a7c109aaddb907e6dcd95db69cf41168c507c9ef6386c5ce9ef1b4d76d765233

Analysis

max time kernel
142s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37e56151a1887d3d0bcf3ab52c9bccf2.html
Size

2KB
MD5

37e56151a1887d3d0bcf3ab52c9bccf2
SHA1

e31525a64e85da1eafd7ef5cd548dc6dd8b1a11e
SHA256

a7c109aaddb907e6dcd95db69cf41168c507c9ef6386c5ce9ef1b4d76d765233
SHA512

b3c37cb8382d604a08383d65da6b3bfcd801c187fa989a09a120c212e4ffb94be315664bdd410f5ed48f9dfffc32337069d8c109428ea8a5e0a8694c52c5f009

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000017c919a80b5569b1eca207dfc3aa59a538c511076260fa1c3f695f3c63228567000000000e8000000002000020000000ae59455c38bce482d0f28f5aed607717a921e7ca2bb7289f20b0cdabc829fd4420000000f7c392785bfd269e6e0e0505e3349aad2b56bbbb3217de2a909a6c9d4bca58f9400000006ed728e3f2cca4053504660b0c165becd22f5f1706e29bc0814bd36da14dfbc0543cc2d1bde298c33aa9f7817e7cf652345ac369877eac764393acfcf99dbd8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04a6e11ea43da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31C373B1-AFDD-11EE-B930-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d9aaeab86eb8300a43f227a33241e4f83d9b10ef3d83b6b2981f546161e9030e000000000e8000000002000020000000159a3b3645d9418d97f47fd01361dbb48388fbf47d9203370d6256ae86983a9e900000004a13ea7714d8d37391d609c8b6f81c87e0298118258a904f85268c0d2076a7d8b6cfe51320e5cc4d8532e4967dfe61e70644b9f1d337ced97ee543577015ed044884a1726f669ef5abeae9b99a44c739e8659d124b9305b13c6e741dc1e19e354bd4d18d53f498cc6db0fdcebdabb322b167a5afa9d2e5a26ef6fc59c437913a52f4f849012cf4e1a3efb76fa4a28d294000000079157d846377d1b42ec28cc0aff90db5f270cfc8418c053fae92fd3679266d9d8e1b90a7964c9bae7033a6c5e1e26aed56284153cbe75b5c3ba1fcbd034c2eb0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411069389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1308	2632	iexplore.exe	28
PID 2632 wrote to memory of 1308	2632	iexplore.exe	28
PID 2632 wrote to memory of 1308	2632	iexplore.exe	28
PID 2632 wrote to memory of 1308	2632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37e56151a1887d3d0bcf3ab52c9bccf2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa15850af8fb6c6ea2f06f13548897b1

SHA1
53be5bc926c0c58802a43cf5d856d4982b4c1d5f

SHA256
618c9cfec1e5cc21dd4ec5abac9fb6193848d27e345517c74d458d00cf0f0fb9

SHA512
d34d730c8949c7f0f93c1b6ec1c158f919c05556561fc892e7c51e7e9db9213b94c369e64b02183f71ebd98a5fde9ce3df375d7187e882f6017bd55992c78386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aa83736e44eddafc59d7c31b4b6c0eb

SHA1
d0de4b3be1cad1115e006f797ce845d8bb6550cb

SHA256
d83c488ec1edf2cee03fbeea5056b9aa665f1088a334626bce89bb02177e9e91

SHA512
e7fe3ef220a8aac6d13a2acacb3e397e660509b1f7110ad6e3920dca5676e507f9773ba5b88953cb7ff3e71a5bb4c715f913e0f2f9e35074bb8469d6e3824d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d0bb95f018c4ca5ba36314e4a25920d

SHA1
0fdb8f22f0c7a8f70881b66f9199c9e4c6bad2d4

SHA256
567780047693ab300658d392920b91ba892429e8f3abbd0eb5a1e68ba305b469

SHA512
1236544ee9145bd3750053e5a3624bdeb5814a5b71abed3db9f4791548b01cd1d73be12ddda222befa15c15dbc62e7bf9cd573f8fb84831cf198c6d3132fa572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5dfc90238077e0c1abf7f7253ba2b1

SHA1
0955b9832e0bf1c7b6a01a57cdcbe5666e2c293d

SHA256
28be13057bcdac744f62f28a1aa0e02c33869af2245e6c52f5376f0677187d24

SHA512
008dc4be862c06ba6c177de265a63adefba2406d79f474879af60d21f04660cf7056a823a28e83990fbc98c4d1c89c7da67cf16ddb43f3ca7e2957d510a6113d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
301d5e935e73afaa6f358b27a9211819

SHA1
18785fcb23d8532b33d3e8fb13c39aabff4ab10e

SHA256
4826a2c0219954e2a11fb9c2697811430bf1780e342be1e85c947cbe235f2806

SHA512
bc3af78649861cb9a6ee469596059d4424751d4d454ce749611b22bba055bc7ed5c4673fc4c0a9a0221204c2db6381896ba32d6a4935385b6ce84a1c73314691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1372f0a9db3d4abfa4d5217b95af2b14

SHA1
0728e901e7dbfdaa0b3834249fc968028450bdf9

SHA256
4a67905388e159b59f84365785a1d8f57ff0afc2759f49f2b3dc162363bb84c4

SHA512
e8ecf5562ac17948ac459fe9dd4070eebe6c7bcc68b6d6a26f3045d5858f1dd66aff58b8bd9567e39d048c0109ded67a7ccf477b10b93f17d55a117474331fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195a116421aaa28036ae9f51901ed860

SHA1
d4a6741f64461b1bee2c5e825492f967af29c0e1

SHA256
9e41988251fcd25f21aa04162fa2d8ad9df5f841d93dfcb769905aca5e226eb9

SHA512
e2b611d4f0f7eb343ffffd8837c9439f598d6f21abd91c7f48eeef216a861001fb1095d1b6f6d27a3108b1db1cf3e847f9ebb18635adef9b026bb3a8ee0577ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef6acd914eda887fbebcf947a365539

SHA1
580d13201b518b877ece7a6f85f45469d11cfc06

SHA256
1035e37892ffb5d54734cea84c9d15980b4fca02a90c81680dc99c6eed43e1db

SHA512
a08742e95464fb253fca97d4115f6b43bc34010fab7c170be12f8061a0d325c674e33b2e38856693cb5a8eb35649731ce51427ad0ce701e287f7e1f4e92d5bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef59d51516dceb923e454ff57211060f

SHA1
5d6afd9f892c4cdc7bedae68ff4bcb80316e6a69

SHA256
6bfe4645aad96019dcb71e72b68a62d1e53e39797f729c8bc25bd29ea817f4a2

SHA512
6ce32eebe508a0160fed665bf9abf7f317358ed940ba134584d2fdde886c7b85ef3749fe84e9201ceb493e1a2ffe5ce81d6edb544e02b88629ffd449f6bbc5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef01f890005b7b467b99412c01b44cc5

SHA1
e51f75613d4d0d287014dbd2738423053b32fff1

SHA256
4f301c656fbb3c2530cf4890ad326ee5bbcc0202875a4d0c11bc44e5ca711241

SHA512
1cd12cc443116868cc39824955d62b5ba188a1e43c871cc25c1a28cd4cf1804e0dbf65d937c747455fb946266ab550a1ad2d655aa64fa75c56fff8028704d56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1afb52c163102f27d64ad64bded2ca4

SHA1
a9722208777dce53a3380f56be0fb8558b358a8b

SHA256
d4be693f117f2143acf30336c65300f5a5167dd998b774a1147d7d064d663cad

SHA512
7fe2285e48a5c1d60070c003c4da1d9ab16c4d7887ee1c884df14890448418f448041f924be8eafd32af686f7d4e65e6bfff153f874b35eed21d527739df4fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD8E2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE52.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit