e787f1d5a31f2e17b668e6be88a49112bac63afb6aa57f2fe077897d28cdb464

Analysis

max time kernel
197s
max time network
255s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38496cc6151825ed7ab84fe8063e59e3.html
Size

18KB
MD5

38496cc6151825ed7ab84fe8063e59e3
SHA1

5d29001b76390ba1e56b99938b606dbf3fb73214
SHA256

e787f1d5a31f2e17b668e6be88a49112bac63afb6aa57f2fe077897d28cdb464
SHA512

291adbd5777158ca5f09dc5746450848fac3a3dc4509fafe5f2943af2ad5084a9a31104347e08b8c7a428638b9b46a2da6318c71f06206cf4e2be1c5705cc304
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIZ4JzUnjBhXJ82qDB8:SIMd0I5nvHJsvXixDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ed3d99f243da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DC72630-AFE5-11EE-81EF-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ab63146a024a48e816a742560ca9feea26817c4c16e8c925c11f583e93b00000000000000e800000000200002000000001789fc6dd620ff2bc6e669e6282e8f7adcf81b98a075de73404a9f20ecd9170900000000764829706de090b95dfb92e0a266f0091dc6a4bcae973104243724a17b7133e18aeb2caa71c360bdd639fa1a7228a88391c4bfd7fa8b5b59e6142141ca800c9b462ba10c3853d2a609dbe4fc6d14fbbf6f76b16b9d1bedb93bf7711a9bf6c018480e17cf64f92532bfa4b5f885a70fed74a7a200a3826e30783b083889991bbe88e164b5b4937f18e7d110fd3d377b84000000091ed922924412f7a5f3710ff69c6666c2048f55957128c5b6d552f34e8002a820cbc1ceeb4a3c64b5c613dd0170db73164cbad8c7bc2c12579d4c1a13e45c7be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000045f82f65568a4efbbd33eb5f7569a3add5677e21d5088997f6329a0ecc722035000000000e80000000020000200000002b04095ca8706e5161c26ffbb4f5739df99ada852ff25ed0fe82bba53eefd6a72000000001704fcbf24ee38e8774e8a28c080daec1c32d85bb8d1aed6c5ecf471ad1602440000000fed7585a10892cb837f77c306b39692c9c5bdf857bd82b9617c10dfe2997d16f1a790c41c184b7fea2c080aa692fdf5db19e6057e57596342d3954bc56f671ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411072993"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
328	IEXPLORE.EXE
328	IEXPLORE.EXE
328	IEXPLORE.EXE
328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 328	2088	iexplore.exe	30
PID 2088 wrote to memory of 328	2088	iexplore.exe	30
PID 2088 wrote to memory of 328	2088	iexplore.exe	30
PID 2088 wrote to memory of 328	2088	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38496cc6151825ed7ab84fe8063e59e3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0158f6ca0b4a89a2fa2a381df2c02b

SHA1
6e1575f3fa28b4e03a302d03301974b32f348f6c

SHA256
2d4201cea3bc932726b16884635226aa607765a32cf3bad11181b0d8f93f307f

SHA512
6be91c70c453872a17416800334cdb513ec693b384214ca61dcb58f55c9fb31749c4bd4669acfdf55d47caf8236f76d6231c274854dde0bf2872491410216ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9c9de5f8914b417bea65f3a0bd7329

SHA1
dfd050556aaf9c7818618b07d39e75459a1e5aeb

SHA256
eca81d55ad724c692725da9f7155bc679016036998b847b7cbd0e1b1ba926e58

SHA512
e067e986024d72c7c0286fbd4008db5957902b0c6a28ee677d616208df358c09524d1bd865c3bb9a34e638abe8b4e61fd1209c895183c58a181ee7a1b378bb10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8c18a1e56447380117c3896d1a38f69

SHA1
96ab9ad72d011465bd7e4c1eaa1abd957c27feee

SHA256
8b4125396365c0397aa4e5b3f1e1fe19fc10ff8082efa4417891acd1db4658de

SHA512
05b2e0d0f830789c6e81c3a3e6b234a9e6d6e71575165dad68243197facc5d2b708cd8d2cd4a636ac37726134ba92347d551babadca3bbcdd71d8689b467e223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c28075a663f42648ad21c3141abcc506

SHA1
3e06222ea9ed45721fa2424a6d68b4bbaff4b769

SHA256
653edcf32ef86ceafd74e95a54a1948981757517307414a55536e5b5e8f8f1ba

SHA512
14948956427624e71a85e1b65673131735d73ffe9d838535659bed31e10c173cc669b71fb3894df72738dac84d69aa06f0542f9188a60fc2e5c2ca3d5a751aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c2a81ea55f03c064f6f6d55e692220a

SHA1
895e965f474d813467b83fb218ff3593c4583848

SHA256
0f20457722d88952b508ba512c50a37d4c35496d8290c1558c94a72a0473e918

SHA512
bf13378a4875dc90db7e727ecb5dc7698f3cf47d110360d4977d996b6f2ab081ba479431f1a1f7be128a8fafc9a11550cfb9ef052b5a012b8248f928a8ef5e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c92920e3c87561b98db98f6c848605cf

SHA1
740735d40186745885f711c89c17a98a5325c0e5

SHA256
4daedf274cb0545a12fae69a42805527d1470799e1be1a5eb33c7ec2fc99d0eb

SHA512
7aad2838f7115ddfd8f440dbbe137a474fb946351cd9dafa30320488f95e0b6f6de2c6ee1164c20499c3c81d73d340168a55bce531e12d35e98980417d0bb7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71a49061757217439b42d55cc6dceac1

SHA1
b656c6a00bdd9f21034ed7ca9f5a1e179da32777

SHA256
28bb855ca60040f317c5669a9aa6fa53dd69fe5fb7cf5814b58939d6af9420b8

SHA512
79bda980c522b4d2c22781cc97f46081e225e1e07eb96bd3512b18e94141f537bd7f99f7d4e0a2dd7836de20f997d52e21f365b3655b589ddba8acabdbe7b68e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36c2daccdb654bc9947c9ae58be76c78

SHA1
5e8fc75a02c57169f472ce015faa282c04c0b4b8

SHA256
7f75913fce6c6f30d940c50a1333ffada589ac53bda0f2861d6461e31432d83e

SHA512
1c3a9ddbf80be9ada132fca7b026c33f31ea8a8d7ce065fab57debe1a889efc1979681a1e5afc2e690dace1c740df9ddb86650e4096a684377640503f63ab776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1225d5b6445fd8fb9e793cca8c853342

SHA1
8d2ebe49da3d59be18e6ce0eafbefd9ed67922d0

SHA256
616fb8f33e616d4a65c489c702b1fb9420899b9ed0234a04356651ea674028c7

SHA512
41549800cde136bb83573c60c1cfc3862ee4b11d40bad3dc52e27d1808462c9016106c3b5cb050530e7db7965eee15b9f9c9005198cabceb4286166dd166b87e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a167f568c2a2983710bd5736e00f3be

SHA1
ab8607df9acf94b84cb3065d2399ce3f55d64850

SHA256
6973b8f10cde0a59006b00d79be92a9a3ecbe3da9c878ed291427e8ac1ad1768

SHA512
7dc653a9b11ac5a0cc44f8798f5f48d06491a955bd7c4b0c0bb8b25cb4c20038fe636f700e6604c612195859f6ef36144ad3216d08ec3673dadf077ed956f8dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08951c345f899876ca78cc12bdbde37f

SHA1
3a861102642c30eeaa7b15c19cf11a4d671c4471

SHA256
273e444ce4368f593f2451e3f55719b2154844d43eb567250d6c40b988976764

SHA512
8edbc58edec58e262501a0c39e0ff6b20790d6789058b90345765300b2582ac198081d67100469abc9b7722b82c59a68af1eaef646eafb21e69f2b68d042dab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c11976f2493a63f3dd41e35040405bd

SHA1
282786f8abe547a98ed8711c4ce4076f9312fffe

SHA256
e75651054245188b6846330604c89504c1661f734c321f5e3cf140d4e2d480ad

SHA512
a4a03e4f530febb4cbb6e06ea3f31e4ab0b276655a5748628b8b60d5b40bd41e4f456fc1ad22221b6590f641ed01decc66bb82ae06863e436507f783f6fe5f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8e8d918f10c5582fd9d6ef540ed1f05

SHA1
1a894f5b8fc1c3570e2d4e743edbb24d0dfc7dd1

SHA256
7a8bce55b8f9910d74e14d488520a0f15e84db589784faaf7a634009c68c04fc

SHA512
65acd1db33b47da7c0ff2ebfbbef9d1fb7b64ca31c84d7a3ce8585851f350bd638151070ac3dcb143a9389da2e52d98b04b06b8856bd11bb315358d51a6b253a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab561C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5718.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit