703896dbd38b23c981a200d5e94c2cafb50b67f78cfb88219f6f293f3dfcb14a

Analysis

max time kernel
124s
max time network
184s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ac2c15d31d36b51f16bf923ef5c066d.html
Size

16KB
MD5

3ac2c15d31d36b51f16bf923ef5c066d
SHA1

577d06a93c26f586c476b6aab4b31d3a42508460
SHA256

703896dbd38b23c981a200d5e94c2cafb50b67f78cfb88219f6f293f3dfcb14a
SHA512

a30076f6c1cae21b1da3666238064e78116f1df2fb5cbc029557a3fd7a9709e3ef636642930936cb92c0c6e23c78b3cb62cad3abcdd4ea989e7dc09fd02514f8
SSDEEP

384:FUaOIxUR4xb5xKrwtOPP/aueP8LANW4uq3N+ppxP4JYuh/FxKrwtOyNIh:Npb8s3N+TxP0y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F0AA711-B00B-11EE-A62B-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02eb2571844da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000005538c9888f78e890692b6b2458a28e367824899c522c5840a719a485c6244913000000000e8000000002000020000000f65ff5833c92a84fbed5641f31dedd7f1bd62d80469b695628f8825520c4922e9000000030c143e38f9850fdf65f2672072b4f759b521c95aef323bcc17acdcd6e3c01b2ea5c79af429f3fed9e520be98e3faff479af63d9f59f5294c77900991cb6dc1b2d5a5afb24d3cb66231e2108fcbcde05bd6e8a0d5e11b2073309afe481c63a194f80f279ba64eb0ca4d4f30609ae69257739262e7dbc1e159ee680411006bf9af77aa11ea877fd43cb99848180835dcf40000000b126b7a2bbd29da85dcbe175561cd38865793fda96aa77ae247c5f954cb35244bce93dc3bd558b15c7f77416ab8ca3b568ce7cb6d497746a67f9f338c7100298	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f65d96b244c5b9b32a395939e982bc83690d48a2bddfddb54dda76754ac89dd2000000000e80000000020000200000007818d949e92807475e9ae79da8e7a740e02723189546875b1a3aa91578dbcce32000000037b27b71d90a0aed03c21cae40c678b15721e6f61b9b142ea005b36731a33f984000000014493a5876c90f7a11e165224cbe81cf57f5dfdb13acac29ecb2dbfff09f861385c50d86d6c677abb928775173880a3716b0a6afc1523b66a93b48e1922f9c42	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411089247"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2980	2828	iexplore.exe	28
PID 2828 wrote to memory of 2980	2828	iexplore.exe	28
PID 2828 wrote to memory of 2980	2828	iexplore.exe	28
PID 2828 wrote to memory of 2980	2828	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ac2c15d31d36b51f16bf923ef5c066d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6329df97cfd60464f7f16cdc73eafead

SHA1
f0223f8f500b538fa52d90e48f079d2bfeba9c4d

SHA256
92a664edb51678fb90a1f3535b2f2d374f0557f1145f694bf5cc8d3869ad77fe

SHA512
52bb2194b0d5cb633aa056a0b07e49859eeed73d84cbc68128685c39aac7b8f81b0c613317b3083ad0cf672c5281ce084304791fcc0d624eecc03d63753928b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4983274501f9d2421520abd985998d04

SHA1
f270e0ff56d470edca16cfa8726481d1b5dd0703

SHA256
13a5d3ae632bf29b09dae20fb6939733c71e3e75abfa286ab5b85589a0607cfd

SHA512
9dc03ebfa24273923d58d8a4c5ca3cf31f630ad09e682c65c49010d00e569dd1ba15cfdc9a6f08b1c6e374aa2bb2056c5ad048f1084ba46fdc13c8931837a15c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc4ffc7dd5316f8c07aa9735b66a5072

SHA1
2e8bf1a13e0a28dbb600e5823a4a9e58bc0a3c57

SHA256
7ba999afc7b0d811d2c7f93628d5af6105b225f6711b271b8ef290b94b11d9c4

SHA512
6ce4f5b9f83b1843687e4137b10059922084b494f3a2e0f78f49977713f9f5e18de9586bdf78e15efea12576263db4d9dab26450c5d32203e6427f22a7476795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80aaa060a3f9087746de3bc1f14e66cc

SHA1
2ec260f15b0dd7fceeeaad6868b4a3a42bd574ef

SHA256
1c887ffaba3904e7497cebb62909ccb128565dba6b2195b158d5887b48e36afd

SHA512
0d69c580b9175b59f9534aa091902c2f986f594ac9d17b26aaec7c874eb760fa7236e3206c08662248bbd5cae64e038c210e45cec9b5f832a3cdf0be62911a36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71b2449cc61b38455a914f05eb51fb49

SHA1
e8f379f592e4555c6632e2aab50f68148f69519c

SHA256
e71440e9d9d0b03b0ee0cebe4ba5b5f15c21cb0077e1480b9be8c9f9086d8f3e

SHA512
8957d281b9f87c01fb316a5045e62ff5be82e5fceae08d15189f43461e632271b9a7a4c136e24cf06a3b4d208671f89877b4b7e0cb9961878695e1544a184283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e3654ef10d7adf6d729e5f687334f33

SHA1
7d640f75628db533af351d3f930e1b99133762af

SHA256
608bb6f13a07bb85d8e979bd98b9952d578cb1c55942729934aef79c19c53937

SHA512
8902c6676b4f0a5008d8593a07ac02dac62f8f72304c3d85e99e3b5713a0680340abf459d943420c9dc810da40be6678acbb6b4e719449dc954307622cb6517d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bec2d9461b60e7922a4a233c6c53eb4

SHA1
07317c849ce7d4e087d9019f0a77802d078157d0

SHA256
bc3c9780fea81fd8b0c9f9441f592b74a32a9722c724ccd634d61d68bd081687

SHA512
28c656820d72babcdfecd7737f2d0e78dadc7a1410ffc48cea1affb7737d5d550c4edabb3ff19ff92eec5ed8e3b7a2eb37ff8e7f308136ddd360d632ceedfcaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ef2eee7a1c1a4780062d919df9dc3e2

SHA1
1c126f98bbbd441d3600f9521654d51f012f1e24

SHA256
647fb59e7cb6fba153bfece1ed80019df9651a38c82a84de25302b366d68d807

SHA512
cce94d63e741b39d46acfe611812a811385dd0309f461f50adf9507ade41c3a418d3fcb6b11ae6079a2ebb9c994c99ba1f493358e9cae95570ddf0c39dc6a4d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604d7ce89b1da42a628c419f16f9227d

SHA1
06ce258c23096dd8f1717c114fafd241a80cb237

SHA256
ca3abffdab870cbc37ff6f20028e27341441c442104cc545d85af34afa4ba47c

SHA512
84a153a45934ab5fe643ec4fa142d0c931fd356230ffac3f94358791570e614ba122ca50dd4139e3e0bf803c078b8bffda8f7e60fadf2c905770f2bdbf859f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
855a9fad10460535d7fac8f27ea44aee

SHA1
4a516179d57fc45497d24a2c4dab2450c8417d55

SHA256
90738448de913b5f57a1103cbca54507f495e1896ee4b9d20b6f204ec202630c

SHA512
22a62b02f6d75a0ce3a68a593ffbc940cff4c6b4ace232560649fc3a10d460f4de4fd326bbaa6e4ccf815a93dc27909f4f0d41cf34593fca793a3c7036e344eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d35a5df7d7164d932f19781ce35d8824

SHA1
c03310edad975879f37cf239e463f8b91fc24e2e

SHA256
86981a86dfb3c29f3d627a0b433ed5777963bf9001fa461e882f112879c63ef5

SHA512
653df676795882c529f8a06707fa174a5cbb8581fcd67eda27f145395ba18880bdd5502fb5fe4a0c2f537e470e4930dda54aca48de7b4c85bd95606bf5d78619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a508b56e5e0c6579cd83bcc325a0cf49

SHA1
2eed8b7ac4c6b2dcde52fee989b09a8020b3b0ae

SHA256
831907cf3a960442e3c2705eee4c85cf4c4c6de30a75b54dd0875d7f5103d431

SHA512
f4348ea6e85234cc19d9bf05e20bc5a6b31216daee1f2aca72524bb56a67be4d11161880426e0177a3f6f0df8e69f3688cd811ddf75cb9d9d3a49b96e9a62b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a617cf15a24ed9b6afa046312e264094

SHA1
9a8d72b2c19d589979116659a4d38fb6493594f6

SHA256
adc8819d235de771b824dafa1ab160310e9f8628acf4d963489583780a9abf8b

SHA512
9315cde67e8a797dad215a8ae2bf0ce70d13c78a84c7a5adee27ee1349a2bc7b76d809812f576ef849fae39ca6d46279806f091ce5c948fa45bea1f4749f80f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a2bb44afedbef8a28611337c0f6a80

SHA1
108654c88bca2458096b243a6681f33caa12a385

SHA256
d48528b24b40619f950f675e734e870816db4baede5834468971a061e5e68fa6

SHA512
735ecf03a261fe3296bf65e81d7f8072eb75a9e6e73412417c4787ba899881c322eb698c24320b889930e707ede6ec347f8d14077942ae2feed7e9db8141f245

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA79.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB18.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit