124edd5dfd9f8291e1e8f850a4c3d9d6b2a48fef28fe2c1f557172066058f292

Analysis

max time kernel
134s
max time network
170s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3.html
Size

4KB
MD5

e45bc77034b11abffdf667c6c45356f9
SHA1

052b4a0925773fbc835787edaebcc1b513882930
SHA256

d201d1202643f03e74159c0ea0342c74cade90512270bf87511c25c117ed2041
SHA512

389c1188b4900924b52d8d4935da16ea225b535833b41ebb0e9da4230892c7c36a01a17897257ddd4607d08778080dfd0a3e5c7d75729c4b1cf4bc2a4d347cf2
SSDEEP

96:T7vDnytq70sfeUolTMzTYXTMzT2bfDZ/eMxm2/Ixajv:Dytq70CsQXYXQXSN/eMUAv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0667a0e1afdd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000524141edc5d133f7737f6df3d48356abc3ef34482cdb054d2c2d3e38b8e157a9000000000e8000000002000020000000b06325add826976b91ead708aca854c7bff6105686d2a48ce31637873089414290000000a9203689794ae62ebc1db39982f0e9eeba27fc3d31c77721c3467a6f73e3771844aebcb9de91e4f0cde935d986c864be96a3893a66b1e82578220edf0cb3e98d1b547fd655f39197b2fed030ec7948880991a5f003d4d580136447a365b2e264868adcc36bb6dc66cf82be978e3e1b71c23e95816b3d32b02e004f8a6b2d3d982098e6f89cd367e371a189db52deac0e40000000765edd5caf07630add03b69bd2d7837f466983ad57816102ca9304b8b7fc6264cff1722acf02f77bb04f0593648af4617511529d1e52f39b75ca3f640aa504f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39A18CA1-690D-11EE-B6BF-FA088ABC2EB2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000a05b6ab002df9dc1af2f9876a959768e8a062400ff1951ca26737a5fa05c8373000000000e80000000020000200000005d3e90afe1f0db0209b33c9efa6c32ac2f34df5e0dd3f0ad0d652d653ee205b620000000763992a756b6d03047836ea871e33103901283e5638440f81062b05ac0d2933740000000d78e66c587a5b28a0b0fe123b7c901e012f836a35b8aa608de534eebd880356253845079c2d66c4830aa6a431d560855382ad6b71634359eb753ee65d1b60480	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403283471"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2636	2820	iexplore.exe	28
PID 2820 wrote to memory of 2636	2820	iexplore.exe	28
PID 2820 wrote to memory of 2636	2820	iexplore.exe	28
PID 2820 wrote to memory of 2636	2820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
203f2f1ed2503c22cf53967a8e1d896c

SHA1
37c45f01252f7d4435af35f1c7e0ae10e051c134

SHA256
0ba6fedf2500ea764ed05788e3b09821eea8adf95f200d90676bf2472856c0c2

SHA512
6fe527671b844848438e18140659b7145e5dac662be5ae89139d234db1d72f4b2d60f483725cbedf383bf44625d20805fd937e1bed9bdffcd49933aaaac90105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
129d7a4ba09790a9ea750f10448a0c64

SHA1
e0d4d431e226c2a49680d5752c06cf175271bb38

SHA256
4da6f25249d2760bcd4dbd216c8385f2a9d600d4e742575067605ea1fa082efd

SHA512
867bd5572633ad42f2f083b9ca74ed20e1e80982e1ee1d1fae2c2631916efca4c0e49b4baedb181c16ab4f4e5473391648c9fe998b1e26813626ee1324524a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b46988381df5a41fdcae5792761232a5

SHA1
129c3a35419233e3293faa9e53a0f124c41d6f34

SHA256
4e666f3827a12279ced86e18c30708ae850a8ed0d8a7340c002365cfbef27548

SHA512
c59a5ff29039111cd98e1a744324d5a3ea99d22488f9d85621679bc48fd9f29eeb90bc3a36cccc60c0b51e3b44c71a540e9118e03c31042c4773fcf8f2f98d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fd5aae831d6a565d324c3afa1873e40

SHA1
0f4e0d857cbed047eb942df7a0e5d5c69895e2e5

SHA256
8fec3adfb66b5a51febfa30d1f4d800c04ffa857522ac973af5bf919de590004

SHA512
5644687ad575463a5b18ae3d5ac9666b601ddf15bab33c115d5a4421cb8bd5540a92571573fba76211f5d2c7b4c13781f203fba694023df252e51561a74eb641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92c3f0d3b2a407c65fa318447cd7f6c2

SHA1
44e817371c9339bc9d133161755a65b3aed36b79

SHA256
469f30e614a4dae7eecefe515791fa6033ec0119e603f9ed918e256b3caa7307

SHA512
59e13097c395e12965433c402f5f29620045a1212703b2fb4c23f935353f1669abaccec4ed6e6fb43d0528f553a649ba42cae8c0d15b17fac4c3f338c45c4f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b8c304e746ff42784de4ef3ec2cee6

SHA1
42aa3a4a2f58c3652af7b550d494777563424835

SHA256
46c599446a1b49be3df5eb68110bcb060b7e4de2f46f120dbb57f78f49af300f

SHA512
54de61d64f0a7a2bf0050ad83abcdc261119e7a1d849ba267c606c80c4517a59407c5350bf1a3923ceb27c1d5be500048ecd64cb2344660d8817c70c26c12684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d408a5e751825b77216178230dd932ee

SHA1
2e8da4845aae49676f4e95c3058140532a77c740

SHA256
e0389b0dd5caa02dc57f8fcca63d16a2eabf0a2c470a0bdb656a6f14fc19511d

SHA512
69f5506dfd4e3461a0ff201a82e921a53bc6b64ccbebd3660c1952329823842d84b75a6b93151ae524e862b9cc6b416c5f0e4b545ecf9aeccca175dc128b8ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84d3b7b1d1a016755a435f117aa736a

SHA1
934def2b984ad0d91c17907772da978d4a4bf41f

SHA256
730c02a2938a59c08ae105ba223d8965cd06e1bd538d1f5763aafff224b3d968

SHA512
9d6f35a6e068d0203fd6033c9ce4660096e77b068ec3212204d56a8cde427c6513f89e886b944284e03dc181708c4fe10a7b845398ee63adf696288625b4547b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b40dd2e421a54111fef732ad57ce3cf

SHA1
91ee218e31bb4606e87eef97d2f4012affe877ac

SHA256
ca2a4a0fe4acac0d7d4cb774ffac12fc6b12456094b06a7deb8c80f4740b966f

SHA512
5c4685ae38a14064835a062a8ccd1e1bc93c75058e6eda43d78adc2db0fca4201227a69982d90e6c42732492db8fef6f79cd58420ddef0e4c8ae5e3c5f91255a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c72d03ab87d34303851f04c100e300df

SHA1
61eb8c8c531010a1e73f3b0de26ad1d31086d5d5

SHA256
2b35298a313b0ec5ab45e4497acf8a313889ce331717fb0b20369febb69ff367

SHA512
edecc453150ef40181b5756c0950dcd8cfdbd5ca2082706df00891f1e042e322e955a1c7a80d9fdeea7c51221fed5468b0ae6a823a184a4c8c46f695b2d5c07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE959.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA84.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit