e82bc118f221924ad9edcd92e16b450d1119de7fb57c7955c7c0429de6a2b4a3

Analysis

max time kernel
119s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a64a1d90c80c4a81adb3b5a0837b28c.html
Size

852B
MD5

3a64a1d90c80c4a81adb3b5a0837b28c
SHA1

8d501c2ce779d20dfee4effd1ae8c4cdf65da841
SHA256

e82bc118f221924ad9edcd92e16b450d1119de7fb57c7955c7c0429de6a2b4a3
SHA512

fde1ee6a075dae7409817ce6719fb85b8855aa83eae28b62b6acf595a23d312af90adfa5b1ea1574996bbb9d51c725eac26ae9a84d733287000c66044d035fdf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410655586"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2DDC611-AC19-11EE-BD45-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09e00922640da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c708828322ac599c22f1c98c9ea35762e4462bbfb46ee2af6141b72f46cb4bb4000000000e8000000002000020000000a0c31e106e6891939f02aba5e78a9afe43a823805cdf84cb3e182d0a2c8eae6d20000000327f9e4051d4c4458b2df72b5b1648e5e1f3291ea38b978c8652bee2f6a7cf3640000000f8d4345537923d3f3f8397107289f853fcd99055c6ace2f01f0ea116789ba4b0281234b7340674cf7c73f99e2f671189721457b39e389c2cf38e0c31a95d62f0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c3b8a2858def6cfa400ac55de3f1013d7e65ccfa2cc8af1e5d4e3413681d9dfb000000000e8000000002000020000000d24d189cce2b0dd0f6075e7e1ba8d3d6f4aceafbc22b980585586e71d79477a0900000000575cebabb1831c5a43636e8fa7ec543386fc9c5f42e834b04ee431580fea9a1039d847aba38bbf13e5772c832e0e0144ba3067065377046b30540f189f44802eae7c17d57d3a2d61bf1e1f20eafcd514f1a3827d5e9ff879a794ce18e448b3c55135de9088e14f99f6e3dd5affab61e4a5ab33feaceebb96fa657fa5e7164d67700bbc49611195ea2b64dc6760a8b59400000000744b09814c1395a003d1a5b010ce157dbf6d440c245c0d5246368ce89b36453f62e2b1a55e730f5c3bd23adac7e22cfac2b42a58701199a0da99ac0e5cf7949	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2368	2504	iexplore.exe	28
PID 2504 wrote to memory of 2368	2504	iexplore.exe	28
PID 2504 wrote to memory of 2368	2504	iexplore.exe	28
PID 2504 wrote to memory of 2368	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a64a1d90c80c4a81adb3b5a0837b28c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df57c0a4fd7f98387f5bac0963ff828

SHA1
02507ac58cb765032fc04bbcae2654f109303913

SHA256
b5b8bd3327e554df50a7a55933cb26f1bc56c5a7b2e6bd8d0980fcd413d0174d

SHA512
1d65d96bed8053c50f547cc5882bc4fccb5ec80112ca22685b04fd99a6a56f3df5769182219308eeca9d3fed626bfe4c67164f6979326f8ba85cf83cc31327b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89502f3b76747c48463f4acbf78a8484

SHA1
3d323f706cc16f21a6deede3101288a0f68e8b1b

SHA256
612cdbd398aa9a6cc41e87dcb2121e9c0d2fb745853d511661dd9da69c17f946

SHA512
8d971ada51dcc1ec55398124b623c58e298a5b885b15ea6d96339322ec8b5b868501798d61bd4897dc0dd68ffcacc4792f53ab411c3a69eb152bffa91c209a56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f5e76c607ae61bcbcfb74483d923ebd

SHA1
7fa243d20c16a1e10be936f8589a7e89ddbd9187

SHA256
c8d8fe61cdcdf6979dbcd1282538c19e17bab31ffd094094e38fb6d924092447

SHA512
a6dc113b9a8294599e90160ad83c63982ba63a44ffbf46f8ddb01e7f6371a1c1d423915cb4eafdcb1e8f9b22ef377c4dd25d082740148f8f66e10fcffa38ee86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25514dbee3d7720d9e8d38f91ac6fd61

SHA1
2be52aa54b08016c5c73281af8b8d8f42fe053e7

SHA256
08fb66aeeacb71f328f75a6865dfbf7f5083f5e43aef2fa2b3d5befbd0aca71b

SHA512
626e3865b41d160ac5dfa5316ae79daad9afe63c55544eb3c3c04deef5a3e4b5ab88b2b64f6a4d416692d62efc70d2f514462746089d38d3eb244f83fc177484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2105fc550efe285388f50ce9f75905a4

SHA1
26fc038d681e9faa7e1068ebd3d35db8cba42feb

SHA256
1dbf839ef2446370bb9723a8561ec4523cec40349e60dd32205e6d27e5a4dd42

SHA512
c8b7e6fe49ee71e5f3c32dccb4ab4ba4b27eefbd1ffe4c2ebf857761ca2b58adbac0b971954eeec1c15d7b03a7f43bafa6d82fc5981d6d1a5b2819cf73a18a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5d88e4675ffa13e762f9c5fa39974c6

SHA1
87a26fb962fd54101d6689e344f64a7075216e96

SHA256
dce7f6ab63dce6ca98868a9d166bd1dfe822386c1052d5ec022f430a022634b4

SHA512
8a34cdf4b860bdda64ffbf4df0be31049eaabf71337c8775207afa4d77f1a3bf395bfa81a78ef34dd2b42362187f91bb682302025c0c2a1141850ff23bc46ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc54b70c1e783471a9e36837afb09d3

SHA1
f0850f213ed41d7b866e448b62308c1f72b15c79

SHA256
10c7490e499efd47c256f21843d8b617dd8e56b6817e8187ab8e3a8bddcb172b

SHA512
b983546ff64e02bb4f2d2affecabaa31a283c871696d6d6533bc202e9fc97b99d6a0608421ccac7f5a0793747c3d03ff4ce46407a2469ae9a7742dacc95260c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cdddeba3c816aa2d7b378ec3335a6d7

SHA1
0e558581621f40c2589a2b10d1b0be4a7956f674

SHA256
c38b8ab44dfdf10ce3631155f2f4dcda3cfdbd7f7b1cca14349feed8e9b1cbfc

SHA512
b6dd82d6f034d55c1cd4acaf299f0a41419909accc6b060aeb05a889459e5bfa1122d2afdf5bbb4c6f2a4689e0d49a8f4233640a24ddb04ee55d62d1f27f12f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e805270c77509d2fa2200a8863cd45d3

SHA1
9ca7ce5a7a446955de5dc8fc392222cbc50981d0

SHA256
1566015e84ac7071e6e16123e020ef34b5027e1289a796afe907855fd818d0aa

SHA512
908a325fd0b894cd4274dc72cc8d1258d674f7af8f11465c08bc151880da004e1913764ceb4bd8edaadcbed0e98bcc6ecfbd2404e5ef005f925a5908316e151f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
569fbaf470a526898d80927067867afc

SHA1
18cb65dcb22515a8bbff658f7c5475f1fecb5751

SHA256
01a06ae4fbb06fe536aa430196dee296ea8d56724bcfeea842d4c26eb062ebec

SHA512
beb52b27ad65b4421d21678d0ed7ac282b9aae6474097bb641ed957d5813d3a71e0da802190b519ca46080ee49e70d39015c01f4b03bbd03acd5f6d8ad4d3303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c32e0b56747723131e3b7f596299c32

SHA1
a7a92fdb1b49c77c7b48569e246591ac2546c794

SHA256
25630a03a23456582c41252694ab4b572c58842ee92a5af2a795e65cd6c83eb3

SHA512
c6c37bc6f4276899e75001fa5138d0011d0ec1a3d89158627d03e14026ab31b5d439cb8cea50db54b9f854a2f7aae7a4d1180f73d3cd21e0eb50ecac235a1c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9692f1db5d90748b9a010edf28449469

SHA1
1bd52c49c1a803b94492f73fea631edeb82bfdf9

SHA256
0844088451cd60636c12dc5e618fe5cd6f2f1d2222bd331e3b5e87f3c547255f

SHA512
438e763dc012d47c5dfb64bbdc4d0280f6db99932a3111276aadb59781af79445d276c6d144b506da7b5baf22064fc1b2fa7bb8eb3d8c4384e228f3949be3ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bcb395de394643b6e8fbf163871da94

SHA1
78a1b3d6f599f4980c56972c33e3a93900573d39

SHA256
bc2db87f6ed1b923bc0b6d5986baa80fd59cb8ad2161ef9c1bd2e55926016a6b

SHA512
e3fd16e2964f3d666ecbeb28534fb2b34c160fbc082818c52a3a1d6d71109e3ca64972d5e1ce426e5c4e564d81ced972ff114021f8c981cfa01b0003f415276c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf04381ac1e701adf9ccc6578ce820e6

SHA1
0b4e6c34cd80c868994ec207cadc6f00e6fea1f8

SHA256
a2e58f77d0147e9271a97b247bd3fb974398eaaf4f8726a508d6276b827a0634

SHA512
e270f2a3c7954c3c74c8c473945bbf32789ccf7c4b27d8577e1c457a1f1a42a3e3ef048cf665d78d463f20d274e6140c09c8a33fbdb4c7e5b48803c8b519abd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCAD0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB02.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit