e8071122688ca7609a11f2fb2ebd1cbbc67d3a0a560e00ba4256c79c0682b060

Analysis

max time kernel
118s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39e94ec0a3dcdfafd76cc1fd6835688d.html
Size

53KB
MD5

39e94ec0a3dcdfafd76cc1fd6835688d
SHA1

2da9a9bc97f311e94c063d8d5a5ff96df830eb12
SHA256

e8071122688ca7609a11f2fb2ebd1cbbc67d3a0a560e00ba4256c79c0682b060
SHA512

d486ed6782c313246a5ea599782b247c3c6bc474bb3423040a3c0486e68396620519938871779076143242569c4589e3e344ef409d91ea3122d33283aece1bcf
SSDEEP

1536:CkgUiIakTqGivi+PyU0runlYr63Nj+q5VyvR0w2AzTICbbcok/t9M/dNwIUTDmDh:CkgUiIakTqGivi+PyU0runlYr63Nj+q2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603e3d1f1140da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000273f479b1878dab31a3285e855ceef6f079f3b52d9c4eadd84193fe20123e7b9000000000e800000000200002000000042b88e12ef2bb939cab808c2fdffe1239bc4258b428106b779693298c8eccd6e90000000d9562e232a101cfc90b6c09bf81cc5f2f79a7fcc51b77d972f4ff9782eaf7c20ec21ffcb2682124dde62da994b40e7357102514d82ef398e9eb86aabd317ecd10f8d586b5299ecd942ab7fae604ec9af1f99f87788ba5a528c513329e25f3cc5adaccb7703a8416603ddf3961a125cf4ec0dd56ad0502db03219a207f52645b109a4f168c0c74c1271b70819ad71370540000000e452d2a334f14bf6c7245fa3304053963f8e03138576d243626122a963bd3e2c6c22cd9d20c47a91cad3531538020b80663e2d9daa6785c7751e253e2b72eaec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410646331"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009b4e40ed5de7c79cd1761615c5e48f1bc58c9ecd84079218b03ded8b38f0d344000000000e800000000200002000000097f88b5f40d3238ae544203af38d8d4d4d75bc43ac61333cb46bcfaebe6e81ec20000000b07871bc61e23f68de98ced693944d83023b6106522eb4b72c1e59ef8090bc03400000002d4b107b3d2108a7e0efceb3cb9b938a4bd11371365cc5b94171a9c3817d0ffe4dd623a8528543f17af8ad2d4f9f2b8cc57a88ef975ec192b963cb228717e0a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3639E2D1-AC04-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2808	2184	iexplore.exe	28
PID 2184 wrote to memory of 2808	2184	iexplore.exe	28
PID 2184 wrote to memory of 2808	2184	iexplore.exe	28
PID 2184 wrote to memory of 2808	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39e94ec0a3dcdfafd76cc1fd6835688d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26d339b0a5fe723e6a404531e9f1cc80

SHA1
a5948bf7c0099a5fe993a60fba84e78937e6bb64

SHA256
64e4b21ac32545b853d0924c61241a47a14f5586df56ccabbbc0d9b4af3c9b9b

SHA512
3a2ef7595f814a40f65322ef974b725fc72f84adbf28bfaba00abcaed120e7eeb1c044433778d7f0865e43183501d8c8db13c121303a1b55777bb2b970b43585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b5c33beaab03f750c5bec981072b2b2

SHA1
8fbea50948d03c8f3ad8cbd2116d3d71319380bb

SHA256
350792ecdd4ee0d05a3e541ea5c98711ac806d6576ca7ef19fe319bddbefb39a

SHA512
00a343048c6b02261c835f5f81fa3ba1c90dad534c1b55f143b41c487c4b9e98cca7961bdd106e642049788c0cf07434c1ed3e8346f671f53ed12f008de6b77f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92c86d6440e65eef2171a1097df41c32

SHA1
3ea58364dcde94a84999235c886d1d24e0c4bcd3

SHA256
10829632a86a73fe68f48f666a82fe1951db7fabcd06769868c24090f387b6e0

SHA512
82eccec1a4ee0fd7782dd684c53623a706cb55d55b3e870ae4fc3fa4b35f1050b83874f444fe8c932dc238255cddd64104ee42ab45ed794ce7b2a2918b588fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52bac17f9f466ffbad6143d7243ff1d1

SHA1
ff62e57d1418e069123a42d0030d993cb2d34706

SHA256
ca150372493a3f63c6924075c8a0bbc726271532164c75cfd4ee29fd6ccf70da

SHA512
f0c317ba237699b793627b00bab3a0030c11690e7825dc96dd860aeafdd50b444872e2d2b6b92ac46d387534ef2cc247a38654f5912f453b9b0c11f00216bbae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cf20d5764c304dc924539bcdb12a37f

SHA1
af2c2978434450ad24328d0b432807586fb9ae23

SHA256
173b911ba9d6680c7104635f03a9d09d3137e6e28aff2c849dc0eb31accda7ef

SHA512
bb2acaf2745807c65dcb4514087d79edf2a11877fcb36a662f3ce880f881f672a2a0906c55224d61483c515b707c38d27ed0ff32de590061f0eb9bdaa9156011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f431968d094df32d07ee2a6fa6bd70

SHA1
f9264687f254394ea7736ea22043635d849d82b2

SHA256
ff26d8b60cd96a95c0e50bfc82fa45cbf1edacc92a009543c72aa50bb872a515

SHA512
e61932ceb32af3988ccd008878a7eb4ee5d896bcfc041c8df7386780b3e2040a7bc93f7b8e8b647fa0f9d6f55043a5f7041a96f93337cb904a02e0eaf4953be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
300eebb5ee7311ab1fd74f7260d1cc3a

SHA1
d26476b2ab4b7ef1017e76541a741f4328980149

SHA256
62afdfb69fe17733f08f8c6b57fcf35e3bfe50042879ae7c1c193e36a6bd0271

SHA512
2c7bff9f0cd6cd281b6c5e5b6ad363ff2e16667b64b0c236ec18d1cbde615737430b2c78bf9ffbea6d3124f86cdc3c636063fed78af952ce2c590951ec534a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59c70e1f3f77936df1bcef5fcf7cf79b

SHA1
7b8611e49a2c78e9715ea20848de0b878a73dac9

SHA256
8591ae186d5724164d3954de6c765cf7d2cba31c3e945ce3922753695b5cf3be

SHA512
e821e77230f89cef7a9eb9499be88d2287c969eb1c29ebb55ffe9bafeb239de00877acc2f660b4524350c35bb4bf0438c7a5fafd29e6cac35946a27cddb947db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d080cba28524c14d489d19dad8207e4e

SHA1
072c1f0a13ff5b333e0c85531461e32f119a51b7

SHA256
c18850fdc32b5e37109fb27cd41281579fc68d4d7ded42a6f3fcdfe2a00264e4

SHA512
82908ca16fcc86b47aefecea45011ff5369acc64eeb6c796896716ccb0cd48093501305d762068807719757b276130a5a3b7cb792011de8b9a0e414087875497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC05.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2439.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit