e382c4e99ffca729d1a21b8c19622f2a9147461e905a33b1fed5a047fe211bc5

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e23126fd228ed88fb1f570d3ed6c53c.html
Size

53KB
MD5

3e23126fd228ed88fb1f570d3ed6c53c
SHA1

eda25b2eadc43779af6f1a555a307d470c563c3d
SHA256

e382c4e99ffca729d1a21b8c19622f2a9147461e905a33b1fed5a047fe211bc5
SHA512

b15a40a371e8c2edd239777ef8004402528a4058db6295456a7829bcb0afc3efdfe8fd29d0a473d379a8d7cb4e94ebcfbe9b406fc370b93162fac3b9e046b10d
SSDEEP

1536:CkgUiIakTqGivi+PyUrrunlYj63Nj+q5VyvR0w2AzTICbb2oI/t9M/dNwIUTDmDa:CkgUiIakTqGivi+PyUrrunlYj63Nj+qD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06CE0FE1-A659-11EE-9005-D6882E0F4692} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410023052"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c10277d9d20f9a9794e4981e2a242d4d8d9fd5f39903481f4a18e33e9fecfe4f000000000e8000000002000020000000fa48b5e7aa43136286c77a1d4592d23525adad27b9fd303df1ab370e13180e6a200000005031faa255801e94b0a40c4c75b9d726c08d99b2714a6a8e453aefe286f4ecd5400000001b706d56d8738431a338d92d17b79001283aed824b130a6aa4296e7dccbfba663ef5e57e4d3c0e5679afab063157a493c05b3cdc79e14cb9232531585a32c1ea	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000afa456196a5dfb06a9048f77b57f98675a54ef3f6b8fc8ab2635d5c38e634c9d000000000e80000000020000200000004a397bc1f626463b60a7e9a1567da625ba79d48de67d4c26838a99b679b96e41900000006b475df0175a959fd21d71f0233e14ecbdc4616857139a0297e2308b8cdda5286b39ab4a1c4b603312dc584add7e2d899d9c2a2d085f684f47d078c5b90ff6bc912176c20ebf54112efe32abb13cb567416680a3fa2bb8339221a568fb2123e657f5621ab3e6ac2792210d95938d10ea479517d8900596198c33b05eab478d7aacaa647574ee00dc7d496ac8eb467958400000006e9cc43d6039d42dc439a69d11dd274e5fede55dd6b364bc96b1debb880463fb49248b60cfc6a4e78533cd310b2671eeda374778e8d92dd0ee13ee32f18f1252	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e37aee653ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2296	1992	iexplore.exe	28
PID 1992 wrote to memory of 2296	1992	iexplore.exe	28
PID 1992 wrote to memory of 2296	1992	iexplore.exe	28
PID 1992 wrote to memory of 2296	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e23126fd228ed88fb1f570d3ed6c53c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
413b7d8da029a5015f3bcde75f9d2509

SHA1
ca30368ffec06a42def98cca2739539c23046e79

SHA256
f89f2b21d7f898b1a2ee858def420c060f4251a145809423eee5a79b2ee1ae94

SHA512
f6ea75e7ab46b9ffc1973ce510040453cc286e889fd7b725bf2beb200170adbdb2f7bafac50182f0b5ba99ba6401cdaf011484d37eba2f3e740bcf601a9a2cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6950a4152705d4aad314fec6383e0ec5

SHA1
4eb67e53dd869dc3b569aa1050edd019e88c7b69

SHA256
d0a36627ce2225de1d59d1c5361c0202741bbec3cee69dc87cda9a331b0edd2c

SHA512
b4b482fa5e0936233c0357326f799bf5b35afdf1885446ff4252ce7a5b3e2f9d449f8e078a8cfd1db6fa712c8d587f3746319869439bf5cc8fce9ba762890af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a90c233e040a3843d3ca7cc60eb10d0b

SHA1
4cc729ee7ad714ccb5082471bc7f8d5ddf0b6522

SHA256
614135d46c9635dd5c182e0b4c50cc476d0a0e864dfce3ac4e04db84055fd968

SHA512
d1250014a0da2aba98e7c2ae7ac00dc1ffdf141a654bf1a1436d4b7fa1ec75911b17326520d9a2d12e8a9c6389f0bd2ef3cc040f28196868b9919fe66a118bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be554c17d5c8f0420bf8418374076cfc

SHA1
c6c9853df17146b59450c38dee162c37959a7717

SHA256
d5959ee118265901862346ec9410771aea24edea3c944339ea3365828970521d

SHA512
b7cad4d1f983ae0e1a9d6af808604de00ac2f8536f2d40f8d395073e378a1551179e0e585807a0c5a7f55806dc2c323f68490dbc516d10f8125fcd7a499d3aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aa019799372bfa25825075d07b191fd

SHA1
13998d38dbcb0e1c260396d5276edb2a59ead1f9

SHA256
6b7811175dfa1ed2f6ad9108609ab96fe30846f5915af50c7504dc4d65c9a8d8

SHA512
dbf45d9fd1b36ff9b80962078a5707967126aede4a3fa3c6928ac6ed6c8c9fc9d214b5b543c8dd0e31c47540cff714df5010abbc13268ca5fc89d06ee9e29f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ee736317482f87e4895d2645cde2dd5

SHA1
a001ab9af5f1d7a3f68c2285e683b273a4b5bef5

SHA256
aa10703391c6d02f8f6174e95b95db722b20a80456fb7b8de139ef2b14f22301

SHA512
dd5ef99c6ba5ed54c23533d06becc5f5677cbfb07c39813546d83b39a5dbf77e9e52eb0a076d83b753feaee9c5f79ff71dd87acf6a969cefc88251e92f4f73c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a424ff8f95bb2ed84c91571c053112b7

SHA1
5f29288c5dd8a059baca0baa81d9d19d48f1d0db

SHA256
3a06ce0b3bde714c5fc77bafd896de6cca0bd19b4cf8251a63c327233782cfcc

SHA512
451be4951472e3c0368434b348d7733aa3cd54b3c957741a719707b1c7fca52e984dff9eddf2ff2ce6573141b44ffd57a5325d113ce1bac9fc38a2b66ceccc49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4dc74e52939b35647ceb2523cf17384

SHA1
df52c061ea66d7cf010456a7296df73ff189b059

SHA256
ec5e6e21bf71744f0250a72281d306c2d086045e4989baba0d64e2be7baca2e4

SHA512
357f8a5cef5dbd17f8f13d6b58adae6b34ce6426efc50ac09a98fdd3b0ee87e99c7a00e98fac5f85964c5048d31b7425817f7d306d8a64521a8deadf02fe6dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af60c0af604853df6a7bc3e24a6db97

SHA1
02b31d03cacd087e6e9ee58eaa918bc0c93b67e9

SHA256
f98fa1b800081b90c5aa684e7a525b26e7b7a13fa3fb6020acbe3a7295c52b78

SHA512
0858116144f9c434a756a10e37d69a6f78969c5b1332e91fe6b4bf3fd3b1f74389259a1d27bc4dd2509021eeff8db08484839d71e812bea24057ca8185e5f9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
732a447b6016fe519979b2970f062c77

SHA1
9901f9954677d3639c82e83dcedfffa052fffa40

SHA256
bf943b00987838b035db247710d396a46a03d32ea8cb3cc83307011574a7f529

SHA512
b70e20b5466792045d9ec92d03303b0efdc74ce4e1de5c9edbad8c6a705a89c354fe1d203a2a677db3bc160e56af3ae423ec7a3d19c9dbd2bb7e119e6b2f4f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3722a79e8bb54b9db4e8b4ea105f856

SHA1
5b6f040c192eba10d54f21baf6c382e310c7889a

SHA256
ad77bdc062ff049faf614926054cb00276a5be8818067494bd8548038b00e919

SHA512
9c16b2760e5f71b38492a75170df87e8ba69e3c5d5a2fce440c0328032b9ae5f45ce0058a13a0ae508682602fb74ebed097028d36659694c8db3ab24a9a3a12c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804bacff532a24f01995c2c376241e6d

SHA1
99699f2e60aceeed332b5754a363eb6e96f94f65

SHA256
1869c6eed66d2172b9f37cb3bbcf5a0806b460026972e402761e2e9d9d228bbf

SHA512
8d20fba4e091cd7d09cb16879650d528299fd57ce1a5ad3522ca241e5ce3152affbbef06a0bafa8a7669e85694cf795d5718e6ac87fa12ffdda2f066cc43575b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51cee9fe9133068c75320579dd9578f8

SHA1
2e898c8fbe3b0172d374b0af50370bc6dd0db4a2

SHA256
2cd97729e9cfb2f817a53500709f51764ca70ae7b248ff790f8650c4a8bdeec7

SHA512
e4aa829bb27a53e1dd503b3669f5b6e5d6800fdf91b69859a7fad5b16f3b3004a51245d5b4daecd1b63266ae976694beb416e368e588d0204aceb4d067504a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b71c4a74764fe1383401003ae685cd

SHA1
2858795719ada14679fa36820614aa503e814935

SHA256
1865a147109a81d97d285eb78f971405c99c641e4cc6ca3d4028c0e4633128a5

SHA512
97c45db62707982a7825b40bc156de260f12079d82c075cd7b8406e6811105fcd29007b1a4f7357c8e3bd00a2dd792a0a457b1887ff2bb2201c78cb132d73a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ddb4997f7cb2fbea7ede8c20703388

SHA1
07acfdc7732e36d46d757fa1759804797fafbe3b

SHA256
790811f19246cae2013cef140025719b4150cee5ab4455c381a5d1cfcb4daaab

SHA512
b076d5f7bb45c4c404e383e0f7938e7c785bed4f9a10b1d71ba812cf4f5f2c4e377de31985cb06d3ae2d4fc20bdfdd72e929196fb14bf8e6500510da1db2c523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\sha1[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDF1C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF4E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit