902858ff8abc4b1d010b9a1f5d39c37e70ef4e7a0f1a0bf091388c62946283de

Analysis

max time kernel
118s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37732931f1c79fa634ec25c73d0a4ec2.html
Size

2KB
MD5

37732931f1c79fa634ec25c73d0a4ec2
SHA1

3311cabd18b4e8067c01868fa7964051c671fc7f
SHA256

902858ff8abc4b1d010b9a1f5d39c37e70ef4e7a0f1a0bf091388c62946283de
SHA512

97480a5f7cff2f22d73ee07b3e8c04c174278910d118afbe51db956ef8ca2c6925ef5b6a66bf42ed15af6e3c3fb3cf729c02e732fc541bfecfa30eed6fbac44e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 206cde64653fda01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410572634"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A01BFAA1-AB58-11EE-ACEA-62DD1C0ECF51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2248	2496	iexplore.exe	28
PID 2496 wrote to memory of 2248	2496	iexplore.exe	28
PID 2496 wrote to memory of 2248	2496	iexplore.exe	28
PID 2496 wrote to memory of 2248	2496	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37732931f1c79fa634ec25c73d0a4ec2.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
effabd5fe7142a91702a4bf3b1854bd3

SHA1
7739732eb0e3fa7b2ca6fcf3af30617a89697c57

SHA256
167797380495336296ef2dc7f363a61f3f0fab75c82291352b783b6b49aa80e4

SHA512
0c1988020af05920874fe845dfb9903a6361493c006b533cd8faa524d9a79247a1511ce98434eef57f95b0ec3b69043cb9c2ef23a4006ad3d0dd51b6382bd185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c427068a675436b08b9383b0e45c05f

SHA1
c5799f65210c0213237ee2895bfffe36ca887dea

SHA256
378b3a811474e04d94150dce3b0574ca4b13392547aa25e55e8cc9617b6a1087

SHA512
c66de350a7e9decd1128f9cc3aafbca6a2c968b8b3c916e1ff8a820ec1609086d010a3fd77a7e017383c6d8ca69df4282f639a171bcda6a7037b811db077a36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5f8b6a2cde54f8c9996fa96f25d6ff4

SHA1
0575005546b5fa16a46bd47649ad113b87cf076b

SHA256
4a23536b8157f78fe6858c0c4440141fb03aab488572e7e69aa4dfd4a2947c67

SHA512
ca2584b3ba9b41864c922bfb876a7d561ed5b7d1aa7dca78fddc0176535db76a82d4c1911d4fb417ee7a0efeb060bd325b336d501325ffb7c047d3ac5690343e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e30116be4c1f427d2d66ad3b7f900d

SHA1
6d4488735810120ee87bed3edc1e630bfe8291ab

SHA256
5cba52a431bdf3b47c4425903b09642e0db597e8a4cfd82da91493137f50f05d

SHA512
b3d572aca8d79e974b972d7734b33144150a4c57ef3d86861fcf31ef589ff01102aabd619c0263d9f3de30907d129c7b2b3ae7448a23ff716ba714215003ec10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ef03e0384a302fdec49f24df418b4bd

SHA1
90e577d804e3df383667fc00f1528aaf89c4ce0a

SHA256
81d92b72d511f3235f90c034efc87e5acfd09bc19ebb892e583ef46bc67ad431

SHA512
07de5a869aadc8bbd952846ed23cbdaaff50bb80181f7714b58a12415edb979a232186be7ab1e80066a66086e1f2c7558d7fe57e45b6550771f9622986c0aaf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbd5bf6b0f266ac13f626f22d805cdae

SHA1
1e3d134b5d3f65d65df1cf5dc6036b24bfaedffb

SHA256
42da374f9f067ad08651089219c22980d10ab562ef6e2051a7abdffe87150c2f

SHA512
7765c9d78a0a538bc483f353231c2c4c7fa2c64ad98e6e15518200cf5690a1a249c7c062b05ea001ebc6cf855d7d7f9cba49bff05303be9f573f3d8e0d9c1b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3d159f13ce6dbbb0b0a4f7ccafa6637

SHA1
a1f5f394c19ebc74415b73b7c659160d571732b6

SHA256
8aa559a24e669836563ebab0a6055cab7788bbb0f7ae15c934db6f40c2d2f2b1

SHA512
41d3099d3c428a4054f0ebd199b71ee67b0d99d7e8602bb295c9fe32300e8db4a463eb31b9a86d8f859fb837c7b17e5aed8c80a3d75572ddb9620457fee2bd2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8e71acf1d9b0d3479ceb5ccc9b4d284

SHA1
5b6c7f1a2f2a314646991d99411e0aa8eb4dca3d

SHA256
7a0d6ad2ad9d77de96d80fe109bf631fb6dec4d2d02665b8a8721d643f48d0ab

SHA512
8ab0b987aff355f4cfd487110f14e2d869f0f23941b684c085d4efc40107d588dd8b0eb0e39b92b54b5f4f3d7aa8e196de414b80e7f18f076cc680b1f9977124

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9BA5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA04A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads