0b03fc1b7962269a604949e0c379e1e275287c6bedbfa844dddbff2617cc231d

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38c09b00eb086dd130b74c9ced5c29c9.html
Size

83KB
MD5

38c09b00eb086dd130b74c9ced5c29c9
SHA1

59c7bc00bcfe9b7f9f38343fc61374c1d896530d
SHA256

0b03fc1b7962269a604949e0c379e1e275287c6bedbfa844dddbff2617cc231d
SHA512

add69e2c6ffe5c8bc0f0b93b7553a7b8500ed7a6c113243dcb4148913c30e6eb7793bc366b75baa6c260ed48eb9fda4ab985cc9fd5f24707e3e060d475b39b73
SSDEEP

1536:IlrHuaSr7Q70NcNtxNSNeNBNYNoNJNbNLbxQ:IlbuaSru0NcNtxNSNeNBNYNoNJNbNL2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000064e8fccc176a2ed5f62c4a4bbd8b699d4e8430d5050583365ce9e87574ff1c87000000000e80000000020000200000009464b15de99fe5c753bdd9846246c5e4cb9fee3e90f92d7a91742b2dbdd10874200000007bacd30c963f5fd57a1560ab2eef3f77cee9d01cb463f2371847ff92ec930f3640000000b4573466f8f5ac5059a3527cd7c8852371b8f65aa1e487d970707eb62661aadb2ccbb2f790d77ec0a7473395dcec627a8b1097ced558099cae0f3d82d93ec5c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411077445"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10dc4ee9fc43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBB9ABF1-AFEF-11EE-AEE3-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000000cdd5d86edafd360c31a9615a0c5263fa689748a556a2c52527126f3c8d4db01000000000e80000000020000200000003c304b2cfe4af084250c07d7d2fe301752cf2610ceca19fa35302a18274cfcc4900000007e77d990bb95b95ebecd79a77629ca019a9faa7ece7c20aed7874483e722848a075a393f050feb8a889221e7dc21a1cd7f5eb476d6f3784fa208d061982b44c00269dbce6bf2336394af00d17cc7d346a87eb4504b6bfa649c5ddc0567c8cd2e232698fa6e6f22c3f79b43aec7d27fbee8704c992aeed0893e6b5adbe3562db1d659d9b4895f9387e3549ac16096b1de40000000e760fcd55325f535cb9cb2270ae9fe134799963fcec53e886b5ea0c8daf885d1b7c015312ba3edfe0fe89bba290c7a4224bdb7c92307b671e21301155eb29b36	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2848	2656	iexplore.exe	28
PID 2656 wrote to memory of 2848	2656	iexplore.exe	28
PID 2656 wrote to memory of 2848	2656	iexplore.exe	28
PID 2656 wrote to memory of 2848	2656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38c09b00eb086dd130b74c9ced5c29c9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9abccb669092048794e059f0cb3c297f

SHA1
b27cc48a4a3e63e0a18640a381fbf63c445495a4

SHA256
ea77439e9d310540a73cc76391317e00862c4107e3ef5a0d67ca55efdbd270fb

SHA512
3897e61557d12d01c26e291131e9431922cecb2ec60b33581ed46e933fd9926123e4de9eb5b404ef8328bef3de4753b0cd0dd9f3bd47b7ba67c5136d5184f4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_2066BB08297F715760972468E8DA4F62

Filesize
471B

MD5
1bf00fc684cbe3d5bc6c83c1cb18990a

SHA1
6c1547098c1119eb6bbf7d3dbf1a3c6cc4d09ddd

SHA256
93490b5d586201e41ff52656a6fa8204b476dd5f200a5646e94bb0a956fd4ad0

SHA512
619e34bbcd7ae44ec4551de3584f944f059fa9d72e5039a0ee79be3d437921341c5c74e879fd29d758413ee6573abcfff9ab515367a32011dad0abe893d19062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
8bec8e233fb342975cb900b95ee72daf

SHA1
53c61bea42de901c5a3a063e6e69c7cb54adc0ac

SHA256
d97595b3ee78703c38355c4c84c7219490d497a605c39ac9d6ae76240c3cd2bb

SHA512
089d280b0fe36377cdfd6f4daec1f2fab43556d34d26899df684fcdd954d8f33897158d56d624df25be68bf9b32d93cfc90461e535600dfa5dafe9a2d054cf63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810b38925f75b956c5050defc24ef542

SHA1
4dc0d18ec9e4e5cfd25bc3f75e8e5a161c4857e1

SHA256
f939bb364437d06820a7332a4bcf778283777eba68e1e9c2c4758ce5b5cf650d

SHA512
8a14c7d31338c68dbf36beae0de59a2fc7385fd7999b034a3f99f939c420a214712147d25b4ec55253ba1f444581c34dd6945825c79bce74aeca54c39d406f45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87ed588c9f6dba32e06a8652ea4016a8

SHA1
99dd83b9e7deabb2286b62a63ea943142446dbe3

SHA256
8b03b426b4b4627f146254cd6c3f84cc9112dcbc4faa43449319789e10f19deb

SHA512
aa23bdf9808e4b89bdd3d2918ab20ad2892f9b9752e2b460a1a8b258134a2a9d344516ff9a687c2d885c19a10f2875979a7e116fbfc347edce498909f5ecdc67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e59c33b43be15a6dfc169e853ed824ff

SHA1
548fdd3ef289ebb4faf9e337af3f980880189437

SHA256
29735b3e78e1e06b143fdae18e1d410cacc5ff17a969d049d64855a4aec96926

SHA512
f723b554a3a47d8a0de21d26a56f5a97d616c6e9cf1f8b4097531c6e51872efcd0c2d81ab0f5fbda3732a539c559ff9c94b48d6fe7957c92ec1be805b4f1013d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
413788d226859c7bcaf8c58caef5d192

SHA1
d7b4d33b041e6b8e638e86b97b85a607d167e379

SHA256
2d89d51333277aa6186fbae17c6782a0c481ac63d47f2f7c328ebb8dd8392aa1

SHA512
8f871d7864fcb5d6bf9dcc166723bd07e0576e4a1571719055db1a9a7ca0bdcb96ccfa912f2616bce79b6c202a234a5ce992872c2bdd981ccea7f9e3fd251d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fd3a74307f4e3dac98213ba20a4ea24

SHA1
638e746799f781f0ab7b6040d825965631b0e82a

SHA256
71bf70328919d9ff795976d5639c8462f63dfad6b6d51e4958e6877c2c4532a8

SHA512
416c26f226af19b6f360fc5a81ef0614278008f278206034c2edb802f25b63f8a112c30e3e1405cfb471f11073953dd992f92698ec31fd794cf279705e2e4538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e21f6b656a64eec19397967c9367d0

SHA1
d0c1a0fc00814c39fb49d5a85da0d70925797d43

SHA256
e10fabcc7bab703ab966ffd1cdd341dcdcc1ebd29f220ca4dd1cebe548bda245

SHA512
a563a936018ab3b78aced09725e4f3e14744bdc534d8ba4f4dc18f30d8c309ff2013bb7ea36f962b75312944dc57af465829008a587b75ed5c923f135f07c05c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed72698201a32a1187d5195652fdd2b7

SHA1
cff88d3f9837a9d37d75e190ece042a5c0f44da1

SHA256
db61d27406add31f3fa7f5da74278be24d9a13492350b8fa3c18dc08222f984f

SHA512
1d08ab4019d2a11c424bebe607c98c19c61a2e362eae4d4831fbff760816f7bcc748fa8457dcb531747ac5c638f81238f0888ef292ebfa3ba9cd3bd60a6335ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c444b8fee484610be866e0570f1c7eaf

SHA1
347629a8edcffc99d74e043e84cac28d5ac6ceb7

SHA256
9eee1b2305cf6f7156a20aa859a69cf06b7f9c7e6671b029e2a2b0d330e67984

SHA512
cfb8854fe7e475c843be97daa85ee31a9c49cea373550dccef3c93308245f4b6922fd94866dc7576f0e4081d99b3661537982021837a604ae06a104fbb0c24c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b952c2346888fdeb24be62a6dce00b76

SHA1
489a9e23bee8edc3c9d8f1841a8a8685167286de

SHA256
a444c1b3a03a6b85a977bf7b230853ea80b68776f50b6392e94ec06a7daac53d

SHA512
3887d96bf4c723084aebd4f97c96c3e1facdf119eab7266e08b8f9e03ecad3d75c02d4d5ad9798245b6add77e02dca6cb9c2b9ca6d63b84a2031cb9ab86a7b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e95e52accb913272ada842b212c84c67

SHA1
fd4ec7116eecaf4910214365cd85ed30c3131813

SHA256
74fe32be1f0b8c9f868c124288dfc73f9b2ff3f9f74e2b1e836360e31b411bb5

SHA512
57a76258c0bd3455bc8cfcd53c3f9e05191aab855f8ecc463f54421c0d8e748bed4f86dce9767f4971b259c18ce8648649c241015806b7e6286685ad6810c6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
b9f17b0aa226eef85102afc8ae8db655

SHA1
343564d5eed6bec30577ba8115d53acaca5e810e

SHA256
b5bc3f925a394283e6bf5b19f223797bdc32c1583df512fce0150859f2773d10

SHA512
3be56b85989ddf1521221ebc05c24c974e706a97f2573288293eadf75026c7dc96386c0b39cd76175d47f3f24258a405ad2e0bd4881f336fa1dcb805e8785328

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit