e5579c816e14ef0a120a32ee7c6c75214a8efe33085a98acd57ebd3e96785dce

Analysis

max time kernel
169s
max time network
204s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f3fe7908bd2c3fecd47e6c371b4c1c8.html
Size

56KB
MD5

3f3fe7908bd2c3fecd47e6c371b4c1c8
SHA1

1d67be067fcea14b9b86d3b5c44a1b92fbe59cd0
SHA256

e5579c816e14ef0a120a32ee7c6c75214a8efe33085a98acd57ebd3e96785dce
SHA512

b318d1b2776804dc83bb768932ad8f3956e9271970fd960af4a43946632dfdc380a9f8bad9e280c579535619c111a4af3d55e00d65e526624fce384dc90226f4
SSDEEP

768:Zcd9QZBC7mOdMolpC5I9nC4t0obKVi/HUbKPd:gQZBCCOdp0IxC61x/SKPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a3a3bfb99216cfec367b257b379e7cf95951dc5351112668ea617c4636a2e79e000000000e8000000002000020000000979f0c7e4d3d8849a3eb84f0f766acb844cbe7d337dfe7ae593efed6c4551bea200000004cfc702a4ed29c5b4b33186153d7fe7a5cf274d44a3286be73c3aec30092c517400000006f2e9d740b6a71c821c63fbceef76e1f83a5c1f6cf5c02d77e65aa9142a302c3359e57b2899a8305f16de8197ae8eb08baff5e1415bead7a9e18ee58e01e50c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f061f0a16e3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C62F1161-A661-11EE-91F8-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000025eb97361915616a8987c438cd5264099a6fd01df25d440c9b2fe90ab695ef1000000000e800000000200002000000031bc6c1cb243c882d104bb9b148614f86e2ca9eb374e9be3c4758d6ea1c9cfa7900000004f56e545a66e49d0e71d6b41662c8c9f0233a70db7908b5e375a68cbb41791756c9cab40e1be6c4fef15723666370516c646d0c0ea89f2cbb5ce350eb2d77a7c2f10818b674ae102190bd02549c6dc7e926ed7e88ef135141356bb7cc7492063f5982d70830cb3897a1de6caeb2bf31c4e8642229712dfb031a52b76421c57c1b117968979b779fc070389e8c75b606d400000003cfbb91efc7552c47031bbcbe922f52a18f1571a2e8fe161c51bb8ac806dd863557e2e688da29fe058ecd528dc18e11d55636309d35593ec2673b77abe774386	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410026806"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2060	2188	iexplore.exe	30
PID 2188 wrote to memory of 2060	2188	iexplore.exe	30
PID 2188 wrote to memory of 2060	2188	iexplore.exe	30
PID 2188 wrote to memory of 2060	2188	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f3fe7908bd2c3fecd47e6c371b4c1c8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41737fc448b9abf7ed9cf8bf0ccce653

SHA1
2cf7460ee4811630ac74f737d3419cfd16d4d82a

SHA256
b300e4c842dcf9d2af2ba0eac263517b2e5a0304c8aaff703dc0cc03c624be82

SHA512
e6ab02739e2c92a705275ec1ec568ff4996d6793b33d3eb658f9e23b0ed3cfd1650aafa393ebfa0a63ddcd62ad15881d173a8bbb5e01fcf5b93c31b6383021e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99d916a3d338dc4c7de20eb51b1c146d

SHA1
16190715eb04ddc9227c175a55879e88def5e23f

SHA256
145f9ee848bac78801784334b528e75961814248c012f1ebd0b158ba3ce1893d

SHA512
8d21b42e920b2f5fc2b402aa19f8b8928695f5caaaef5f6b3ccf3716dc5956b7fe5df7ee225f451c7ecd359efa2c3e25a5ecb6684fe5004db7d71ba0fe4304f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c660da4eee24d84bced62e197144bbd

SHA1
5fafc5ee36efa83b20f1319c00dee48580eb4a2d

SHA256
c60cdcb1616b2d77da66da8e3f8ca5159af99cc4d47de63a2547678ac140096e

SHA512
4544531ccd0cca0b7a57debe980c73acc9b4d95a0e51c06fa6e0466135fe936b60e433c5e5302ff94a18ed4aecf4ec8950d2bb38385d9841fa1c98e46905d477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08d6d0171c53e36cf8be3f4bcaefaff

SHA1
838d271a52786982447c54abea0bd66e1cab2947

SHA256
934522d595dc03f45547f1c345d167465d6ea07a6f399e9943edf7c06608a1cf

SHA512
5e8aa05fc85ea3d6dfd35c36e1a327faee706b56994cd0f046bd112dbf55e10acd050482488e48e3272dbe77ff700e7acb85380f8fcfe553aa75b1d719cc1b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b75f27a43dbcf28c5b6e0d90ba7abd9b

SHA1
bd2ab2a500cb6cd481896b73cad153ddf8f62cf0

SHA256
b456a3c12d9afeeed8b90b339680767e772109e3779bfeeb3740efd57bcaf843

SHA512
8d0bc4685544d801e2e41d373ce0da9933510ef1dd908fe69d56974cd22e12d2d3f7af1c0e0d5c68e1d6876c47a825bf9485780cef5ea5ebcb3af46da2ccf5b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44bb88096aed03c5f5cd06d61bf6ef90

SHA1
f91b709642238082f0a59e59546974d1d76bee43

SHA256
b387977e925ce02ef9eb985252298e7da8b784b667eec0de511c5a81521377c1

SHA512
82c88c6538f939c71ea2df4f3f03060e265eb8e54dec39bd3b1ab1f698cbceb46cdb9502eb124935cd3f6accb6658a85e263e6799a5b24c1c90212136b083134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd66e40e550e5f90f9d58c46d59578b4

SHA1
bd004b52ef3e0be44eb055f21a2381b4e6b34904

SHA256
e4e17f2175d70d64a7095072f7949318d1b2ba562d2afbba7eb76c7964ca3932

SHA512
4c7cfc1c8fc8a2e375fcf79a455ae03f47ea76808a9e6dda43fbaec0245dad884da27dc321a975df854e41595ad97a9a9fc38e5afac6d3121009916ecd0e9686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
110eff08e5494646dbe7043dda9f382d

SHA1
4b7750781804c006be70f3f9df1d0fd689a2835e

SHA256
3c32bbb6b462bd763a50715a25fde8a44ed71c4417b12776f880edbb7923eaf8

SHA512
d00f0fb2fad7f2d30415bbc041286f520d0575be5461c4651fa0ed50d3b4eeccab4cb2a168c7c3ce12c150e31e03e707bc12d941ec3e905c2ed45208a8d9b34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a927facfb5809c54cf9dac1e361c66d9

SHA1
ad2bc4e07875912346e1d4b82ffbedf4f9438855

SHA256
9016ce5baa646613d0c02a6d7a8ff8906b0fedf9904e45db3330f57d7d2b6dad

SHA512
a03a845d320cb2b988f510226292593351c4beff78183864675367dca5e1a825a7e1c29dd8c2fa08eafaeff6d34fa888a25f8e5add52bae30ed676c1b8cbea85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54A6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BA5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit