6c6d145c9919e612244a5bfdb69a170e781249c65549e879e3538d0247136822

Analysis

max time kernel
155s
max time network
181s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a752687b1ccaa8e15c979afc88d24de.html
Size

121KB
MD5

3a752687b1ccaa8e15c979afc88d24de
SHA1

7002dde48235272a58939af86ae5d7d401edf6a9
SHA256

6c6d145c9919e612244a5bfdb69a170e781249c65549e879e3538d0247136822
SHA512

4359ba05f6a1f249e390211e7b4f8344eb5f8cbd1fa5cd17d64b524fa8c215d387031a05f3ffd9e647d835334f170fd69db8e0150861aae7476941a1bca0d106
SSDEEP

768:UxxgY+vTgvlNMQmsvvQAGcB/9btp0jP5777y2YR+xhSjfgxxSETRMlth3AFuDpzR:yu3U7rpXVtpEPxfS7CxSuUthXl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206ad8271444da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003fe8d93745c83f8b36408f6005c8db9ecd5f7f8efc187097a40824d701de8625000000000e800000000200002000000085fffa88d8c7f940bc7a944f242f3587f240d0acbe81486fbb2f2937b0c271ac200000003f2b8492f3446dc8c730e4e383b52a7dbecdbfd02babfffe575bb6fc7d41a21440000000c6dd0aea862d858dc370248f6648140e8f49f45a66792b4fb61b850d08ad7a74c1defb35dc63e19660aecd7901828673449d977ee8afc1dedca5623fd615373d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000001e2de3d561e4a1c9110edfc96b00439264288161b7805a24d71ad9f408054ced000000000e80000000020000200000007780d81f00d212a70d624a06d297e7b39d7fe97aeb3d1275238d4366b941b6b590000000c184b76af1bc9a3b16432223ccd4ba2be4754de2eb3c0633b9d9774e49c6d2d6ed95ddc56754a7c7e92c506ffe603c214a1e5c4d9573dfbe20d40cce581cdceace24f942e09b5a7e4aeb8662467df21f0fd35d2611cec37b891040008adbb137180687fc6a35dde016a2584abfc71f9921da7d6cf12962ed1ab018f1a41f05b4b6583d864e99c6c54439907116d2b3f6400000004f82f1b04b388f6e21242bddb89cb5b8327382f64e50b5de5f909d12485ebd2be24005ddba28d94a8872dc46d638e7012a194d8cbe690e8c93cc5157d6e40903	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C794441-B007-11EE-9075-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411087435"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2720	2760	iexplore.exe	28
PID 2760 wrote to memory of 2720	2760	iexplore.exe	28
PID 2760 wrote to memory of 2720	2760	iexplore.exe	28
PID 2760 wrote to memory of 2720	2760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a752687b1ccaa8e15c979afc88d24de.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99b7eca37a2d797066785897c6f20a9

SHA1
1e9fe02bc9825bbc22d2cdd54bc198d60b2b53b2

SHA256
8bd6cbf0a70d7a4c41d75a9d11ee02be89da7825f421d62061390c8199736e9f

SHA512
65cda8164270b80865446e8243ff25b21d5217652329a75eecb050cbbcaac10c9cb0bd30622ac0e79ab689f2c30c6ae2a02f2bc0f932b7d75b54376cfb00f280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdbec3cd965bb490c32de9b9e70bf3c0

SHA1
3b4dff704cc7c0ad4aba6e45f6a589d51fbd8fb2

SHA256
dc0075e20520a5d369c6b9c023c9523eef1ef39b0738304d7a62d622534b6718

SHA512
d0be1d6fe1b07e588b1ff409c62f2332f71d8ee2a9c51395a3927ee7242f77f0510216c738a1637e0741dbf004c33e27c941c7f3383c15561e9f46d9011d8080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
472fca6598fb3ebed4456d4eae46c3d0

SHA1
4aab123d244eb501873d0bd5173e7ee5a3dceabb

SHA256
2843463a27cb86d4d8eef6933d763bd3bdb52b4504c89dc16a90a81ebfc1fe51

SHA512
630800f84596d989556f9f1667f4e6c3ebca9f664d2164b269a404253ab6e7071944971b2dd1808220153e25d3186f339584d894189380f51cc0b21ef1deaa23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b501cd2306ee988534402529c5eaf14

SHA1
4fb6eb3c4fb8f61ec040af5383ff9ccb230793fe

SHA256
11301df02599ce2dc4d38824ed5bd9433ab1e542367d781ebc1ef00ac51bc771

SHA512
4cca08da2ecc72fa1bef321187490b11e2603654740f3030eabd6f460d72e43961031ce530b4d2482e99e3480dc31e342a7edbeab210120c26d90d95890eb1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d4a6282757de1afe2108eed9c3360f9

SHA1
689c6ce742e7e1babdf395b9f955abaf9d3f1e01

SHA256
489f8e9965706e476b24e653760bd01de5e896d8eb90ab7a670b19c8f0f7497a

SHA512
cd63bc6c938ecb99790d572a777af05ca9f850ce7faef8da833d146335a875cd151074b8b7ae8a8beed44cdb893f1e10d32c7e73be0a7693ee77b98f0f9276a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
160171fdb836f5efac7403daa0b81e06

SHA1
a611be5b1d557506b7638ad6f22030f195054dfe

SHA256
e47abf3c763ef2f3fb97d40248bd4731be5542feacc7e891bc0ff7e76bc74e2d

SHA512
da230d6203977def178dda231679c784f3135e5c7d433f5c98901b9eab96fccbeebe0bf353bf367a7a03961a77fcf411d2dd78f8d20c5c2e2c2fbca7c54109fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e3eda4b67183fb85a5d15d148088e0

SHA1
d80cf10b1b8d7d7beae77d74f0c47618db3b5714

SHA256
6f0618dc59da2f16c13a3a4704c4bd1018d2f1d1ad2ba1f1d7f740c613e91d1a

SHA512
07605d77699a7fa7eda8a2c15315f0ac6ea4fd6b6ebdcce8b938b3914786b8d475cd5ab472a6e278afc888b77bb9180b37362f106f08aff2b4041de108aa7328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b7597ab2b9c498c73083478ae3e4125

SHA1
8bf37ca1beb7950381262a0df49959ead65c3771

SHA256
d6d2a443c20cb5a90c340def218bf264c2606437ada3d40f9ce6e745e0442060

SHA512
3fb7b0448787720f0981d302735c9483dc92d9e59bb49f2a33eb2bb22de0445c2a3704778ff5301a3e2fe67c5458530b8877a1e8b138c6e5f3235cac395aa19f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a0fe04767f0fa759a2b097c46c5eb40

SHA1
a0190dbb56190f7d10c48f07bd2a1422a150b296

SHA256
0c4b54889097965a64a19801af3525dfff4df3b8a60d90115a8a1f8e4d4552e2

SHA512
d6a4a25fee4f791e79eb25ef3f7ab59136abb334dffbc7e9655be291320af90e51ed37a773077df44994fdc9a43bac0cadf4f3f8aa22c0cf93bab08edd95725c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5740e55f934cf08ea46402487979ee55

SHA1
83091ee2ba8ec6850cf94779eee682d77c822c81

SHA256
b80331b8700a20fc73af841279569bfc807e213a641b83e8cbd65cc505ff6295

SHA512
9aa6de94d12cd6db070d4c3d39864fbabb79fc6df008bb2853a25d7e55a0fe1c2b82699739119f5b7c291b7475cb88f812c4060059435dd7ddec66ce0a8d12fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2535562df99984870d99811e47136f5

SHA1
f95bd8bed6599945b815592645ed0ab9a729e66d

SHA256
b54e87a32f924fcbc7af8bbe954413ed376c03f8622d5ee1b2c8353e7fcfc423

SHA512
3f0311682439bfffeae0ae2d8a05ad1a0a32a6b417597066c6c2c96c781ee7cb96a1fdf3178a298d26c5cea0aa9d0c786d1be848ee46eacee4c8e6a9f9fdbecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94f1a3b3979613b0d3ce041f9eed56fd

SHA1
710323c630f49188a7cc58ad70f86ca459324197

SHA256
c5e896168d2a155178eaba15e8816d537523152a1c40dfb6b28626ded5a192c6

SHA512
e24b84b2f6411baf2a6b437e255c4aad49a1aa5499c4c80c0b42d85fe1aa9fc141d5221383bdace2977458cf71a1bd20fcd88fe308c74917a1728fd00777deb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563dedc58528005afa6ffc1d7e723028

SHA1
80bbd2b079f4f3a392e71413795b2527fead96ba

SHA256
4c709923bc3c1d2aa0d4fc2db761bbe2646d01ee58b388f38209c5ba9b98e9ed

SHA512
90345c438600be8a0493a279f62de209d42941a81c736c9741879490186f3bd94075fb1ae9bd4d4f2bf15e7178f08fb4f59d7b5896f7ecb04e2090f2f373ecda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a93acfbccc3686b508f990eb06dda61

SHA1
399ca666ade9f66c600fde3df8aae2409c394670

SHA256
fdac08b3245f7345e71cc82de57d1a39c1e949607665131cf5521d322b688895

SHA512
54369adc4fde83426c2151ee13a370dfb139b23420d054efd73f84f2b8b9d24dc69d2cff8fda4b7b024d473c46cf67be2a094e599a9c9b49326518cb30000910

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CB3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5CF3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit