ae4598f4e2dbc044d3393f31672dcc9ffc1a852b61131bf63fc229f5ee25a173

Analysis

max time kernel
148s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38d00d3de56f79cae718ee582a33f4ed.html
Size

3.3MB
MD5

38d00d3de56f79cae718ee582a33f4ed
SHA1

8dfb4fd3477fd68b4632acf247767ba2a9787b45
SHA256

ae4598f4e2dbc044d3393f31672dcc9ffc1a852b61131bf63fc229f5ee25a173
SHA512

13ddd6f234150e46b8c57fe06cad699a8e1ce2119409fc5db3d4e0e7a6fc67429b7860602a506364b94a80079cdd94571c4e1f30aa6beff821a8201c56d39a57
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nlg:jvpjte4tT6Lg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000033661635e78feda7154e4a64e5d0305b8c1e0535edc77f2eab5d1866999d253b000000000e80000000020000200000000acaeedbde9d7411bac614105c51353a6452b964ee301ff4e9dfa4d7ac4b1d4990000000bbbcf12d2dfeefd08e850c27ed29a31cba8d4b1caed9aac3a56fc7a784697ce2ac93729e3e337fc6e943428b7d37d50987b50966399e36b6315d691c3432511c1a74a1ea2e534bf5ca139ed7766c7652a4db2f29e90b24a912df6fc1531bbd17b7e833e109c9c8daafa14be355e7cdfdf74455792015c51b2765b86956d23cc2e2654621f3cb056cbe22d9f99ea33160400000003ce51d2f5ecc65789b2c77d728ff5f979a1ed062fd460e7151934288ab4e9e35f666292c281e2c81ce8e6f08ffb7f0e851ac0b109be397bcd37aa18178ecef35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000f3b5d81369dcca952f3c9407b5322752ea8772bf97d2dba1bca9052a1b2fcb08000000000e8000000002000020000000012291bb870618d27c4e1901ccccb5b3fa68ea29884e09a05acbacab3f86bc72200000008b228003d9c7bfd7761ed5667ed9d3b6ded9e7b76abfe61f3b27f6d32cb9f67440000000916a58f507f75298fbd0e6e9b0b3907592dc4bbbe4c52506eb85d381040577bfb278ff109084c744fe11ce49ed03450cf47755596423405eece0e62184cdaab0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411077710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92B4C3A1-AFF0-11EE-ADCE-5E44E0CFDD1C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b10e7efd43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2040	2896	iexplore.exe	15
PID 2896 wrote to memory of 2040	2896	iexplore.exe	15
PID 2896 wrote to memory of 2040	2896	iexplore.exe	15
PID 2896 wrote to memory of 2040	2896	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38d00d3de56f79cae718ee582a33f4ed.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ce0709ea55c9a529c74a7e3b41c036

SHA1
4f99984f9602308adfee78e175c0c8a4e6585fe1

SHA256
7f3112181a9c6d6b625994c93fd947e617b71a73a6e2f316a07be055376e6d09

SHA512
c338ad2e7e500ac239cd9745c44d3d2e7ffa075114b7b774f22960b989e4f73fd1dc30dbf90ae3aff5a7bfbc10b389595acc3e250855717b059dbf21ca8c50e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aec4a2005f90b9b509f1403bcee4f7e1

SHA1
1ab6c17bff3b295c71abb97f91e6271d0e9452fd

SHA256
0ad32bf5d0282ca0330d05b8777dbf46ebf696c19c8adbe97ddff571edafbd23

SHA512
6da327e3fa5ccd817d3d6b2143f19805e153ee139f629c73d2b0485990653b318bc907aa5ee8a49bf500578f5f2d4a8e3b1cd0bed245acaa25b855a59ed147ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7622430b3304c33123da9daa618776c

SHA1
43e88ba36aa0b57221bca09e1e56fd5ecac6163a

SHA256
cf65445090a7fae0dcedb87d298792696e6a68751061d48b00592e5f6cb4aa59

SHA512
f38d4c23286cb01f54306fec34eea8d5624943bbfef8b2df047788bcdb1b6842f82508335d5d31c5281f5977830b3b00081731698f9febb4efaf2cdd09915d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271b4fc399f9fe1f0c9ffbd2a620af06

SHA1
c2b3c73db9b86d05ac10ce1a9f6791e5456b6de2

SHA256
a1ffc09ff2f117e94611a3d2a2b2c4a61fdbb11f267c3a11233c47906561357b

SHA512
23d2cd70a4130f4c1871769f42ed9b77571d01ee70d906c3d1b235400f2304a7068ca37210ed351580eb875740b75d14075592eb437ed7cccd2346d50915d21d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
525fd54efca69a4ad22de9eb5843935c

SHA1
f0af2171a4f68a3ce3074212086a8fe59140218b

SHA256
d70176d8d6a693a4f1dc012cf115547a4bb3ab4a8efb7d08ed44bd9dd5acbcae

SHA512
4d3dbc3dbecc68de81d0c4334f4ea4dac483b289579f4f351644829a4f28a4d84ba2292bf8a980ae3fdf1c2400291826a2b239b3b5634ac283259c518a372583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82082c86b5461def979bb699aec5c717

SHA1
5f6392d72f131b162e904a057eb381fca53e8931

SHA256
21a18e522403d0d87ac6cf653119529f53173b7053290033aecd14bb36dc171d

SHA512
93da677038e57828fdc525aeccce6e537b258fc4e25668a4e02d1d1bfd84477d530758582be408a39933bbba52857ae70b9340c38626aabc781e0578b091755e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c270f9bf5ad1e3da58960de52462ca

SHA1
a09c894c5e3f0a4a38c865094f692c2417536b65

SHA256
fd1983ba1e97817ff548fe63883efe30c3a0ca2ec900703c2fc8070628a63293

SHA512
7b1cf8f476b98d93702b1d938fc2677f8e63e2f6c4ac2e1cc77e45f9b159f5ebf00fc35fe50c2e558d78231c8c7dba707edd310f6b8e64bf46d225fc94f431e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
253d2c2fd50c8b8e297716b90311dec6

SHA1
5986f81713ef966ba998cc63f359628e4efbb200

SHA256
4392c511cef124f652029cb9b11e6c03856e9d287f6516b3213ba1a39f84e33f

SHA512
a8b43c4fff34d08c74116c3ba78e32977f6addc31e31e1499023d5ca542c47e7b4c0bc4ee342d316437309a93a07327fe1fd10263993c5a779e45a418b03d5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0fc970292e501c6306ff9fda39bdac5

SHA1
00cd7eec4312dc872c11fdfb287f9d5797abb8cd

SHA256
a9e5552e64225d0aaaebe4a8f632cb225ae6289d72b0b39e386b0629793716f0

SHA512
381f1aff81348a1ef1f9bca71f8dee096dc7e69079761b39306a77be842b23c8f1533114b6bea612333005cdcbd33089b1806dee72c593bfab6eb28268f91f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a089b907a07b021c7a671a8f9be80e

SHA1
8b7f2267bca7f083aa200ee66f3b4a595e6fd234

SHA256
7249e755f7d8124eb7b45084437e3e5a0acf35d2f68fbf98e598dd885cc84dd8

SHA512
df706cf5baf1d4e0221b0ea6a81d129a12558dc7410f554707b91952ba1d79daa00d164577a59d520b1276f70f459c0e91d0cd3cc443d5a60319bbaffeec2bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7091b09c2515e0a1e3e7ef366231ce31

SHA1
aa24d56b7acec0e0e840d1fef748eca33c20a710

SHA256
98b418709ab462ae4fdaac3786e38c3f7bbb7282ba7c6a5fefc2a8d64b0aadd3

SHA512
c8307ad7b31d6c254ce11cf7a5fba0476840bf7cc3c1a87305eeec81948c6ef438fdb7d48e1c17ee04f15398d6111fd8c7046d47d19a2ec5dd811b057825f2db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1035bfab44c7963a8ffef04ffbaea080

SHA1
6d65ff3799b92b0f1332b91a126446057451cb89

SHA256
6489db636593ed2fe726c00fd5563696ee230f2d58bd230c5d48f3706b6b8c5c

SHA512
cecd1e075e479ee1430aba08a71d5f732403d57817ae9a55d0d935a65d454ef701f2d77b5bfcac04103e23e43f368c43e78aa945edfb3ea0961bc7ecc1dc6276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e2b0f8eef8748a688741aa8a055582

SHA1
4c3def8286d7c005e5c8f49cc5729084ee720dec

SHA256
0dd905b6ddfbbd02df5f85e5bb6db440b8cdbd1ecaa7ca4de2354324238af695

SHA512
cd47e4a94738105125e1196e435b20930c48c09012c01a8b84feaa0c55577cdfa3ce48209be677798601abccfe439ca5e0123111466f516e4f6dd8fb90696fef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit