e0583f91f5caabd1ad28aabed5375d8b6084348f9d44aaf74ebf59f4ee81329a

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3752579c8a34e43b6f8fe5af155c9103.html
Size

6KB
MD5

3752579c8a34e43b6f8fe5af155c9103
SHA1

279c6e2166f3c5f465215b0d4a67300663b93864
SHA256

e0583f91f5caabd1ad28aabed5375d8b6084348f9d44aaf74ebf59f4ee81329a
SHA512

448fb82d24b93c13c59b9e49bc78d52b12414abbd9a5ffb10a2562982ecdcc04dc9970ca49858c34327183a181a2df6140e16d741bb083a733a8233d5298fb1d
SSDEEP

96:uzVs+ux7p0LLY1k9o84d12ef7CSTUiZcEZ7ru7f:csz7p0AYS/lb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b2e8d7e4e0e4d9b5f4749b55b8a5ba012b0c34e933d48778265f41cf1ad91072000000000e800000000200002000000068eef5091525c78e8262cbd910eea014eae47efbb68c76fb83459996e52bb39d200000002837188f54cddfec37bfe84ddd4331dd847b33cbdf80b5a8fd4d511c96a994234000000068a02f2de8f76746d7b624d480dfba19dee3a58f776f1443143286d2f7673d58d91947222a7f3a2e3b3284f95b75d34c39c4c5c55c2d309dac997df87a966611	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000003dacb1c47e17d8d6b7de61f126d92381e6b1c202f29cb6099ab021bc23f4e6fa000000000e8000000002000020000000a244a173573788755895989efba02b89ad37b91330d12a556989d22cc70e6aa09000000072361f8cbb328325f0b222a000169ea10f1dd1e8aa4a7da94285adfcdb0c2ef2e9f7a328942689ac669f91489c2bb0091adce3bed1b86091b52bf2d2596c89c83e5b8b74c658e484f549f582ed90c58011b64f52147fd0d2e44686e968607cae236e2b1dab05e4284558a6b48a28834031eb9ca8e77bbbaadf3fed2cc5b50a7bd8aece712f03cfdc46f5552a102e6dbd400000008e2ecdbf6c1f993eb7d9de05e1402cc66bf38ca64b4b7ab89b5d5183405918f070b81115e6ae2eca4376f58308d94b9defba84e26741daa4114327c750e39e29	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F67C10A1-AB4F-11EE-93E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bfa5d25c3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410568913"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2812	2900	iexplore.exe	28
PID 2900 wrote to memory of 2812	2900	iexplore.exe	28
PID 2900 wrote to memory of 2812	2900	iexplore.exe	28
PID 2900 wrote to memory of 2812	2900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3752579c8a34e43b6f8fe5af155c9103.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e64ffbcedda6ed05b027fcc017a35410

SHA1
c74322606e5c0a90a52e0e84a593c5957dd7675a

SHA256
7db29d262f7354fdc0088a8da81c80dd556a3365876075c2c4e85b5458ac1c7c

SHA512
a447c99f05b7355a533b3118429a7e6740e7ba02366b731456c777284e866cd75466eb87193f639b33cd6d0964cffa37985079d46a73f15046d2652d5809ece5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec8b899d59ecd3f7b15e4b72e1b1cd91

SHA1
09fc2fb6e25d9825d1a1a1736912e885079598ec

SHA256
0f5549588ab481f8d3cc6999879c7382929a6e8b9484d7cb7cbab4f15440b5f8

SHA512
4166b4edf8e5ab4ae0e02630b1d9905f2985be71231d7d9dbda54ec683fea83cec929e16cf5d76189523239ba7c2cad25e1208d420946f861c79c8a95c6f0512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d499d0fb706e62421659887b61af97

SHA1
87d9bd4be63510ffdfe9d5a98de9fee716bba361

SHA256
ec91e9efc85aba84cfaf0531a85ccb3e75fbcd3f6ae767e7479c9c4a033083bb

SHA512
7c4d5b178a9516d217d454ccf9c7f8bf9b5c0429b426c5ca2d8162588b4fef2e0d5cfdf38f825dc473238189caab60805b8b50b4e4768e4c19109e1cf7a48dc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46aa72b9c3c176d05bdb6fbaa7154915

SHA1
568213a5fd28c2f5a882a808642e7532dcd7ef0d

SHA256
5abd3f4770c178f2a3ca2bec8be58ac5b64378c2a4553a4c5b1b2db48d1c0c70

SHA512
4e78ef19e7cf45b245a9714e15a787e99fe51da3e5cbf159c5c381ab1f5c53cfb49e2bb74fa9a70892a9f2f6cfa6d2324d8402ecff3280d573c9f4b2d5769e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11c37dcb5f928708f0e87e78b98f6595

SHA1
b8cb5fd1874fb89789011f2f7ab0b569b03bfff5

SHA256
fea5bd356beb462a66282d3b4a0ef8265f8a2feb5a691fb80812d7f8b458edd7

SHA512
5f87c1366fd301b26b22ed8a7c83828c667fbc51756fa7e1487655bad0328fbfc1923c800bbe57309b4be7ceb5b533b53329c69e79480d57e8fc69207d6f682f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e39aadca9f0a58e668db0c42a5af30

SHA1
72daccaae418442585595668e9d32c0c46b4feff

SHA256
79fdb729a799362043638a8d20a37d9485cbf8016b4497d067f24b1058ef07a7

SHA512
6a7326a864b8de53451de06bd8ead888417cd54c100ac9497ff7ec5b40ff1725c3a49d1dca88b4d457a6d745c9aaa29533c513f0c1c4d41c94274acbf3ca5241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6151c953070b0b8354272ac167498538

SHA1
c886b0445f8f3fd0be33fee2425f31255e1fc5f5

SHA256
5ba1a6fa6e5375c718a3148465fbf23f32da8182da52e8a85d5685b991e4fb49

SHA512
565d72f33d0806e45dd729a11791f72280dfd99cc7f69de99496f11e347e8b9bd07f912082cde9104b0ca99e73902f921910e997aca20a51607e926362afe87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9cecc7fc3ea80ede7f80d6e86c741a

SHA1
87b8c6697242f3d3269576bc5209a82ece5b3a7b

SHA256
f4d61c1519663dd78633915a0aabc886b881648066fb6f2cdf0179acbfc27854

SHA512
6470b800834bb9d694cd5f4da336f7ecfb15221eece9f9ea54ddf158b5b651bf7dc53409329afe3ec8fb533a2ea25a756832dd67aea303c405df228656557947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f85f3ff273e6a61c8f27ffac3dd1da34

SHA1
06376f1ed087baec158b842f4c01bd8666456a6b

SHA256
bd548248e4989b3c1d87bc9155e271c6085689f429a04338c01e9b706b2eb0ba

SHA512
2377fb757037a60b0514baa0b4d466b7084536cbe2cdd71cc5063c39d976263a01d7438eb949d3ee44017ea8f899c0fa95b973db3091b9850ca68273f58d992d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ba073e060b6e46412cdbe1b30667c9

SHA1
98a98b7a8812bc088c7acb1e390cc244c59d2329

SHA256
edee8837193f8dfb3d830f432f5bb639b607e044dbbc909a0e346acb09915661

SHA512
b96bb3388844f518fe7ac04ba9c0c539ab54787b3bd9ddbc1c8a53280f76a8845415004e7d9b715476455f5151f20178ce9b945e5287d7c22417c19cac050145

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabACC5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF77.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit