4437ff3497f98d877966540205a3be076b27a894d2b5f205008801d44b87dbdb

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

396e08e5c776c6105d656262a2dfa29b.html
Size

6KB
MD5

396e08e5c776c6105d656262a2dfa29b
SHA1

97a83280897c66a9b8603f89c25525b7ddd5511a
SHA256

4437ff3497f98d877966540205a3be076b27a894d2b5f205008801d44b87dbdb
SHA512

30b41c7ead264c019f2ee38f3190f8f3100377bc4aec25b4d6db3d3a72e25e5eb9357c94c8dadb39b952830f1fccf014afee0be86be675d14d6da62322429229
SSDEEP

192:Zy/O8yw4RlDEvHLgszgAy9ydXDChxiqEuf:8/O8yXRiLgszgAy99iqEuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000002e0a77d5342446d985001bc8af60cdada9fc5eec0e9cbd8f137dfcdfb7b1c90000000000e800000000200002000000088e9e239243bd92ac42981c31df3f0577d2551d9aee0e14516326793a31b967820000000eef217bfce0587ece3db1cb6398134376d55c22371b0b3df9baffdc164a85260400000000b1ba3394174efdf1ea53358be94746382b06319905f3738f02b523546dd868efedba70c274ae9eef3d22b5a5b72d132080a535eff4a31e379321539cb4827a8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410635725"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000a25d2d93f7a7bad354d10ca35dd36c5efa57d251d408e2d8594e42612efbfe9000000000e80000000020000200000004fe5489b90666263de6e09e24f2ca06e625b4891b5ed5d9b0bd9c02d12fb668490000000be5ba8fd71c8d3654274331a9a3c35ef5c532d7750e09da04f4d6dc8dcd851eff04b2516999d917798c7e7791f1ef8aa04ec54968a14aebada8fad1dc760879c7eaf44b582396f90b92f738e716402f763a393cbb5355c0e7428ac500980b9f33d20f8a1622c0e72af63ec6f5d80ea8c7fd72d8776e72f8e9d3e87bd57bf8fb827ee8a1418b21354cfba1f4fa0169efd40000000cef12f304b697069a6a82103391e1ad4c23e5fcc96f141b11ba84cf77ca96daa19d31b6be307693e55d6f1e8d1aa085893b021738f729a8eeb74b5048c5487c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100e8b5bf83fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{862D2591-ABEB-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
828	iexplore.exe
828	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2472	828	iexplore.exe	28
PID 828 wrote to memory of 2472	828	iexplore.exe	28
PID 828 wrote to memory of 2472	828	iexplore.exe	28
PID 828 wrote to memory of 2472	828	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\396e08e5c776c6105d656262a2dfa29b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:828 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f38b6771597112705629971360aff8

SHA1
da1b4c18ab0ffc350e4b26f5dbeab76a92618e7c

SHA256
3e4737f4b002b291fdb310a2b5be86c83bedb938ba6608b99eb043eab014a8db

SHA512
56d6eae9ce09d4cbd78c218c3a1689b1eb157645bc2b34b53f34e0916d380819e21cacbc2c3fb09d10e2492a24c4d7f104877aab9983072929aa38be5eddc3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a850e9cdcdc8632f2caa121d87f35f

SHA1
97acbfeadaeaad0765f9f83465615eabdcf31de8

SHA256
a5c33e71a0721556edfc32b51e0b82ea0f5490682533d81b88ad10c6e07718ab

SHA512
7f204f4e494eafc92b041cde421e62c85c9d2e0429c49bb7e23bbb03d870bf51c0705b9cc594333260e33441ff30e5ae6166bab46663746c42dfb256b94976d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
812fb5c6f401380e824b204404591329

SHA1
5e842561e31b4969f309d5259915265edf18f1c7

SHA256
5e0b0b9d8a1e66b95df301eef88ff543ae3e414696f811b996a341cf7b5c1daf

SHA512
384224163e05f83add8e5146c7ec4d4d86380e318cdc6ee0b46c6813744a6fdc6eac298dd3177fc24e807e841f478035da00392453809c39f170f7a8fe7b23bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08785e0f4f86ecb86dcc47057286aae5

SHA1
3b76df752d879e510005831b10e70448be80a3fa

SHA256
e053b97ecacd328bb923b5c7ea4c12d1931efb17fd2b32eb0c635fc57abab067

SHA512
25b119fcad30591de5636f9cdaf17daaa03362362b7a4bd4d15ea875c17d6433d5e475046625300f03c6770cda10c8c6454f0538f1ca76f3ecabe1f44dcf3a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
635148617c25ccf444afcc58a51ae835

SHA1
22e7a5562035399b7b5692ca055d042ebeb6dc3c

SHA256
6e06fe86e8da1703c79bef65fb8b8fa6f70cce1acdb74e63d78d1ab6ad9711f8

SHA512
8b75e0bb63fd1476b9fae56ec6a71d05591eecf3b811dc98b452481d1b5b4bb9639fb7e3c465a22fdf5143a37cbcbd8ea797c7307abdbc71315c0182bff87037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b95cf6cf4d1e3b81018e95ec85c15e17

SHA1
22603bb417b3bef35287b8877a8985f322db8929

SHA256
ebb1565e55d0edfdc05a223b251d33b4a2adf1cbdeb8364806c814aba5dfbf67

SHA512
cfa01ac98663cf4a0eb58312625bbf01517f6882ab138feb16b03f9c79f3f5559e7f3e3aef5d69e35c01fd71414827e0bb35f6f8ef41f4d49da90c68d0de1d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0f82fac479b0b9ab99d3df4d8426d6

SHA1
3939d2a14a76d946ea5eb354e58657926d5acf37

SHA256
7067d4f4b5d82b74579e65e098f2078edfabfe9f4794756a5ecca609ef313ae4

SHA512
9d53c3753e679c7764491a8d3c8f05b02c7f7d199887465a7d20dff3109a41a203d89a6a29510e7c69e62ab3bda62a23e42b196cf4163d2f1abcfe1f524bf8ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461bed4b25d0def4f08189a3561eafde

SHA1
7f5b97451132a0f5c30bfd8ae661d2295dd93e7e

SHA256
9457a48bc8ba22367c68ff9033e4d0d0d96426331b682c5ca4c0201f4bd1a269

SHA512
f73194106820a0c137f3275860a34f5dda33d72e7ddc0162b4ee10b8ace11398471f9ffc62f79239b99d1cb9ae03888736c5dfc176ac6fd05639c71b37f98657

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA20C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB14.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit