e20a97b0dca2f8d69a5f39e24468f65b5881f466ae4953011722d5045320eb81

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37b59454b3ddc9333836ce13bd75adca.html
Size

6KB
MD5

37b59454b3ddc9333836ce13bd75adca
SHA1

69a1c9946b3a9252fbb58d1445779cf149ca14b0
SHA256

e20a97b0dca2f8d69a5f39e24468f65b5881f466ae4953011722d5045320eb81
SHA512

b99c4304f74e73b45363dc6a1ec85418a99f53801f20c62c2e73d842a0d7c586e036e7510c19735540ef3c361e2be35cd9af2f64606ee487033f5a5460bd400b
SSDEEP

96:uzVs+ux7TWLLY1k9o84d12ef7CSTUHZcEZ7ru7f:csz7TWAYS/mb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b4b4fa9c3de13ef517084b788c038b0e4d5c162ffe781525cee183ccfb2bb304000000000e8000000002000020000000ae4266536471cb0ef041b5d926ae85405a1b9b074be13c4b80cd83141476907020000000805b612c56e5267760ded9127ff721e9d19252eb91048819fff4949e718e72a940000000543aafad72ce7257acfd7c57ac473955eaa417e10a2349b591f53d1c2b7f17ccbf8108f07ddf31bdb0ba434304c2e726c064eb161b3d903805675e5352e665a8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411068282"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2069ea7ae743da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d64624fbb28708e1d665e2518a03c6a16583340a7836819d45629f2d1270ab1a000000000e8000000002000020000000202f2e10da94189f9cc7958ab42143b00d1999d9b3ca8276aa2236eacf671f9c90000000b0b1049b611466214988088e17ab2362a883b9c26ea9b12d34c9cc6ad628067696cb9cac15e597424fbea0837c3b2af43b730227fb21fb6475ecd42e2898e48bfd1071c26c2af3bfa4e4b54e1024c0738310f492bff712315dfde3b520d2b016c089fca6d3931894351c2fef083613bce4f8601390ae5e207fd84dac935a6015bebef6899bd86b257a4f83542557b3b2400000004b869067031e43f8057664d25d8183f8c5ff885496d27334e8d548e9fabbef3109c4a9cc9db1cabede2e99a3989e994982e0f230aab9157eb280456f0302f383	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3D56A61-AFDA-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
1372	IEXPLORE.EXE
1372	IEXPLORE.EXE
1372	IEXPLORE.EXE
1372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1372	2224	iexplore.exe	28
PID 2224 wrote to memory of 1372	2224	iexplore.exe	28
PID 2224 wrote to memory of 1372	2224	iexplore.exe	28
PID 2224 wrote to memory of 1372	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37b59454b3ddc9333836ce13bd75adca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
780de2339575a4ec616f3f903f92e9b8

SHA1
5b5c59ac54c83161eff4246a577e2a7d187dc2a4

SHA256
9526023716fbdd77a2c7531027cea1304fcc45bf55bc29fe77953102d9342af8

SHA512
546afd73e033c33eb837b8586949bb5ef8510051717d59b2c57c7d1b5583b9ef8c1b3ae6e3d5b8bf8d35978f545054803b606496f096925ff948b2f551e89266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
802a85590b5fdfa332229b73788be081

SHA1
3995df1978a6ab992587c3aaa7a71db39ae5b22a

SHA256
51b67819efb307d4ec9839998b954e6f7f31715baf7dae6ce3ab99a7bcd8ed23

SHA512
16ef6ffac4cdeab207d3883804cbb414e4b082b8cbd1332d11e3b7f84e767eddb83bc06844fdd63c9486d8a8513572bbfe3aaf70f4f80661aaa2c528b15b94e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2835813e7b06952764fe24e8ed4fd9cc

SHA1
c93271b45df5c9d356531ae7d61915d087e74c0e

SHA256
be68cff22227c1e0f5e2798baba616780a1b58f5ef242bf63af25a0d80318edc

SHA512
8b488c8bb89d8330cd83aa213b4ab303b45b24b98b464c8e6744eaadc0d540b5829933742bda4a37f7cfd13bc9677066d76bff6f70085fa0288a14e855bb47b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a3baaaa6b2e4067b1902da432b2b699

SHA1
41a165d6447febb190ec7d93c1a3881004517455

SHA256
8bfffaa3ad601267fa3d2cb9506e4f66e2dfda11572ae25f6c2bcea9644793a3

SHA512
3a7e90eef60c373b7eac1f15a7b70e8d713c349fca13e76aabed01d7c6de77da2092626b8434b97fa9eadd4aecb6806ef757ff61ae602e4f7cf421cf56ca9cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c264f41d4431c49cef611cbf9eb8431

SHA1
08f9970b47a2692bab9d71efc7551110d7449892

SHA256
e12e88908ea7f2ef5e15f364a9f7158bc6bb692a35186aa5dfbc70df574b089f

SHA512
cf05226c672d6ef97c00c0f8574b7a8b94326116a4c8aa696ef9095b0f86ae7da277e53d1d08a67d9d09ea3251e03fbaaa864f731399901e4f32e9ecdef02505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c4df7645f9e619ccdbb2dbb2a676f65

SHA1
4de3f4cb9dc1084f933d48ddaa1c49b3da25d114

SHA256
507473fa06136e73d07bc094a13d243e0dd9bc6cd22ac7766467d4717ce29e5e

SHA512
0c1888773817502bd6d8a445869b72d5648cbb10f75ed2563089a57be81267683c9497a516f2f441c8e77bd2311be01c6820349c58da3a61c1056dd11e5a33bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9934232c035987d2727e98ef78a32f1

SHA1
aa9a5e6e8c62139deb13afdb465b24b833ed7702

SHA256
0b48638e337c9485bae55e0d8564f6fef36e2af7720ca3bdf49a76643bbd1a84

SHA512
2bd652aa47e61ab941984252470cc7c282540963475b292ded2d6c5b99b2862738040079f6832dc5399138549587c994e4287c5606c6726945a6b9abac91d732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b87f6dd152ea0a327892f6c69a29b6cc

SHA1
9e48653efe5f61838e5de206dae82f9e0d4a4713

SHA256
ab29891add5c1476bb20c207ddc6ba8de733b52efa7da0109299ba37b2a15e20

SHA512
0a874dbb47c6168fcdf095ef960fd13f515124ea3d590ef2901e823ab07ab9a605a56c3d815485ce80be0e83b98afd3895c0e25416063f270fc87c3209aeafdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3edc5a7227eede3a5996f12c88cd541b

SHA1
0bf7fa8ed6297692edd9969631d19d0f83ecc727

SHA256
7ddb4bfb1750a310619b98b342ce2a5600b1c8a0583707e3b9fea129d7ecbbb2

SHA512
e077790192332c79b60706b7b06422b3b9e2f56c5a920bc5592db5f2715acc1ef00a1e1d3189982354e4800f621033142a6bcd7e5b9e0b597ae61fd94c407f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDDD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCEAB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit