fe15d941986e575bb09b2b20e943115f22632bd88d787f7e69c2fb940d2698ef

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a36aa9b59fe42d1582ab5daf5ce1d19.html
Size

1KB
MD5

3a36aa9b59fe42d1582ab5daf5ce1d19
SHA1

faf32aca08baeb7d7f7265d1cbd25c0d2bdeb8ce
SHA256

fe15d941986e575bb09b2b20e943115f22632bd88d787f7e69c2fb940d2698ef
SHA512

0bcd2b8fc6ee590e8c392784cbfe14a9d8dde89ee284a2f9dac434708d43956f8a0afca37ff7ea4d8a47fd856f091a74c10aa3fe2ae0a82979dd456a1f6a0ec2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f820c12240da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA608BD1-AC15-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c0ba467e8ae3bdca2a73d062cb354b728ff525e2a74c9c60fa998ac63ccefb63000000000e8000000002000020000000e622a8a1221f6e071c86b1035fdf7011ab76f0a9357a118dcf05620dd74abc419000000030dd71b4050c072293eed1943ae6ad46ed89dab78e0e4594a8ea0cac8c15f032a5a6be949cc120023b462c6b106254c88b3450380813abf38d2472594f9a3980318010a99ca182fac157bebacdd2de2ceed10c237c8c41a44649fad12ee993bd56b0d5ec21291528d33753d9cc95bafd4067bfae632c3de7d523a41c2854e50cba6dffff75012ce3a29c7a5bc4ff3608400000008f154adc62d6b7d8054c04baba47842a5367753cefc7a6416ce29f484236ffc1f65fc83e4d09343dfca2e8cc544a898c3b0ee024e8b720ebffa8dda288e21ebf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410653963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d6a454d8078c364951f2aa4da33f3e6217d71240fbcb993137fc11f993c25344000000000e800000000200002000000084493c04df4fe5e5cf4637ac5c796914e60c58d07da83a9de08c922ee919980d2000000004b8591e3f6b8290441d15c996c1ef4c09f2fcbd9f6560016b8b242a4d893db840000000e74c13781285e36a2db73e55e46d45596286fecfdd50abe71c6e07d2c5518df116a73b47ec4cf5a046ebc5ae2997c9f93e02429ff016f3978ec02916c0413a3c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2388	2212	iexplore.exe	28
PID 2212 wrote to memory of 2388	2212	iexplore.exe	28
PID 2212 wrote to memory of 2388	2212	iexplore.exe	28
PID 2212 wrote to memory of 2388	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a36aa9b59fe42d1582ab5daf5ce1d19.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cca9b160ab318d448e18e705d0987c66

SHA1
73d64af9d1039a75856ac32f9ecfc6dab5e3d6ef

SHA256
dad2423617e30bc39341fbe4fd6b7b33ec824b73981efa43c5814660cdd7a8e4

SHA512
3eb882cdda0b4e5f3e2273b5f0ef07ccc458e96283613e2b1a0a546cb0302c13f6337c082d4c9f376efa383f9ef8c40db9efa3d6029a9d0efce0f3d7a36adcb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8e01923e45a9f28b393f3297c280584

SHA1
aa7d519a3d33199a40b1c922d373580cc3becfc5

SHA256
a7a825d04aed6fffde41286d954becf3df83eb39a7b16a51d412d396bc73b359

SHA512
ecb6ba93effcd43e66f4c1639030abe1140de42ed161c9536f5aa5d16b3487bbf05f7ccf78575a4f89b479706b2507d7fd681f887c77db908733620b905e7834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d0be7139402cdfdf2ce2a0790809c74

SHA1
924e2b26abea68598d903b49433863c45c3291d5

SHA256
b356c44b3bedb445e7d7746abb1ec3c11c557192237deb0ce930475863136535

SHA512
92392dd6a869511c81ace9c45e236163573413cda10117b98873b926d2f17b9af9793b9545a181558eab9bbf525484d203eefcf0d7a269e0314b5fa5735726d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
314d377dd45ba5be4bd77e0c25ed9e97

SHA1
0bf0e88d88c997977b12e24456228788f965616b

SHA256
90f7763791be39ffb63bb3ea3195e80c1a6d60152102f6e6ade84ab35e889913

SHA512
7e28d365bfc721114bf0328ff87797f27e28b08b9cd6eb55a6f6b73433c2c7d45d1f30362da257dc6fdd91d0eb06f82038d2df980bd7de1b84799f6bfaa96aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0258a4cc6ea6c8092821d9e579210794

SHA1
3744be7711e3a559c01ed0c9e31b60b742abd552

SHA256
59a6945487f605dd1849f924cb88270a6092e8da61957bacaa330c7bb4e8aa68

SHA512
6ab8cf3979fe0b91c0a7e0a76a7087c9556c9cce97442c709dc843bb3efcf3c588107b9d1f1bb6cdd0d9790b6a9d3341464cae301a0980cee8cb9800117387e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a11935079ba50a25b2419dbfe648afc9

SHA1
4a3d160a1f7cea73e604e04fb787da737fc0c095

SHA256
d9b8e2b06a9acc2028f381db713fce02626cb1f8b0fe3a0681a9be0691f49c79

SHA512
7ff5225093e00b4b1fae6d9121b7cafb082b1296ebd51bb2fb9ba9c49491acaa56767fe15ef48c9554a3309f1babf25454e8a55f41b6b4b3b1feda8fd9dc565a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76f3ce092ff45c4e61058e4b7f0ac27c

SHA1
39962d1f6c38ec9fd431417826c5aac6ef2617b9

SHA256
cc9a11147703567e7c7385140d03d5e250cfa46816c8c34b5323b093d03aa7eb

SHA512
f22dee0a2c14593bfac4a86869360708fdc7554b8cc9c7db8c957721b3d4b349f2a2932fdffd8d3e594c1a4b13490cc5cdd79fdf0d56ef8885ac91f3e4b9c3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
819d673f9b6dc95ec7e83a771b5a2730

SHA1
fba6ced49ad98f2bda9049e3825ad7f494fa4d4e

SHA256
a3937247dc215d42498456261273181deb811c39a121a463f51485f931f83be5

SHA512
986039dcb3ee2beb6407589f5ed6a731563b852a5cf6753f788f0d4fc2d3a0e50282631296e0085055add01bab3bb4b8016b739a02e3e381fa261c7c61c26819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b129805e96e314856cdb3f2f86c74b4

SHA1
f711835ee4e0a9f6d8418ab67bcd8974bcfbf956

SHA256
bf5720ed84dd9829fd940f955d392c84ae461cf4e145db25aa2d6cf442191bd3

SHA512
aa1b56d1ef0bd76d059c8b7fc05ec0f906c11b8b5e3019aa94ad6fbef6c8abd9aabfdf8a20afb70de6884ace2df0eb7fa31b55ee6fec12b3172ff9cb5bc9ab49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8581826563b3b8e7e116f47ce03ecada

SHA1
1d2578722a1e05d7e542aa8fe3b6d122f174bb97

SHA256
c641888a3174d8522948c1d3c756dcbc0800511825095123cffe2cc6ad67d44a

SHA512
cfd065b1068fb4b36ad7fe453f9ec5b808d9deee893cf0f5c855825fad8085459544dc8b8034566449989aba98e35a587227fc7aace98e3ea219c7ca82c4e7ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad2129d7ce0db40e976e2999f06db53a

SHA1
5651167cb2f17166b2c8fdf50649cbeee5c7d74c

SHA256
8a88d5801d8c98c05fd2cb76498e64a91dc1759810a75277bc2d0301ea74ec2d

SHA512
478b4d9c6ab52b7c85ece71bfa15d9aad4bedaa8a88153bc3538d9ee7f0e0a3ee747eb28702b4cc191268edef99968e8d78598682db18bfc17eaffa3204d07e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a38731663a31b8a2b3204767d3dc553

SHA1
c029c81da2ab41c5981e19253a00303bbe08c071

SHA256
23fa62a32406b27f6d92d11c3f920a1a7db7f31adfb796fb6ddf0437a38f577e

SHA512
48fc9bd235ea7b60b442e8ab8721cfb80d01ea9c72629f340a49fb5be1a5854cff90c58f738ae998d705e3bd8c9a6bea01695a501c69c0eda0d8272b1b83fb94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6902.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar764E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit