478c1a632aead03730120a5eb4f291186b78494b68ba3d7688bd6e8c1bf70c2b

Analysis

max time kernel
0s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a43373607bf52fe3c1d69f4d5dc21b6.html
Size

36KB
MD5

3a43373607bf52fe3c1d69f4d5dc21b6
SHA1

1081247d88d0cff5cf824f059b9b901456404536
SHA256

478c1a632aead03730120a5eb4f291186b78494b68ba3d7688bd6e8c1bf70c2b
SHA512

0a95b0f68bffec6248c454fbc227cf387982cacabff86e225e483221cb6d79b4047d53c7ea5d1c6385959f7c7a726bd23c1e327b28f58acbaf36df6860f4d1e5
SSDEEP

768:S6VQVwdQXKhtcxjyMPv6g55jDaHwkIS/r37FXvuYFHoeiUjclGbJf+kOpbsWDta+:S6VQVwdQXKhtcxjyMPv6g55jDarIS/rI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6013CC21-B004-11EE-B49B-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2964	2028	iexplore.exe	15
PID 2028 wrote to memory of 2964	2028	iexplore.exe	15
PID 2028 wrote to memory of 2964	2028	iexplore.exe	15
PID 2028 wrote to memory of 2964	2028	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a43373607bf52fe3c1d69f4d5dc21b6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ba23628b8b1203a0c7dc3d14759409

SHA1
889d0e419b60415fbf039ec2a90aab0b8a1d82d7

SHA256
6084aedaf9442da3322d0e2ef47e52d050c69dc437ace15b728aa0155c908c98

SHA512
d9f3c0ce1a32aa3004ff2d5c14fb8058e40303112afe86a638097d62553040cca9a30bad788dd0837c8e0ec64f1d182dad78881073a2626da0c2a19d03513512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3303c98a9edce21019ab4016e516423

SHA1
f5301a6eaf38275f1390444cef4044efb5616704

SHA256
746828612fe540d5eccab3b7f72c9e248dc1b543e18038abd8de20ddfd8830d3

SHA512
3c28073566d17ba89ff2c7cbe22a2c45f5a484554e51baf8680294f11d94b4d4c6d43545c5ff76f4abee00a68206a5bca3f29877f232a34f4df085e99b03e9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d2f247f4add3571301ce8db39c881b9

SHA1
2edfb9265f0ed3f448b8e1860f61925b978702b3

SHA256
aa011b7559da5eea6094a1202c4fbb64023e78a81d4cb332ab3de32dbedeb57b

SHA512
715076fc2ca2dea3154c958d820f3342ea3e65b3d556392e3233c99143a8cba686a3eed0cc2b1261e098b68aaaa3108896d783e39f19fd3283d1473a52f7493d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a25652c7111aebea824a011cae063a7f

SHA1
3ce2cdfd5b8fa55c46dfd4b00d28023ba29cc370

SHA256
27b757734b944cf4d06107420a6d4f4ffd7ef009c40aa4d2a5225cdb0e0ce310

SHA512
f9e4e6e3e9a7dd9d324fce688df7ab5aa743f1dac6c777395f6788857d3206c9caca026144e6a3b0d13874f5de435a456e4d6dcea12ca9521a6eb525136cef86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b876525f684a55b30edb06775d46870a

SHA1
213de1b7915b5fc0ddd7efa45ef25523cd43bf4f

SHA256
cac4ac65d531ba908ea91e3641a8382423d7dfb335a52c2fc9fe5dd42b205905

SHA512
03e6637df2dbfc88c3f5673ae025183c7a4a866fa3e3aa9a95f09a016a770d06285c9d7ed5e6546119cff2892ddc3ca859ac0749108ffd49bab24e841af627a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fad03dd4f9a542dd6d7bbdd43663191

SHA1
9860b71eebf0b27ae5b7a09d5d72a91c1fb51938

SHA256
259943116b012b825740ed8834ecae2eb0fa21393d90b7d48539f1881e34585e

SHA512
226a58a91e0bb554f9490dba785ec7ac8611eac7c563c1e58ac19c5e38cc66967e53c2e8aab718a30bf62a47a0c0ab3665b3249c1033a7df55c1ab609c0bedd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae1a79b690bb5582583c4d509cea7db

SHA1
98bd152f7df7f41a180dbc751648832aa7a59923

SHA256
dcec7b91af038f764f89332962cbf133cf3dfc3d9398d02b5d8c22cd34842c8d

SHA512
2f172e244c5054a1db5aa7cfc7cb9788e3d98f19f5402e0ab0cbcda17f9807a9cd7b5e1584dde2ac0fc0ba83b1dfd07a5b01c65619e5f36eb4342b2441bc7bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddb55ba042c9fc774a364822d942b1bd

SHA1
47d130cc466798b12c9c40dfe07fea1cc0d0673f

SHA256
4c9ab83a10fbe9e3cd89a01e04c934c5b45908a53e041a41139c0584053e2ca2

SHA512
d247466a735639f535db6d6a01399487f1229cbceb21881f43f8b2e5bad9741e9f42d9b1490bd7373537326f8a15897469d5018d44d46c128d2cc37d39551039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac4a66f3c536cb9b6cf7a644cdfb55e

SHA1
855dd2b979ee5b838a549db8860ab043343eca4c

SHA256
bacde7a1ec4bb63f183041e6602136ee851e3f6ec1ab6001e586f633af066d58

SHA512
433f434d078da50c6ca49a492cc9aef19a0750c164ae5193262e5046cda1d5fb890fba5bbbb9ff1a1b745c64f763ecb64bda88ce600772ef3b7676dbd1748f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD128.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit