6faf6c3e974abfb8be1e2c08421086e8dcb9e348838332c8b0b2f7990610a798

Analysis

max time kernel
146s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37c5a380e20826ce5cf4b52b700ff24f.html
Size

25KB
MD5

37c5a380e20826ce5cf4b52b700ff24f
SHA1

e346351fc0d444a570ec64f420154ee54b571ff6
SHA256

6faf6c3e974abfb8be1e2c08421086e8dcb9e348838332c8b0b2f7990610a798
SHA512

3b35cd540b2ccfad12390301d69cfe2ef8142027d0331cd5c29d21de6f9b6a06b3b3c06ae1a67a8f335c3b27203a3cc234e2f97f5c30889a6109e343d06b99c9
SSDEEP

768:xy1R1DeCUO571jBD3hEzh6XYawHfV77OU2S:xy1R1XUW71jBD3hEzwXYawHfV77O4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411068716"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02a497ae843da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3B55260-AFDB-11EE-8C00-76B33C18F4CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d6598ae35ca1710ae67fab2af7912539c654686f87d7cf21fb5b91ba3ea75600000000000e80000000020000200000000d2ec6afafb045730e6e0ef487d595f7ee14414f81e456ad147d61b2c871a31020000000210fe936fa7e763b7bcf3279ca77d0c13914df94b8b790fa3776b6e3c1e7155c4000000002b89c9e3a684fed22427efeb99124e434a8223ae52cd08832b50a0f878a02ebda187ba8769cb4033b085d4ba07b932386d874228da30cc7a0d135e946a0573e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000034e6ef37276d1253cff9bed8ebd46e175954066c7cfd0f937a3015c759e4872000000000e8000000002000020000000e00ea705a80aca1cc1714823bf92436d0525339a2be661349a52225fe34b47c9900000001ac20594ab41a1bdbc5421a1123d82d0a2b95a58bd2c1543254c9f8f8d7e15071aeae58dc5faa1635caa8c1155760cd8e75c5105c9389657aadab1cd50a0cc619b414ba9f0106cd47bf015c54b7fb213950f48c7e3f13670c0690fe93b75d80317b01a49d8f90bb77405f209a940310f77e1a6e7bc2f2d80ddd6cd3e6b6614e98e1024572724ae440b2f127cb424658b40000000f87167536b2c0d42f10e5eaa5af6b5d2485605a0b9319c89f56a7c072f5b915c80b2e31e44c0e7e3912692b2881ce111c8442f5fa11eca857b3ff513c407bde4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1380	1912	iexplore.exe	30
PID 1912 wrote to memory of 1380	1912	iexplore.exe	30
PID 1912 wrote to memory of 1380	1912	iexplore.exe	30
PID 1912 wrote to memory of 1380	1912	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37c5a380e20826ce5cf4b52b700ff24f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae39a6e0bb779c970769a3be5d09102

SHA1
f7e48c6d79c66bee92b69074c3d48542914660f5

SHA256
87934d827a914f9581827f525ed5540e42bfcfbf46eab9055a9667f1c53dc2b8

SHA512
16d8652ba3cbd28cc598c163a8ec95fccfc583ff30b3191ec301a83e98f4d2b23e6078837b1a2bf088ef697a5f3940f7a45301b032700b7fb1e5db4d603e97c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f9154d0798ef7b6823850615d5575d3

SHA1
38157dd8128bc0e2fc07f62699cbe694be6e5462

SHA256
c0c65001b5f8cedca2b25bd8285d192256a6d4f274354da209fd38e939ddb243

SHA512
0e51c6e26a3355baacdea9e52e13593320dc0de467eed24a28b50f47b0663e8198c09afd0f37c1be30f272e35148525612cb2d403b499c4f64de2cdb72fc762f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e3b2f102e051665e747df327a605bc

SHA1
403be74e5918cbafaba7d5fd9490886a026355de

SHA256
5cab36b5eff85d3a70dd568b2cda9ebac647d1acfba67ff023479efa618a2d4a

SHA512
1a55cdf3e42f7e6e8f481344998a4ead5f3d866371dad674b7db47242cbd8623536c8a24c2781135d32b278dc9d735b988b7cd4b20af11446cadf49a8bd3473a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2b61b93ee4e4d4dd67532fb4c613c0

SHA1
838b5cd749857e76d0708ad7ab8849a2db705016

SHA256
2a24d1a2e6d68ec63bafd0d73c12dd6bc591ee29d2fa88805b5f244ec7538e3e

SHA512
f62863c28429e9c574517b03703b254ef4d8274890f38ae43f73def381d20c845528cfdc0b9e3766d9520392e7b3f31e7bf7b363c83c033ed2d0fc84f0a346fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6e8bbbce2d5e84d81d7455d08b28849

SHA1
616aa9c5723ef95ea73e6eb1dea89b3b2b716a46

SHA256
429cd6b42dd3209f8849533ed9249bb667a6c5d2187a67be66b30286a4206693

SHA512
6c79d9eb8a975a0739f445f097b3501f38e77a0a7dafe98bb865599ffa0403bc326e3f7899aae96f326d65bca91d932d7af97dfded497ffdc5d664a78a986803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
995028e63f8626a67c7160cecc1aadcb

SHA1
2c3e7b851faf358e1350a21b7d48d4bed1b816e6

SHA256
3dc9d68e15ab490e1ecac691f3ed6d8dca681ce5d95ba2451dbf0a063914fb2a

SHA512
bd9d922e776ef5cfa6c9d9e6580212910893ebd16d10aec30af722325aaddb6454ec8e7e123d790cbd792eba9fe5cf4446fb54584c08c788d39b2e4ed13b8566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844a05011be4e961e01866125d70b916

SHA1
9d031ed5c60d6ac54c5e2a2baaeddd566679ec4c

SHA256
7aedb8939414027f46c5165deebc7552c83e5e203338cd41ca767bcb5b152056

SHA512
200d44ffef5b9d7e21f22675b2241cdd79d44271776f38e5789fa453550f050ec21612ceda519a4b1aa2fd316f10520d21b3782b1577e591904b96c8be9df17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f20e0b75d7aa8ff74f86bf051803196

SHA1
e394dc21c4322678406cd7bc913158b015196247

SHA256
12f0a2477ff551e63f90c116b22a1b066e4cf4d5af1f0e9e2f054bed75d4a173

SHA512
88217237fac6c9ceda71a73774c9b0fda6871a7d97ca832b83e6b91a557945aebfc10b6fb0d5c18367c8d6888d6a978e0c9b9bc115a90b6072cee09c7f27c980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
418a294940cef47f5a0be6f613f12221

SHA1
4b72560b5434d751bc7020e4e38439541041e095

SHA256
7263c8bd01ff0699a0788af78c24d323124d4566aef76d9d59df1629d180a63e

SHA512
e561e1c06f21821a981a4985a46680f12ea44f8e340aa7351a980d203e521b283baf0eaebe3b5dfb87b59987f140bfa0bc4c0ae052cf4d67c6a1c8a87de9dee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4c2de25ec1b3ddb3e64cc618312657f

SHA1
3ab889b0acee504073301b4fbee59ac02f9d461e

SHA256
fd24cc57fe8e34c5319876aade9f37bb118ba8fadc07d6d1a8d4379110fca8ac

SHA512
662b35805adf74cf79a8f73b56e0c46a9dcb1e2f0a52f26e5f7d6d5f59aa0ffcbd4a6d20193ab44b7f7f409ab1a978f68061eddadcf85782a97db80971783678

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a11ba795ad38fa81a9b3b96db63693

SHA1
cc94d40317dc984cf7d0f32ff4fe03fe5498eac7

SHA256
47a96655c8bb31998a794a111ffd6a85993e462137dbf13dd77e38e2e59d0bb2

SHA512
180b736d50261e1e94e0a561cc4d907e389e6bb4da8cd7398684b33473b8c9ae4949f0fd10b9049bef1313d7b6c2c19631d181c97b0ff223887e26b0a65da080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b50bc97c81ded90242bcaf0e7030cd7

SHA1
bfae8d28d562e2d62610a35db76d0b9193b42668

SHA256
ebd077146cffab942d27ecedc0d8f06cfe138f5d62c47a949483dd85a0155eb6

SHA512
af985e6dbacd3bd823fdb80d9664b0d01b26f4c20609d3198f50ac997747cd0e638352ed6a77e9674380f9b582d18ed36c6fbf5285d22824633ea941ad227c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9514489685c30c0f27ac82d5c0f6a2

SHA1
d7215192b7c3b2c71b3e24b9f232e68497ed113a

SHA256
d5052065098885c8a35ef242f96e3cc10ddc76197f4797540ac2a7b85bd4ed72

SHA512
54feeda18018349d0f556751a989db5b8696f22a7bca630450aaf3978996c2681751e819179fe641daa168bca2d6a8efaed3868940fa49c036c35fb8ff67d318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ffc29e9c9d8a75a9cbb8092b93a0546

SHA1
37fe4c6daa0931d2312d16eda7df8c0e77506a97

SHA256
3fb2a41112f7f42b361198b1fbbfa361eef2fff479220fa1471d56367b00f091

SHA512
0d92a035d49caf51dbfb66e937e4edee5395f4f5e7f9e866a2255d59de6fecbeed4ba7cc97869bb899c0b5159526ce732a6e5496a4110727800d49a8861d2445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921d3265c18881683b0efe17bb48ad1a

SHA1
21d488d4a20be200b3d0f55465b2d65b82e4ec9b

SHA256
d8e99e7de6e52affd4f81651f7818494b3f76164710c0da42b7df5848b39dea5

SHA512
49c760dd9a7135babab10e2da398451eff2d093142048d7ba864ea25f251c88f1cd85bf26b953638cd8f1c2e15ab7e59bc3c31a6dd4c9082aa2cd0365e4fe925

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0A4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADE2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit