dd8ac5615135f055dff509c22e19949db26c1bd9f9d1d138e3b12302b82ba307

Analysis

max time kernel
121s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eee50f7f57621d29bd6b669a10c7ecc.html
Size

53KB
MD5

3eee50f7f57621d29bd6b669a10c7ecc
SHA1

7bd686cc7eec573d3243626198b04986c40f0dcb
SHA256

dd8ac5615135f055dff509c22e19949db26c1bd9f9d1d138e3b12302b82ba307
SHA512

9a27341d04c6a49ccb749bf595272c72889b8332f4f99fd51103d9f01c3caa5759686d3757891b13f8c5e02d36877cc8f78594a299209cd97fa812cb10e8fcda
SSDEEP

1536:CkgUiIakTqGivi+PyU3runlYw63Nj+q5Vy0R0w2AzTICbbqoV/t9M/dNwIUTDmDS:CkgUiIakTqGivi+PyU3runlYw63Nj+qp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0cd74346c3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{572CBDF0-A65F-11EE-A623-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000daa9a9b8e2176be8c171b47fa59edbb86b0722f4f65ce6165bbf4b4a5dbcf70000000000e8000000002000020000000f3d680d8b604059ab47ec3cb80f819175697e9720324788fc80dca67ae971ef390000000576a6fab1c9af8cb3857f0e37ee055d1c7041d287ee42a39cf2e403d136e9ee46f9c354bb02ab9c6d938485d73d4aa9c9c7aca10a47c31e5fe510ef8c00c300df20631e0e846bb2a9b83d27e763425ced570c0c5757f161a8a27c38f17338ee5c746c202fa267a7b968891dddb9c7f6c69abc12cdf09aa3acc9ef19f49696e1d883ec45ee68fff003e4660013a036151400000004c1cdbf8ad658d286cb75469423f70cd3f2caa936751d95ebf51aac5432a516b018655da6e88cda8460e7dea3390abe28767a074b0fad394283338e7a2814879	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410025759"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000eedf7e83b457eb9ba308fbf892c0008d8e7348893e1724a35e9816f450d4b634000000000e8000000002000020000000bc3c6960c3df1c183f19089764022d65ee9a80d80147beb0ef898adad8a30637200000000268ff77d67c67b04e344305ac71268f9d920ce2f1c1d29237bbefef0f39708040000000375c41b18d13c474049434b8ea53bfb150fde02c47e251a0b02919ef991d4404042bf04b849cb70c707f5aaf5b45827006a32528cbf38a8ada2cc4b4aff30869	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1604	iexplore.exe
1604	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2860	1604	iexplore.exe	29
PID 1604 wrote to memory of 2860	1604	iexplore.exe	29
PID 1604 wrote to memory of 2860	1604	iexplore.exe	29
PID 1604 wrote to memory of 2860	1604	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3eee50f7f57621d29bd6b669a10c7ecc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef9d37609ddadb6e0daf3230a6f3477

SHA1
74fb49500ff7b7caec6871e726c2345d2e0363f8

SHA256
e5e6fd654aa2865abd5c73a2be6849ece598a4ea1e2cec174bbe70cb8158d4f8

SHA512
a3816d3782f1b108be76be52dd90df668683bb17d7001e4ca2214eee6af8b2a675c1754dff8c0372f8adc212d543aa7b86112329f389d0c615eaa41b3256dd2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b64c1dab6cdbf3730587271cae95b82

SHA1
65c764a99aba33a7035ad534da220161e6facb14

SHA256
c4827f430bd8981d42e75e6cb3fdc106e1fbb4efbe6d635981e23a36e01919a5

SHA512
a171e42af7621f7038ada56589c11fccffd48238d979ae5071cbf11459bd6ccd69e52f47303068bdad012d21b8bfd4267aa4c4b8bf1ac8529471da8763af0a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ffe7cbafef5f5e86726587afbc2d4c

SHA1
41be777c1322a73d971e47882eed69f5385800e3

SHA256
f11e4ff09b07b40565238ce583443cc6d309c96d66675695abd0e7315ae486de

SHA512
6865d95799f4444fc6d8bd4db140691df3157500fa894d11aaff9928bceaddeab9fb234c62be7e54a881c3948a6762ffec670ef813f90cefb788a84118ab675a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f4d63d764e690702b7648004b8a3c7b

SHA1
7b455409fe09af43c81689b73a15cfc24af73472

SHA256
9bf5c020540c0d22d8ecfa63d676194918fdb591ba68c6bee448f25f7e3fd8a0

SHA512
47991428a8523fb0dcb11cc837a0916ad37176f1190554e9da618ad6b5921bdd2a01979d54a4b34027e01149b81596e7ad2431b6c654542e8993a25fb0335d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceaa39e228226a1360c15461917527a4

SHA1
16a469d2c3fa9bf40ee70e8f6be156cdb9d71375

SHA256
270231cac4d87af9a911050513661ed62ebe21dcd25a6f8e04e3e709bf86c88c

SHA512
a2de239bf0da6230de1b9e1c7e7518cb2e1e49b2bb6184f35113571ebd949acabdf82a37b0838930dee25d45422c3dd7f2f55978e594548805c2f0dbc6210066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32314c832fcd1c0d7125e95edfa49326

SHA1
9dca919a8a19e61f9ff49be22d043f9f14378504

SHA256
36b4c4a3cc1906d24237f58ac40f7de7a18df12b6d0e01257f83a65f36e34687

SHA512
60756eaccab8046b1e56e0c436006e4887d8feba042b0a30be5b47012fc24fcb214515ee6e1214df708f53a8265fa910864990e1eebc41f140f60fd31942d7f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dbc086d5cddd0d3966b6ae51e1652e2

SHA1
3f95aa715c6bc4ad98bffbfa9028d0ec7ecc30b6

SHA256
0700b610fb05e192b3ac85d7a76c65629d9ced1212a3df15296daa8a4bb40f63

SHA512
5cc78d3ea1e3a1889bd3ef78c96d5e000e646bd49cfc3ca6c59ed9c76497576e15883a4e5f5fb1fcf44a4a9eac82aeaa667f9abb3201a01832fba4c5b6e6b7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2d03c3581470d5a9694cfe46544261

SHA1
069fa01e5352a55d0b04dafa09d3922ed910f6b8

SHA256
6ef248905581b6f3824f1d7c944c0cbbfbc526de367ff4a166a286aa29a8f103

SHA512
facb9498da0dabee453bbbc2a0722a89245ddb3de88188e91b3e202d10cbdb70f21c59c52cdefa97f5f2498a3a3cf506c3d2c3ae951647b9cf12ef4586b96db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1782ea9a446416ade62cbda0fc956a73

SHA1
f2acec152b4735f4df28b015a5127ef9e9ddd123

SHA256
9a11ec56e8fdb2ff88c5445700191ef5e4c16eb6b264e9ce0adc4ac6d11bb8ad

SHA512
6a714271c98c8160e7a8593f8834edc04186107f103de6485ce40079a0d83f51859e5619376509c298593190f019dc3f0fef5b064a75fb5878908ccac816f8db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\filter[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3517.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3588.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit