e329f0cb0823529b5e16abf04593fb1c2d00650b345e8a4a1c5346d8b592e2b5

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3930ad1e9c0feabdb30c927fdd6e2e16.html
Size

7KB
MD5

3930ad1e9c0feabdb30c927fdd6e2e16
SHA1

02a903f98a4f6b48f27d691deb53eb4dafa4d0d3
SHA256

e329f0cb0823529b5e16abf04593fb1c2d00650b345e8a4a1c5346d8b592e2b5
SHA512

df5c9210ed376c238e01d3a5f9b17954334f5fcbb92695a8260bc63db7368e16870404ce43fa9cee3714027d96058b494cbf8b9cbd01540646844e984c2b5708
SSDEEP

96:uzVs+ux7tWLLY1k9o84d12ef7CSTUHzMcEZ7ru7f:csz7tWAYS/Vb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000d39fcdf80e16c2fdac5bbd5ae0b52c37b0244eb85a564fa7118ca367718c6b03000000000e80000000020000200000007a413ee5caf849b6833a1cc56d565cfce4e15ba7e093215a814af8514126e6cc900000001351fc0f41dc4e7fedcd91780fc7a451ba4943fabb4e2d0064e7919dc03909ae9d7391e91cbffd885a557224cd9af7c52f4d94d0832baa1189bd6edf34c12727611f2614934833cab3a510c386b5f3454fef173ab85049d33dcdb09f5c76a5641739ad6af809d94fc98357d88bb769099fef957edfc2dba186ca6d044faedc603770466405d95b91c81f9327328629de400000004ce21bc2d0896b72a9b86ba3e2f129d8729b7d85800f53328917cae876049a12918aba8781d4826ffeceec3220a566c8988c31dc13aefa0798b9de6469211ba5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411079853"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94F89F11-AFF5-11EE-98E5-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8049456a0244da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000079cacc303c18795b32cd2e7c585d8bd5aace0373802316a9c0c1839afadc5fed000000000e8000000002000020000000d2dc6d9de05b0508bd30b36df240d82ab98292e407542243468ba24f6c53d52e20000000da5cfb3eb0790233322634737d7c1aa4eb44d41bbf2e9af4523273d1fac14224400000008703b0f2da2d46cdf9d6eb96b6dec7f14b246edd783df179772a75244f0873702011cf9c518599c707fd85c9e9bb19ede459c214707266fab70cc10e0cdda433	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2324	2672	iexplore.exe	28
PID 2672 wrote to memory of 2324	2672	iexplore.exe	28
PID 2672 wrote to memory of 2324	2672	iexplore.exe	28
PID 2672 wrote to memory of 2324	2672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3930ad1e9c0feabdb30c927fdd6e2e16.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0074f24824d0215541c6603a51452b1

SHA1
48d612ea540776de8348816eca4ee4100de9f95e

SHA256
aee171e60c00f907115b8c6c0fed166a38ed5f1c5f9baaadecf5a240fcc4bc02

SHA512
1e94865a44372f230746fe65bad63deb51da4db029cea3941b5bfac21c3cd6af35694776d6708060884f35f11ab829756ce993bca8a9a367a8fff4693ca41a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
220fffaa3e942f5ecda1acdedddc9a13

SHA1
05f5ac4939a2cdf18cbcc9475617c9a5b57d2751

SHA256
a8079d995f8d4ae366e4d042dbe03b851afafa242429cbc312872d7b3a1e8785

SHA512
258e542d83fdbd26b6912e50e2edc2b543b6c317b80b7701d0ab03d2248c182a3c66be5445b171222f592b166148bae312c0b179b6da3c526ce74e0a1bf317bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31b85c473ad0b4361bbd6fd4ec262789

SHA1
73c6a87922a302ff762f5fc6bc1e87bcce5d2c79

SHA256
72ece36c2ade3bf4e757526dab3856bfcab30a9ede10be4ac1b2c7a9eca6725b

SHA512
7eef61db7d150f3b544196a8cb5c7f36b7e4948f79448d92f802b0eed59f7835a889b397b9b08d0e02aea4903f8b096f98b5a6800b6a942264b20b675b8baebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
317d5a05b4ae2d1ee3a7be1178907421

SHA1
0b5398b016ee68a787d10a41fad59613e377d931

SHA256
d91394eb6ed052eb901c67a874ed7021bea2603b7db92c86463e4a74278e0a17

SHA512
f371416ee6d7b1da4b466c15241f0395c31a5f49f52c06570d75d2db0c880ab11da11ad9254509f23dd3b3d9f2e59428dd2d6de15d331ad8b43a3962dd7d9a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
372d524964b99d388ec1ec1284417f9b

SHA1
b15b1886934621f0bc7d4127946533c0c51b4975

SHA256
69101a5d91b06e6278d0c32e9132469fbfcf884a38253716c2da0ca6baa1be4c

SHA512
dd4ace5dbd4c908c97e7627b19f242447911b8454d88e590f25fdb2f9ccb0765a9fb31ef22a2c15dbac47f2776fd66d5a59b513aff918586f5c09b79795c2e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47efe3d639db1beecbb96d414d78f735

SHA1
352ea154ca0e815ab9de18c164ea0f3a915362c0

SHA256
a3abe3e7ef455bd51fb4768822fa6bb4974e0b1e3ed04e918789a5f384a6031a

SHA512
fa273ee969e56c70b126dd1362e1623a21146651857ad4a59b221fb105d48dbb701f95c38b30b14cc2b84a557a6ba9813825339e6d05838b279974829702be79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e97525baed329b5328b82c535fee65

SHA1
47719bb5e88eee0538c47cf4ca3d03ae45e81442

SHA256
6dabcd189916aac6b2906c2549192b21d74edcdf492925537f1a8723cc22f2fd

SHA512
f74c8089e4cfa24cb80bc34b97e3070d585631f2be595cf2fff9adc9ac5a4fea4198f0724b0cea7e65cf7b0277d9d06cba4424f8c4c6341c9e55cda50397d214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c04a17be3451baefea463505bdea8cb

SHA1
bb518d7ccec7798f6ecef5a7e3328aea33aa0314

SHA256
b3c8e7edc48163ccce089c23600e0c8abfa0fe3ca3b29e6056d2308386e28700

SHA512
de42b9acfc04f4062d8a09d7c8934a420dd9b6ffa1322189d5573d75bf4a00c90e1283a4403e987dddff03b71c662fc52d449c5e87f165d9037c3a351f4b3a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3a55eeb903bc0fb72a88b484638d3b5

SHA1
2f82dc83f4808c26ca2b29ba74a35979c0740c53

SHA256
a625ac7662266a827d40f08fd6c9d9ac7fb368c1d1e48d06716807d0dc677eda

SHA512
88d0f151ad8524cfe1bdff3b4e14579f27ef7d79620ba84b8b06707da0404aa6c3ca29668b10f53140f09b3451218e2e50937793f8f82d92ec5a3c98183adb80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a4ac2fd70d543883cd47105018ba43

SHA1
d49182c7b19caa6b398b84f679dc38890aad723f

SHA256
a0163baa236923a44b70a8500e1104f0faa7664f96cf0da94fd0bcdc75d1078b

SHA512
0b3d843c2a1155238c2641a9fe74dbb7449253763ca0b33d902659d75c18b9d9732db8f12f5ce1bd3bad5ecdc9f039e50e43ae5984f32bca6f1f4bb9680ecbb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12552d64100ac34187f2ba362cf2673b

SHA1
694617077fc166be272d1bafc54fb6a3dc85dadd

SHA256
e934fbcc569b67eb97a31d98b8089612e518dd5719766e05d9671224921fca32

SHA512
3dd507df221e6e8830c0a1346bd5cdd9030ad500c0afd9499dc278417c4045f5c9c4c1d47ab6a7d7004187cf075f2d12866d038607ff52d049d3a93b2b685012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8dcfaf1efb1da3e49a157fd212e588

SHA1
90fe108d9ec80c2c274bcf3eb44352e60f59ad82

SHA256
2617f8399726fae567c42eac518c44cd4a69d3612c1e6bdf89d474ba84c11335

SHA512
dec8ec1cf046b56ffc80fbef8b749b872a14bd37ec1100dedb4e54cc8e3ea484ab210d551b3eed191a3e91ba48a0af92b6e795565cbf7a52e3f9dd6896fb219f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a6dfd28476823d11a8b1433f3d35fcf

SHA1
cf1a9c5d75415255227d993ee0e89cb2176f0c85

SHA256
5c2d1c1e7135b70f199c60b95bdf90258599469b1d642fa330f60a86cbd093c7

SHA512
ceeb51784b403ed9cd92d9743619ee3bc709d819b47567880f451da0f43599f23f21e1b58d54b5e6b9b13d7b2a5d0749942e3692b18b91a9459918553caa1f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85D5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8675.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit