f3e917f26d9ab0e7b5a31ec0354e496f3d

SHA512
3f3d51ac2419d82bed4da3b2dcd68d3e110d6cef5086015efb96766f46030c5e333416616fbb2d939e11ae02e6c5640ab8488931b43b9b39a893b2640903aa2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6719e7a3904585589322affb12b8bb81

SHA1
4fa8eb386e6754c41497f7d603ab8175eb9fdc8a

SHA256
977a7de03b5b4bd8e2aa912143455b32361e72ad543f61fda5c1e36daf26a81f

SHA512
03ab2327a9a9794467009d5011286de43599a741f15f3dc971e715522ad5693b3679a4ea8af675c31bd2705852224a53b18773e8b84e75eaf12a884094d0d6b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd8e7d60d6ad5cf0e3edd31f4a2a28f1

SHA1
818d73be0e578941ac7a82041fe3fd8cb35482c2

SHA256
20f5cde641e99369717d7b611790eca2ae7599e6014dd2d4b0674f7099c313ec

SHA512
eb6fcff3426faa3e6de7aba39970707260c3a5fec72026931cbf1d10d2a54e25e3a0f48d435edf390a7d490c8c27d38904cc83b633cd6af0bc8ccb262a499712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986f29a00dbc3b30a4c4a6830fb7d0d0

SHA1
5ff724146249f39bef7aada2f56abb2f28bcb639

SHA256
88843b584815d319c5554a4d3028e9515ba7f63e9f339313d3d9cdf3bb2fcba3

SHA512
f03fa97cc1e89cfe838c2bf2392607f2c7bca5b1ff08db9000fda34cc3a5199e5ceaf6f25c844e99bd4651710c1ce81f6b04248f323c5c508d80a53d7765733c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e6cc60fd4800ac687b1a885bb4910cf

SHA1
e5852788bbc9036eff32afe7a76889d01dfa9c9a

SHA256
5c03a58195f5cba39f83e114ad3e1ac55a883c4e755c5ea9879fc3e6321ff336

SHA512
7de90a237d01d79e5857549ab64a465c4f5762046ed3ee27f55aeaaf390855ab1a0eec82a3be96adf60e2855921772044a2d904359783209c01a93bf11914069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f91f28731b6689ee48e22fc8d98994b7

SHA1
39124beae10e188f3ffbd5b7d27ab0c6ae020052

SHA256
95cd9c534c3f3fe23d233f2afba218732b04f4753f30a3b1f770b8a900b2d268

SHA512
6cd45ba67e3194b2b5bd4a89c7ea6985628c41eb82a49807d59c97e023c6a8208722d952319b7d4f3a0056fb53a96a6f8115c6c4e0707cd17a9133534880e595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bee37b14addd91054bcc8101c14bcbc

SHA1
5f2526ccb14c353cd1beeebb83f23850970b937b

SHA256
ad9f49c4ff7c9b3ac38c81dfbb2614399d519de4aaa6011d8ca4ba65f2398b28

SHA512
7733e18beacf925f4f93311e80dd80d69614b846c864b2c3be5e1055b1c7d3491a3498b096ade374d3cdb46254ed0cf2e6ae1987b38d1fc921fe4a970e223cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8050b9490ac2c2e9493e923e606a1a2

SHA1
b3ad7299f86f8450230dea801bfd8b01ba276a97

SHA256
b3cbd10543cdf5e30c7c2d09f8559ff45c9f703790ccbadd515372c29d311827

SHA512
97fb77da3c37f78c1255f176cc1d5c8be85ad149db9230c248e79d1d47f95247472d6e393842188397cdb2bc499ea72c2b3a1fe5ad1dd962e63142414b7f2e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2144b08c592be2b4918ed6d45bf599a3

SHA1
34e1c50b87596cada4c597ce13a8a0a38ac04740

SHA256
0bdcc6fca0379ed40e60495b897e7b9451000926d02cb20bc787ccd86ed5369d

SHA512
96fb2a93e48bee8793550ff5d84d79967b29a1fde96feb048c4263a7881a198581c2c2d427ac851db78d406d6d856af7b7e070c0117cbb5b343613debfd43b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a9d4ed9efc91a3b824a41a5cd2a098

SHA1
979ac15d877b83c1b3bd7dba5884aef86496ea7a

SHA256
f8dc268b09d0603ea09401af7e66bb89a962c3c76b71ed2a668ffb96283600a9

SHA512
64cfd16fde4a5f15b407425ab895d7e89499e36f811bf28930cb9c8452ffe7d4702c545adf9b7ee4b18e35290d75b410d03565ea86edf61de51e9b0dde7ebb5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84fd98032efcb024ed12851e7ffbe4e4

SHA1
f25d8faeca876a8af422c63894b0bf40354ffcf9

SHA256
dc15f67fb9dfee6efb3ec7ba5cf2135d623c5fc65233ac1f563c77e20ae60d0f

SHA512
7ca14ff5a69e4fc2beb840dbae7e663c16359ac9f13c008dcd527178c9447be782fbe49b810fd84e0539aac0c7b6621d587854f4a7237302124a9fadfd5f4241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80bc490a6a13cfcf9ceadb65aa06e85e

SHA1
b0cfd2b7d63900b30d735e77a0e4a57e0184526b

SHA256
f853f4fff08a7aea16a6a4ad0eddb9a33fc94512653c88942c60064205183d6b

SHA512
456bbc08c43846eafca1ae506f845127b2d95459298df3267452dc2185ba36578668ecb2791945792acd94a23e23cd48624a9efbaba7084a99e92720c1c7bdb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70251f2045c9e705046f4cfea66a6ac0

SHA1
4ec33bb184618137034eae2382e26638d0d5c214

SHA256
dadc90963d687979994d61f463f558baf746fc3c76bf2637fe22a238bdd4a9f2

SHA512
06b89e222552a3704ae647503730b6190c3ab6bf6d91c7e0ac2ee42661a8352a8c35a179a3ce237211e316f6bf25eac46027451b7d961ab6d4a788c7a67d05e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e819560f5d4aef169a82b310215626

SHA1
090b372eb4b2a49fce3f185febef18fc3f99582e

SHA256
a337a612806030861cd5e52b9537ce19f6b2f67d4deb21c9ba89eeb5ef52c7ef

SHA512
d94e751798e15b2a6776a87c3a962c547f1a8d49fc8e1d67ae7e9991e6671d5054b82582459976ca49366b4c26ce7298cd33362316045ac0d7a9cc6d751cea52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\analytics[1].js

Filesize
51KB

MD5
575b5480531da4d14e7453e2016fe0bc

SHA1
e5c5f3134fe29e60b591c87ea85951f0aea36ee1

SHA256
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

SHA512
174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC43D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC43E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit