e7280db701bd990c51a5e789e6004d875205046022d2de5788fc42beaedd0adf

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39fef86b35b2cce7392619a3f77eaa42.html
Size

6KB
MD5

39fef86b35b2cce7392619a3f77eaa42
SHA1

04a496c52b81ec972061e07953b706696d8cb360
SHA256

e7280db701bd990c51a5e789e6004d875205046022d2de5788fc42beaedd0adf
SHA512

9e0ad1a5b1a3cb2394197b1b35a2cfd24ca8ab599bee957c47629898dd8e14c86f6f8db9a99ec7cde806d1422110eecb77de0ecb4216ada993ea4f94a0c722df
SSDEEP

96:uzVs+ux7/0LLY1k9o84d12ef7CSTUHt/6/NcEZ7ru7f:csz7/0AYS/K4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09174c70d44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e740fd36cfd4b6d7805fb339e3aac57dc5d5c6acee5e6e8016e380c9dda0e7f3000000000e8000000002000020000000950e9c14964aad92a2a2f6f38f9f69ee1d50e34947c37593983fbca68e90cb68200000004c60c94cbdb3054fde19446191bac8da2a9c1f40dbd27fd429378d339024a56e400000002b0fa2294640a67e343fca49883b349ad628fd5eac1037eb1adf6f801c3d2f045ab80727e409f7ba952faa61f0821694c5fc9b796747402a0fabf4f35fa530bb	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007a2ca94fee7ca72db987f2ea6c7dfbe5350543f7b65a128a5a4760bfd2a3ef14000000000e80000000020000200000005477ab794195b61627917f94447305ecf00bd90d5f6df45ceeeb248e354c106d90000000c767eb9780223f1c39a3c76d21b6812ab15c4c756068940df897529409e85e847030541a7fef736e25fa3b804673626d43bc2bbe00d0f12fb7f5415fb9b616d2524d86f8eb93b3215c5986a1e69c7d4d2c524201767f5661035326840bb8616d98b534f5d90c21ac51221678870da8f0f94ac0150edd343ff95ef7b3fb4649a7c98d7795fba7e67536375e708e7b0d3140000000c37d9fe1acccce8c040f94900f73a1cab48bb6ad3de32e1c4e0ae5cf1f570d79d73f4a023175fbfd0afde506b2dca3ae71779f3118c33a7a356702e697977dbb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9A08B91-B000-11EE-B0A9-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411084706"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39fef86b35b2cce7392619a3f77eaa42.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5059a4534b48e015ede8dba4b07d859

SHA1
4464723ae1fbd4122a19b4fa82f24a1ba6d19a26

SHA256
f352710cde9bf4aa986559b8041b75ee08b3e98174ed2f6087f404c7182c2578

SHA512
b58e82c8aea2959d16c52aea69031ca48ebb34e1520fdc782f60598eab6168b56f3784b73225b9ab960b7d93b853a543bdf5b25b54214b723ea98acf4698d1ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26ad5ac2982c781c0d70f5cac3ff5727

SHA1
99c50be737700a583b3ba4aedbd0fefaedc739c4

SHA256
739fe5463cbd0750e193e64d37d672154372215e1ed8faa8cc68ab917f25917d

SHA512
4746e5e8e7b9a4d3e9987a06df1311366e4de6027477383961981edd31bc9c5acb392b22a053b7ad80dae6364a2bfaf6a820014e703bd9fef49b524a0d8bbe8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1126b49f69a337a9522f4b00c2fc829

SHA1
28a59c11f321def37f1306bed1a2a8d4cfbb2f83

SHA256
60e184272f4fdfd2458efe7b0a69fdc1bbd0042026d59bfd3dd8ca0be33edefd

SHA512
a09b799174e0d7f85a426f8cc9ce9298a5f18f6ebb5a344ecd2f596c2f33655eea3dcab019657f64bdf89c85849cf16f3a82f44323ce272089862da82d0ff9fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3a5005beb6b84ac98e4e10ced231d89

SHA1
58822a13c4482a9c29d3857b50bbe4c3528844db

SHA256
b9d7467349ad2f35a50ab6e7279d5eee3e881a4558157e16c4269370bbdaf57a

SHA512
7e009b9ab6ed04dd7f8019a8bb98f4d7d734a68ab65d4bb3f807ce648721e227b7647be3d6ac01d4634df242c38a511e79bc2dc1dc65c0d623f6857de32a11dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27e8ab074d22b9af4165a064ee3946ad

SHA1
222c6638b30b7513057331dbc1d5f4d6ad8ff26e

SHA256
c3bdffc3d8b56ee525bfa239f95001639d90235242adc735a6038ad9fdcb279f

SHA512
a3592f60f682ab377bfde68d99b93f676cb5807530c9e93822a47b7737bc2eafa040d1a71cab20b4526c353cce5218f7701eb1e42f7994b7e8bcdbb3480c1ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
923371c3523b842c7c64a5bdb525447f

SHA1
78a24e78fa8e1c61a5a090f78b62714f7bf63471

SHA256
5fe26dc34f8e7432da38849267316e074931dd43e10f07eb4e2b774f113beb27

SHA512
4b60501bdb3ec63d0b18aae190fca79e8c858fa3ad213e359fced4f23ba46b2913e08a4031ec01f09acdfb16aae86f3bc879281f9596d8b8b6fd12e1ba7dfb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ddc0eff2b004a5ce34789a014081715

SHA1
7850b4cba9525994ff07eb4b403d726f43f1be2b

SHA256
fe9f29110a15053a90289af6fdcfa647127c64651586fa7ca802f91d405e5a02

SHA512
97e2b2a7400d2d8d94b2ba6908c67c4067f014fe9abab9dfc450a9efc745e8e091a7887da240465a5d509ee875eac8259cae686eea176dfa004481281b88647f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d68e03b7ab898c5d2b4550dab7cf9ff

SHA1
e2ceea8c9c0640d74f3d125e211c0bc831c4d836

SHA256
73d68e8bc084ffbea890d09ddc51886418e21cd99879e91f31598eb0e303bc45

SHA512
4f2256cfa1a196e8f1980a0a18224bdb6efd2146106c98c35876580fd29e0a9c26ab7d92df857f592081787341eb8da727dd2d267fcc4fecaabfb704e3a6d597

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF401.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF878.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit