e2bef4b4d00500add5d5ba062a106272f4b23bafc3c5b5a512960bdbff943f84

Analysis

max time kernel
150s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ac4f108653e577e082dd0335fd887f8.html
Size

53KB
MD5

3ac4f108653e577e082dd0335fd887f8
SHA1

f53066bc5fd4481284647876559b37ef0c14ac24
SHA256

e2bef4b4d00500add5d5ba062a106272f4b23bafc3c5b5a512960bdbff943f84
SHA512

72c1797fdeef91586ae91c0dd639f072059bdd6f46ffce39220afc7776bf3a38bb76ffd7921bbdf9acc1b2a62320580172790cae770abf63656145ccaaf4f94b
SSDEEP

1536:CkgUiIakTqGivi+PyUWrunlYq63Nj+q5VyvR0w2AzTICbb6oT/t9M/dNwIUTDmD5:CkgUiIakTqGivi+PyUWrunlYq63Nj+qp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000414cfc9153921542a65bb5b91e8049ac5319abfd03ce3c5cc5219fc2fc7f4cec000000000e8000000002000020000000e7039581ec94a7bf26ed5ce12bacf609bb79a5ad8ac3edf77c5a887d3ed6f13a200000006ba0206ab1faff84c7e4fc4598402241897bb8b742b14a5df9ba8980f69de95c400000002d72dae38ec88e13de432afd0c78f81f8db72ec16168a2a733fb9dbab8d4c051012e4534dcd2c53781369a0e7d13724d55bde915a5890f7c9647aca3dc692690	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00884afa2f40da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410659569"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f83a5dc3df36ff0d3b7f54dbdc96fd504872976eb453e47782579e6f81a64099000000000e800000000200002000000084f7e5651ebcbe3a3f5717b997ac409652451d5c3ee5443e3ed4dfe4c7df6ab690000000cdba75303176ff3da63fb213e0c92cf025eb5f251373a466190b33546b56427dd6abe5579550f9070a78f659b656a23c0ae6399ee2260f26aa9811bb8e6c418a6754e326de9d4cf65e388df0f7877980a778be11bf4f36cabf59ed935a803c1dae984c507cdc09299e82383d17563764af881fe61d22dbe9afdce54050e4ee0a3ecfc4abf858f2a7feb87542adcfc854400000003ce953cfc58931e590ae689e4eb01fc8fdd383feb001561c88787b1c0af06408c33596a26313fe44bcf22bca008af3fe7b4a7cd285f92b6ed23d4e614d861348	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0958FDE1-AC23-11EE-A892-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2344	2132	iexplore.exe	28
PID 2132 wrote to memory of 2344	2132	iexplore.exe	28
PID 2132 wrote to memory of 2344	2132	iexplore.exe	28
PID 2132 wrote to memory of 2344	2132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ac4f108653e577e082dd0335fd887f8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76fb6effd86284c430bbbfefbc91a31c

SHA1
e8f8a4c81781c73e3e1995d779763913f00996bc

SHA256
efc0e3ad6f293ff55f9a9395026a7350061181deb42762ef5e37cdf386f24d3e

SHA512
a6b5ef7f6c42b7991ad54c039776c72fcfcc2f690b4ae00b5fef8341f074e10664442dc719d6ea8765ad649468fd8f7f22fd1dbdad05c4f0a116231dea226941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bb5e3e7679fe176ab17c356ec68d13f

SHA1
4f648bf995a4d52e74c0bd10548fb06eb8c9d821

SHA256
d351e0022f7f2a8c00af5e1c4b5a63cdaf5c1e1619478c2a20dd64edadc4e17b

SHA512
412dcc02bc5fe3296ca136c44201787d84845aa8741a911a1ba0948edbe77e19632822c30398586ec5592b2a6d1e3efa5bd7ee1f24977676098b2747dfffdc32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f739a17e4d00ec925a0fe4ea2dab5ea

SHA1
e5fd6606b0c71d1d32051b8f16fdfc287e3a5711

SHA256
f0d01d269c5405053de767ae1bade88dfb5622486b06514ad776d21b2142073f

SHA512
0219255fb321b380843123130505f8b570dfb51bd96243f893fe343e270720d604f5d6e8b27515d97df12a6e463f5c3cd0c3b2c381a4beeadeed267bb707502b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
473cf758bc28c0d7676bffd8f65a461a

SHA1
85ed304ea80a355ef80f9d5a107e1e324e6d7336

SHA256
f705307a7aaa1071224577e699ad0cd7f9c5f3490c2e6745c234a8733ba38ac7

SHA512
206fb6c0f10f8a4bf65a7022cde66ba9befa539ce7588b689007d70b7e33208c2bf5de458dee452aaf5a1c2f4c8fc5adce161967465469949ce2ea09308e33d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa9b7480ff5774c7424b28cfe726c92c

SHA1
2f98bb560fbfb2697797aac4f94118e01541b8c9

SHA256
c37b9cb2bc0874944112d5ba83789694c9a976e3e13c87b98a4575ed993cb01f

SHA512
c05dbc0e90a4a3503867ef4c6a55474cf96e9f663012031a168aece1e1181f1e1afd8a9a65c18b576b66859d2a5cf3999a99ac2343fad72f5680ee4edff1d561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0755ad1b781f8aeff172e5b4a34b7577

SHA1
3c55f1080487d77032dc3e73e08c419ba4ed49ac

SHA256
d6cd003b3416f581042dfdb73a41d4e6c06b14bd9ad00e4be53a3cbb654e55af

SHA512
42ce3d80f3ff280214571fb2d4ef63bc1389e83c778228cf5b994e7d04793133cd5551887a933a860c0a86fe44980dcad0501f0257aaa1f37c575aded06a7a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
403740531b3c4eb63fd13983b2dc63ec

SHA1
6b4228404041cbb21f0635ef3bcbb53f7f5de3f0

SHA256
84230e80c484a56f4035685ecc350391428361122a7ca798ff02215aa7d4aa09

SHA512
8b883d66a050bac3274c1259f2b6cadca61816a5acf0b4d59bf51950f65aa961f9c076a03e098554559f9983845906338576bd084e9c6bd41849219eaf05331e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e0a464d870d7d49ff7741a06422ac99

SHA1
0d57239de9e929fc6b5370c1a7f6c6a6800ae7ac

SHA256
95d18cf550f819f7429ba4e0a6f14c0355a7bd34255bdeacad1c8681c59ab4e3

SHA512
ab34f2a3f7237c279209ded9d6448598cfcc3bf1756774b9b2f31068fdf4c04993a4075914f9316e036356973caefd9fca24651f1c1099809ebb336397307d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dae2fc76c78fe50bae1c969bddb5497e

SHA1
464e41c1dd2e2349d8093012827e9ecb1e899315

SHA256
52a7abf45b0916a7c1fff0c299a2fc5f5f401151a5ae8bd3d3793e0e8918bec1

SHA512
dcf3e005495364ce0b9861cd75ff463205023936dece99098a717e8676fb465201ec7f13a8e385bc1441aa68deed7ad1681637f0f69af2e515764276d376227b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4699e00bf9fb96b4b0af7f617c9413e8

SHA1
48724cbe3d84bc9f77713796ba822306b9380f4f

SHA256
3b3eb4bdd8622cae8d5dc9de8e812cd7aca37280ccd686f3f2c286e0e7d783b8

SHA512
27057056e509a9f901b73f232ede0eb219d7dd589929dd2ceaf9b9e9588cff623b9fb6ba971a9959c3defef4a8bc2ae8f986eddd62664dca240f15983eac232a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95BD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AEE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit