f83e7fd0ec515af20db3ffa0618e11a26513e1d78ff62a3dfa9c748fe16d30e6

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37f58de13565a0ff536dec4a3dadeb08.html
Size

12KB
MD5

37f58de13565a0ff536dec4a3dadeb08
SHA1

859bdf8a724f254bb2cf1f07277fab63618b90f8
SHA256

f83e7fd0ec515af20db3ffa0618e11a26513e1d78ff62a3dfa9c748fe16d30e6
SHA512

d0fda1f7201e629adc83557be075d403290146687e409c4d098c5ebf2619ad964690a5297239f80b9caac55936940b5aa7d7de3ff147a6b9caf097d2a8df544d
SSDEEP

192:rdmmgxds8iC9ZYT+3jJSXbmWbrsqEIC+LJssJ2ZITKmj7F87hmKUuk0QjUVgUETy:rM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e081f79f813fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a764a74bb5f4e1799f8bcc0e2faf8aa7e77bafe4fece64f8e33a427c18f75dad000000000e8000000002000020000000e0c07e718dc02db4ae51d19ae1d355c8e2b7613a61947b932f3d03cf0e2d4bfd90000000980a689ff5fc4c035058a380d735598c025bbeca1b8a5f6a5b6677df45d723cfbecfefa890ba83771e401080179c55fd9ff81c8475e50be506380de5d3b9fc909ac8dacbae3e5fa000e8cd8ca12a29b077fc3b7f8a0512beea18f4e6b8284a9b894b8c0d47c32e77bf9d417cc4d0d0909541912f48bbc45663b533b26dd0bb2829f8091abae0a37753c6f58d7386f5fc40000000ff5c14f58fa63e7a1492e7884487a14a6d6d8d73012fa6b986c7f6e1792f17baecde926b6acee91616768e560bc5c83bb7a75e2cda7e95ceeef63b26957321c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB772821-AB74-11EE-B218-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410584731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000001c3228047d52f12ed06a4baaa6c7c9de13ea0509c328b6d1c84e67cc0e5aa988000000000e8000000002000020000000bae26a9db47595b078f7d8563d42a8b3d3f2ca3ea874db485b0641df8f44c53d20000000c4e01be5fe21ac49e6a7050386fe0ddd93b1832cf86d6299ee9b955d91ff6139400000003ad3ec7127c0db8b53cc5fa4437e9a7e1f27f82677cf677b36c87f6c6adaff619df2540402c3ba2824d05096b2d41153a8e28ca5a73a7ac422da32ff01f6da2f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1232	2168	iexplore.exe	29
PID 2168 wrote to memory of 1232	2168	iexplore.exe	29
PID 2168 wrote to memory of 1232	2168	iexplore.exe	29
PID 2168 wrote to memory of 1232	2168	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37f58de13565a0ff536dec4a3dadeb08.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c1a9b32d5faccd4b9555a7628e889ba

SHA1
9bfdbc15b72df6f8cdd03aa648018c6019702eac

SHA256
016caab7ed0b16249f3af94bdd3c0997c24aabed87f644e48a084cdc8f81479b

SHA512
63ec119ad0ad2d797162ead8e877e6e53b5efc1630ae5f1e282ddc712515fbf8298217f6bb72561e3e97a6b93b0e16e80a1afa00d77a2d46211a7fc6135773b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e724a62bcda48793f0d4284228df25ff

SHA1
47cd7855f788007103a98dffd4e33868d59ecd13

SHA256
0b466bc3d6f341e88c3916f6c632873b2ee9519327ec39808aec1410705dfe8f

SHA512
5ce0da29f2d59c0a99104a50b2eff6b97558f6f561a3169db7ea2b8299fefd8a3b84773576b9135f3df396853a18b3b4fc2158bfede7c857e02e2f40413686f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c28b006f8ab92d0fe735463e9aaf31e

SHA1
98eb9e4c5109cb9d2dd8f33503ed6c3615b57354

SHA256
0025ae11db405aa22be6193ad4049bb8fb1aec6e1902f98cd271a7af89ed9095

SHA512
4b10347459b1e368363d93cbddfd208f60786c78a46c292cc0ad22ccaa7d04d7dd9743e0960589943fe4085e6cd14311f71e056170affe06f025578a255aee92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e5c026a19474f13cb0c1a815d79e0d

SHA1
98ff9d04b47076b7673044b7ae0f162317d62d0d

SHA256
3a592ff35458341462022e169c310e8dce97abb88c94edd3002b57d9636c88fd

SHA512
1f46d8b9fd7c6802aa93ca6c2b6fc22550a9e9d2a805fd480e4bcef67593b908dd4a8fd52ac2df2682ab44c651725e6b2fecfb9e7ef05203ec258b3dd0cb9ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2a2bfbbc036bea18fd148110a32ea84

SHA1
26fa0ea294f58f7785d37ba153a58328e861efc5

SHA256
3bfb677257773e02a50370630fc4f1ebae858a695d9fbb5bf33bf4c21e96eaf2

SHA512
e33a3a96fd801dcf6fbad01fca2290f48d18d5d08717f639b5aa8313b50e2dbfa737e490e31d8cdcca72a306d8c767082eb1494111ec13d73adadc004c052109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9334167de41069596125a5e72a76a270

SHA1
74385ca38acfd19eaa0f0d3d70f7effac759eb8c

SHA256
d4c890444cc415c712895654956d3c86bde1c20c568712b4636d84480def4d2b

SHA512
292feea8f50f9d85900eab53e79804d4683cef4d1708937716c776ac26a99586da4c177a98cf82a025bdb47a0845044f1e2b9014bc47548ac2f126d4cc099de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9632d552b44eacb202bed2817203f7fd

SHA1
fb4b249f3bee16cf1c9c3455474717aff7db6394

SHA256
d3104270a45d8114a486d98f7a86f2c14da7a41cc9f42bb5179b966702fd995f

SHA512
b9dc1bf8ff23204292518ba724eba4b9c499919f9244438713c4c6d96511c6e201023e3428a6307498648e68675b40a75e5948a1103e8552a266841b3bb60bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a7e7caacb66c8b449d36f252e9280b

SHA1
5fb0f7303ee3c55dedaa4953e898aae3e7a2278f

SHA256
4b815defd5ce774ef6e042bdc6c208186894c01d44a200ade83ea4305b3e59a2

SHA512
93dda3a5231611432750be6993130d965140b1eecc3fc632b3db2638f09796458206d479bd31e64b0d179915c2bca426117176aa333633d2d8ea8d92504f7a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5f3fbf811d77e148d10a95652799603

SHA1
b202d3aab2121787a107632a8cb34ac2a256d939

SHA256
520c107086d89faaf8ac11c6cd5d6375ef99a22a2aded2021859f33532d81102

SHA512
36956ccc0a6ddc0c5d4de64e568453b98c7914d66979c982d256ea0b3e577a9e839c788cf15a151c6521067e22852e39fd7a7f8424f45b1dee444d824a38baa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20AD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2542.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit