e3bf5b920ec6100e2b5c23f3b8d75266f125466198474cc856e3a8d597d4fa26

Analysis

max time kernel
139s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37e65b655fd653b755bf1ed10d5ce54b.html
Size

90KB
MD5

37e65b655fd653b755bf1ed10d5ce54b
SHA1

e7c62dedd59ca3189cba3aa3d978925aa02bd457
SHA256

e3bf5b920ec6100e2b5c23f3b8d75266f125466198474cc856e3a8d597d4fa26
SHA512

8ed26f9bcef4c3e9d0bc5f7ff100b61afa112b6e112cc0f5eec0cf8e494200e01e3b6f586bfe5d59f5a88ee0c3b6641d8ec4f9e819d484230d30caa8e3333cd2
SSDEEP

1536:gQZBCCOd30IxCZK7x7/MPbQ/9tI/YXYPujd+pB7gKr7dhprJ2jW/5IdbONURQhXh:gk2Z0IxWPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fdc612ea43da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411069392"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32CDF641-AFDD-11EE-BA54-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bfb02e42031e93f91841b39d8ae4d79195304b16f480c93a4e8ead8fa14b0072000000000e80000000020000200000007571415a3e7c66d884929b15cf6fea7b9cf05130c025c73253032da1d420354e200000006e34b7b1b71789043695ed47ddcec92e64a97818da91a5135b9b31139cee58d44000000042710253fd52305e06ed85c8e187238157c7cf32ec1c5f1d87e0936105521d3dc35e1b1aad00c81d0b93c7d7d407f8c2b3a2d0574fdf10f08a3d4e2fe201b7f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000031c3688d30d78aed073badd2935c9175a44521608a1def190ef57b06577d8309000000000e800000000200002000000026853810a39760a8c02180a8c31b6f097451daf5498504852d796e0efa81d1ea90000000ea7260eb9693330d06560730791f13aff1e8a4b9735921c9101663545b7b23e7c6826d585ef77dccaf86c9ae5d5725114f1d44c37871bc3d69895dcaf489314316c74cf30266fe2f49261ee8671d5b383ee51863b0622200dd8586c3f2542990223b34700534790dbd90f05e5eafc3ef750bea56eef0b0885838ea6a3433c267aad774c5d8ddbce1676dbb41dc1bbdfe400000003f9965bc7d47cd32400da0d4ce562a83751feaf703eb892cd591d2142c7307d825b3588047deb38ebe362562d66211e92541b9a2725c7a767c26470a24ace566	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2552	1972	iexplore.exe	28
PID 1972 wrote to memory of 2552	1972	iexplore.exe	28
PID 1972 wrote to memory of 2552	1972	iexplore.exe	28
PID 1972 wrote to memory of 2552	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37e65b655fd653b755bf1ed10d5ce54b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b692a42b3ea90ebaf9b8883fa8c393

SHA1
2cd41f785b6d83db553deb62e25fea12bdd2a2a3

SHA256
2d96eb3f552a250cb0a995dbe1615fb1935da23b67774ac4cbf69ec60b08b76b

SHA512
0ef54266f60e189f6f64c7e8ca7ed00e6c51c92310968c8f46c92bba9ae76141b519c18d55f1e49a9eb48ec914215aa30da50dcf192619b7b03403a138c3d8d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fadd800902183d72b6b425fe27b28c27

SHA1
d2ae47851ddb6c04feca1f5b0b2004e5035437bb

SHA256
85da8816992b42da401a8356bcee46b2358bb0cb54c6701ced71bb75712789a9

SHA512
67836c279363ae80ba301269fbde1697cbfec51100b0ef14e13d324b9e7c157db123ade827221979481aecabc0ebf53a50c27c8a4fdd6029766b7f6e254755df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82df3a1c7ddd49be59a41863b20d436c

SHA1
612d80ab965c1bb57485eb64e71bf29768ca0bc5

SHA256
101ba26309f7fa4765d90a62c4d7eeeb08a02cac98067e00d7fc04256044b734

SHA512
7b1b962ade7560f19ccbc31fa0f245de7e5dcacc460605e28b422aa26b5a427c16133f0bd6faa49cba79ea78e7346f93e7fad9a87ef6b68ca832563fa7e8c9c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
152d3e02f44f294b69447691a81ddd96

SHA1
c6bb88beecdaf5cc36db8e718bc35fae98b642f1

SHA256
3dd3158111ad63ee85ef3e1b1f733db1f0bd4f6870ca8e6ecc96c590620d38eb

SHA512
07453f9bdf8fc8520d1a892b74991d42e59610f91f926f60f6b1a4728d6900dd1e30cb8bb6c3fdf8cf7752d5af1b76fbce5f36004706f7a4ec5b63defaa69d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb1bf48fd6ce310548c3086cbd4242f5

SHA1
916ad619b7634675d17e2e665fa0a91352c9c616

SHA256
7d4a5c735d482af1599976f29227ecd277de3406c86c0b90c33717152842b628

SHA512
c96662d1d33c2318911c3eec89268a633ca64e2d3154506e30ca632021c1c673d67cab2db10146690a18b830b92d622c4ad2d8dfc7203710f130235f3a4a94e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9440dcf11a8df55a35ee090c509735f8

SHA1
fc861948701ede46c1c2d30607025df684b59ed6

SHA256
00632bb85f44b28882b4ac048adc463fb20059eb321f20377c69ba58622ab0c5

SHA512
4af597ded53cd87759b7e95e1d9e8501974bb238ff30cc0a553b3fbd6c2f04d0a212c54e2390031c48d121061fb286c8d1d22c6f7c9eba80cf78fa0c4b08880f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e22331eecaed9c54bd0744d9d1580c70

SHA1
eaf40e6ff45a7ed625c1148a1bf2d6fd8ee02fea

SHA256
b252f047fc6469a70c82a9db4875725c2564b6363e48861ce75f535df560dfde

SHA512
688fa80b90bc4ddf4b9908596bc27e984aeb5c307101de9a046b3c0e1a28cb06397ba34c499a253567d615d9bc8c46d5a76bbf3a28f7027442603e5cfc5a9c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44e0d80dd4ad01ba6c0bb3b4f1bec4ed

SHA1
894b404da51d525efe3d4770e8b0eb6228b76a98

SHA256
e38800fddda3770793b242792338550f638b1cafd21014a34bbc6489328f450c

SHA512
08837473b2f995f07f1e53c1763f0f0eafc048d91cba5ea54838b4ae0298425a0195cab9b690934e445bc324ade0b7e577604e3b9257fcbfc289d6056a096bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf5293424d6190bec4f03d4da4fb92ae

SHA1
064f7d03aefc05fcfb7bf9c513562967d77da81f

SHA256
0a5051224b410b372506715c414930f843b41b56c3d114261adefc3cb2b049bd

SHA512
afc300a4bae05131cc639e63b82e92643c8be7b8fa423a858e75e057b318d3a983476b71a4d2ecad073bca18083307f849c2b47cbe75040900a2877a2ee0109a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
857790adbe2becaa439d3d86ba429ca6

SHA1
cd00a7aba9212639bb4eb19a5737a15a7ceb15e4

SHA256
c4decc313d5f2b32a05a1177e8f11c9edcbac4548c3be9f9ebd2b4f8945fa0b7

SHA512
d101d0f3a2e090ae6bb62b2ce8543aa3baf062991956e7afbe332448856710bcaba6600416b024610955a203f779e80cc0282bd97d771d690cc502fc6b3268f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2807ad799b73047fb008da7bc34e277

SHA1
c51fa90e68f105b7014a48a77b28b1c851de8409

SHA256
993d2cb7feedd3bf199616ee4428cacb5411bfedb8e6564b7af0241c89e3974d

SHA512
9a3e2ebff47ad61085e27bf254540dcf7549472ccdd144d0514a40a51ebc525f4eb3f13b6f9ee29c6dec9e387420b9f6bf2868880c240c7ab000729a0b572c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eca780599da5eee0198708bba476990a

SHA1
03bb0aca15c742655527c3cd76b7e37d30d0c7e5

SHA256
17aca8a932fc07bb666dc26a60947ec587d803cc4d2f2ad6733de3229117534b

SHA512
875d4435e1d3da89d6707adf4065c1738c101416c21df781f8f117a426bf0224a52db41c5c0a95052a03c456946c18f34faba9273834f5b6a47bfbca28c57b4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e5f7fd17c6a6c4617dbeb55ac754d28

SHA1
bd605b4c8a5b8b6213900b686b1b3307f9dc9458

SHA256
d316bc01f8f8c6e0f98dab57020d5b7404a204c8ba3ada07f6189093981c1e6e

SHA512
9a4f1e6b5cdf9fd7577dd30b09b414bca89a8c6b06a725a72aa7755ab85b222588314c83688a2303a0b29352280b6acbada497e7eadb079db45a362eb2500a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06f1816714dc04be7d6047d5ee04c0e2

SHA1
350a96fe3562f5c47a1c69c8a3a9eec8db1f5318

SHA256
33eb87695018e52332fcbb42a02cc60a01ded51c0f6549b7c6b317a992251a2e

SHA512
31923633b20147f8c1181b1cd1aed6df545f2cba7b36c7bf0ab919cb749e87575431783e7718673aded307f2048125f52b6ea1c41e71920f50167f20fa61bccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC610.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC690.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit