3f39c2fc43173b203a6a0b0331adb6ad265f0ee09fbab56ff25f18dec4fb805b

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
19-11-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

about1d.html
Size

445B
MD5

3eb4ad1622faf2b69fc2dcf8f7bd51bd
SHA1

e61891d6cbab9c52ffd25f94007a2ed12119f0ec
SHA256

a898213a2328ba3270055ca3883098f6fc75f6b88c90527d2d8d5d7212f4d5be
SHA512

1e9b0f69cc8ade011c911b995de5e52bcf02dab0153fdebb1a60250cc603693d1ca0c9bd6abf80679834f7bbcf66791bf8ed076ef40f4fd6618223dfacdd8060

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000198b080376238195f707ced99d26442c89b5b4af7beabc73486b86202a941372000000000e8000000002000020000000b4968f065fd6d8a21d8efe3576870552b963ea9c12c472cae9f34756083171dd200000007370d4e502f6b44c7508caa6a967511f9ff36cd0081ea74cd6d8c0693acdba0a400000005055098e270f1201fd42a3e31c484100cb67a617b2ab029f90ca342356f7789ecb05e316aacc82c111bc07ff517e9f555635462cf7042b22241cb3410cdf1bff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5045c1e2331bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406593098"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DFD0C91-8727-11EE-B466-42BF89FD39DA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000007b25a0648f4a8417a08331388ce8dcd5bd9f503b750123c92b6dfc10d1d3fa09000000000e80000000020000200000009444641253be0ac16660f7664bdbe8f5b31c8be6714344cbce631b9001eb1c4f90000000ad46736458c4954515c3915bb827847b8f9f995e411d815f5305777c9f238e17759172c17156a8df9f6a44a560bf8aae4ee9d638cf4934ca2fa98271ce2581b218b46b705b424717598050cea5b450137415feb25253a88b8287178304d3830d736d46594cfb825bb913113b7ca86a29d1de0a58f2c921603adb248b586dc67a6151da8ee107228220c7a915d7339e474000000009a21d595f699319f2a5f2263d9935be1ed50cfaad4332301f048e5042edc3cd8b70b4ab7dca5ea01cf943c3738e5f26e504637e846ef7eff2f8f5e0d4e796ee	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1708	2944	iexplore.exe	28
PID 2944 wrote to memory of 1708	2944	iexplore.exe	28
PID 2944 wrote to memory of 1708	2944	iexplore.exe	28
PID 2944 wrote to memory of 1708	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\about1d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc619f9cd0f92b2914f9961bdd71bb14

SHA1
28b272bea907fef3089597510b070526e6814e24

SHA256
8a764a10761b6b9ce9b94b9c01996a0444153b220cc72055cc92504ace5e4672

SHA512
b93b25b57ce5cbde66418194f9acf58deebcad3d2d9526fbf96ac56d4c18f8d63b55db16095d1d7ac9fb6f5f595d8f4a050211c56d8f6e41ec68dd25e70d3cfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9879d3a41fd91b9242931b2c10ed9b8

SHA1
0b65a3209214648643c73a56c493e25218e5b9cc

SHA256
e223233da87d1a45977870ef083d0ec884f0558468403934117376501d19d19e

SHA512
2897b1fd5a605f9c1f9c46029d21b685f731249a3d38d8715b5f7d5c19df5082c794ba8de12b12c8905a7061e08b45496b092fd07eaf4642bba39dc74a47e3b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cb83ebe81c759bf79a76d24ad448d2a

SHA1
a02870092fa944e2f8f498890459e520fb4e5f53

SHA256
aeb7b8121f5a74114c50d9c29d0f4185c1ccde64469ad55fec6fd4d91a73796d

SHA512
c6f0aa6431556f26a273dbd64b966a34ab1fa8b91dee2431fc13f0ccc0836195f176ad76c90088266def936977efe017ed9a98d3c8d3cdc78619b25a1a8de56d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0277d7e3eb450eeeccaf37dd4c5a589

SHA1
815f53252bdf22f44953b55f7fb71bcf575cd6be

SHA256
23d411431fd704004e44607be3d414b82ca77f0138a234ea1caa3d1ea9e69d2e

SHA512
6ae5a904aa0d23b231b3996dfe5bcf2635590f25347a13acde875f4c492f6bb40179ceac4fc27e345d91e6493f4dd8c769697e2cb407297eb515ec2df74a117e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a892f1ef831110715565bb6acfcd3ac8

SHA1
e0fe07a1242350c5d837bc7574497d8df35da4dd

SHA256
c6b7cbaf25bc23ef6ba162991f835779683be9d9d4081c6c071e55cf1e7120f6

SHA512
5fc65638e16e77887a55f84afdd1f55dfe0af94bb7e6d223b746c00310ddf81f38dae8351969d4146dd2094262a29e9e4cbd4a51a1e999d88c6e5c0700a6f292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d639e4f161fab7d78bd053d64c733756

SHA1
42a4b8e5c18f6ea6d72dbd747c1529b6c053abfb

SHA256
7ac33adb83d03752f46641e7bdd164694801b37bbf8b7e3b1d634212d19e8096

SHA512
27781b897ca4b7dbc36dc978c24a9cb4cd29aeaf596ab52352b60a4ee3d4c8f231d29c331d7dd5bbbbb0d4d27f6bedb15b220d19b4048f5d524fd79baa516914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6438ab0c4faa12b9ce6e34b9107f8890

SHA1
7a3f73e625a2e4e04e950fab250ea223ca087167

SHA256
08df419170e3ce57564607babb88a9432b5b92566686971da5d140d2b1312c3e

SHA512
679e78cd5b4af816bb7404271cfaa53483efa99c4c54e6f7bfaa4f2a8e239a9b33d8d58da78eb9fd3a97d53f268c9d0419ddb6beebfe8839ddae23cccf6c39fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cac3ba3ef28c7b479a73600307a666ae

SHA1
7259473fa8eb49578f0b4c0f730d7ddd053d6843

SHA256
0e922531cdbe456f878a98496c3b68c7883d18f60adff57790df527d2f55c66e

SHA512
5a979aca4c1cc40d7b6fab6ae3ecd339e5abba79f4ecefa03ed4fc721a6aa4c82d5fece914af63e3b408db6194e0b24b193dd765dc45e8dd1aa7f7f47be849dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
472b14c46a68a55a3fbea130d9089623

SHA1
7ca156585073c8600f84ec2a9d98a3fbeb76c04f

SHA256
de676cdb4dbc0d70d136b2943c24039ea3c34ea82a520400789662c0585a6fc7

SHA512
eaa89bdb2f788cc595c76910795a73bf0641ee496c374e2de38a136b8d4f956032c18b83123e835f1ab2644147ecf64ccc36dcb0cb7f7b903c4310fbc96ee1a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e0c82dde8d6a592007851288698351

SHA1
eb17a6676fbe9932c4e2bd26220aa8f0fac29cb0

SHA256
e302e6bf477a390d003dd1deaa08123bee4e4d444727043a1df6a3c5beb39561

SHA512
71f8401e9e9d0e483e0439bdc0d25d76b42bf07e8b94406cbeb8d637c3351afdc9ef81e1a3b0c54241e5bc41394740080b2ac5540ac544dae590aeda93842ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66ef9b2aebe9d9c008b8d586ba9f1dce

SHA1
cf1bd0af1e43b8bf68ce6d20170aaef694b65839

SHA256
b5305e3d538ecef636dfe4b2feebb084a6163a4d557a3f194a45bc1f3b257518

SHA512
6ea988247f1579161f1e451be8f162212e24e36b5a8432db2fb9ddd1f669e3eeac2e729268ba3955175eaad19d46fb085aca06053060cc3a6a7106e97bb3fac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5026.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5048.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit