92c0ca4633b3371a24381ade7d0fbee5703a9187680e6dbf5113b33c983d27bf

Analysis

max time kernel
122s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

379de95470a3d753b746c8fa92da1ce1.html
Size

2KB
MD5

379de95470a3d753b746c8fa92da1ce1
SHA1

ed4662ad1dd79cc43025b20d37c86f8e5fef91c2
SHA256

92c0ca4633b3371a24381ade7d0fbee5703a9187680e6dbf5113b33c983d27bf
SHA512

8b8cd955aea2c90b863bbd822ab68c227ac67ed99e475482675f246f959dba8cd5204ef52165c06c9c3d570996db171e8f5e577af2b862ab86f9eece15eb3436

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43E3F141-AFD9-11EE-B377-EEC5CD00071E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b1592ee643da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000513baebe254104f88983dfb0cba894403c98a7690312e0cf33b52c43348066c5000000000e80000000020000200000003bb48c13a139fb8d07df23297e6ad74bf2f5d54f59feef110fce5a88965a27a5200000003758b1abc31127f9772102c4d6eed1fb5b084cd0a6e1fd135e0110b712c51845400000004d3b4758649888aac6bd1f296ea851d75f87bc5ce8bf40f72691df0f78ba29a59b8c97a800c35f65ef806aa011bfb6576b369774ae3af6c5341ecf9fea186109	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411067694"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000072f01539942a82708a333fa29dda05720348171b89f2fbb862a7638511c1142b000000000e8000000002000020000000cd6bd7951e88bce97cbd3afdadebb2590b1be645a3b8e5f9a22a55a60bc343e09000000074888682dd01435938b5360d1f1e7b939f82e365b11eedd6afb19fab623ec2e2f9470dd949458d463bd142bf20ed1ff10d7c8c209c9a1f21e8271473080c81f0c2a615fed07aa23d20826070ff9dfdba2092124a756a6f4b9ad80c8245845c6a0c504e9ff6a61d536846fa4fe491bc07065f5fdb6f595a270e87cdc1ce56e23f5f2a2be843d4eacaccdae05cb352a29b4000000018b69c62a6fcbd205314a51f1012eeb3d158d80f104e214a1167b9b38755a26aa6588f12b9d8daab1bf8ff6103fb8706c3ca81b5bbe35fc4f7a092685b5f4754	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1784	2072	iexplore.exe	28
PID 2072 wrote to memory of 1784	2072	iexplore.exe	28
PID 2072 wrote to memory of 1784	2072	iexplore.exe	28
PID 2072 wrote to memory of 1784	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\379de95470a3d753b746c8fa92da1ce1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b219eb398786ba8a9533b803670d0c48

SHA1
7164ee72ae7abd5cb53e98ca50770dde469e2544

SHA256
53c6d0508d7012c13ef186fb772f39d60020538c82eca7419d251193f1eb2a35

SHA512
35c88bcbf4e8f81e6138fcf1d7e4bd6bd8d31e83feb10b2d884baf713654662f9c68e71c03cc6b5caa52abd83af6fbf5e071e2f550dbae8a6a4f0abe0adc4dd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6bbe3532e3944984b43afb78e2fad62

SHA1
e73298c803618e87acf977e9be22dd6f2343ee9a

SHA256
e65ce3b07a9f97b4de052e3948c5b2a9f3e24887be1ad15172fea2705196d7b8

SHA512
e1c17a7c0caf637049bc514a3c7a5afefaa82221c8a36c54547b5ea3482873a7c67864ba062150f00651a5ae8aeff789c655755c9265c2f6add576660958df13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
780cbd1687eae73154662a941f5b766c

SHA1
01414aa7dd21e74895a6c13782a0126dbc6d3512

SHA256
ec8bdc59308d51fed566ba40cbd6d0d36b334135e50abd2f6ac7244a960b9c1f

SHA512
66e0e79eb2da425dd7ca7e820326fcbf96bff016bfa4d42be3929cad77d2cac19e214aa7e8bafdae4f4f4e6bd4693e9bd31c7b3ac7863433fbba2d70b3f8e9f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ebb40291226b934faaf4cab4cef5ba1

SHA1
32a410868aa993144a2355b249fc6dc16d6b92ea

SHA256
2bf20696ffccd91a24a5ba9b8a2b0d95ff5431884db478d98484434902651aa0

SHA512
bc03e561bf3e8c458a3863afbb38a093467fb8b57514b197b90e2acd4c545c4b29c3ebcecc068b84e5ee7baea7dba0de51f3c6bd241eb9ebd372edff0b67db0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94bd3a98a081eabf914741ff98292dd7

SHA1
d6904008cc0875da8bc2b76cd85a9e2270931dbe

SHA256
a878f6685a3d09c29c1ea9d8ea6440ae47b2435da7f9e7373f81ab5b33cc59aa

SHA512
8ce2dc8bb156d9647035282f76c14de68ee46c260870420d02e3d5e3a38367a41dce94d7ca00bd30ba362ac366ce937a222a29885df96217b0c48aff443937d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e3549025987e119d9813e276bf22c2

SHA1
15e7a43257f7629489f140ddadaa26450f27b246

SHA256
a3389a1f8c3f59e6ea1ddadc5221e736ab63102ae7fc29ad7ac19feedf6c2549

SHA512
05e5da1be0bd0c592498f21b62df76c2b9375ebadfaa08f93f14a35cb116758908c9e9b51b2fbddc5fa479fed2d5aa3aff86f1f34203c15ff8e47f9cf021cd5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a78bca0749b3924527810c6cb1699a

SHA1
3ced42b8090272e564692797ffd14f668ff3409f

SHA256
64e7c61bdc821f5c9409c9339bc1540a19f1f9de1687931f71654fcfc73ed0c7

SHA512
47413b8fd55c90b68d026b80193a309f97d16e7a4bc0f617a6ecd95e91ad10f7d8a682bf135984d8e62c1e8a283e2f14053a653473e0320bf7671b64abe9731a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b75510dd968b24ab98ecc9882ff40358

SHA1
5069b46758f996653d302c7b37fd77468290d0db

SHA256
9ab8c4560dc5be87bc6534b51e108d37f9b7cc3e4a7aab26a124168573555e1d

SHA512
1af3631b6bd8892f5bffdccdda1b1ef718e287152121ff39f999c4b89548748b18ae7f9c3abf56427ae72ad35655224588f85ffe3981de1bb8a1e086bd52f8f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8244b1cf9b5ace01a9097e125e20bf0d

SHA1
e302f8c385e218365801b30f30a322336cf6fe12

SHA256
79ba5cf590d0dc652744de7d6be2045e4bdf39ce60695f2441617b58e93bc461

SHA512
487b283ede5a8160140c214424fba3cb7b8f7b2ee1cf86494087e2842283a85dfd40e37219a66b35a8bfeeea33c535b06a7ce6f1decdf960f9f09ff9b233767a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96a1634c65d0142430c29bdd8677ff39

SHA1
42bfbfd9119e7ce9762a5f0ecba32fef7ded822e

SHA256
ae727f314ab39c91c3d63360d5637f59033e3576cc6a5cfb3886fe1ce65ce410

SHA512
96f7d5cf2074548c2b329108640e2ade1bf4bc0cf7353ae44229111d9300ee8b6eeedd7e34da6012dcdb8d4d702ffa6e56e0a0e80b1748992f4ac7621c81f783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188339ecbef84b08b651d1c2735cd035

SHA1
4a95c4cd3c4bfaa4a159817d761d2567cd27c308

SHA256
fd8bab439a5e1a7b5bb4c2fecb82000224fdeb136f22b0649c88cccc62ad05d6

SHA512
20d2b1a76866471710a6b1b6769a682ee2ce5d67472efba927310005f9f024851f5fe08e3e45e60ee7dfde09df36bf5b1d850e9dca21a093609b86dedf50c3ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff7019371e6b8eba89d8ab18205a900b

SHA1
e92b7196a06dd1beeecec3a9eddcbabe3ef5fd69

SHA256
19ad279fe6e2459e0a27e88f00b6a6f9e7d8e732870e1b1023ac1e2256dcc0e4

SHA512
7b612c11be8192dc86cf3b79f856e2d6506089d55d5b43d79cd51ea9f928b3909a129029fe6f21da0164a1123696914cd86515b9bcf2c0b121d16ab66528b85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar210E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit