f8a92770a3b103058c665c25329669c41d5129f8cada09cc8b1eadae9c729a5f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fdd1d061afed23273087b923924f7f6.html
Size

51KB
MD5

3fdd1d061afed23273087b923924f7f6
SHA1

9c7f43fa13f13bb417ec61e2af9223f18b821419
SHA256

f8a92770a3b103058c665c25329669c41d5129f8cada09cc8b1eadae9c729a5f
SHA512

bfb6bc75dd31bccb0f37581bbcb80f1bff06d8aa6a083a87ccc1d4fa04b79bf80e09e9351abe541bf8bf3137d36a9db93871d9fe4ce4248a30eae6c0253bd384
SSDEEP

384:qr1C8ldpEt0e6vSRkx0SfT9lnApnntn0d60+SwkNS0Njf88cVHIMu0vcTw0cx9GW:qB1jAcq7hn+7w2Vz4Fx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2085886c723ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000446d78cea006ca7b60ee9246678616de2a91ee6405345d61fb66c7066490a619000000000e8000000002000020000000b8830c1d887e4462d0781085ec68923104316a40dd675fcd3ba0ea43cc03f4b1900000003239309de58eac247fa4e69b5aa1fdc5aab4fef7d6a6005d24974a63d9f63639f33b3ff548a1ae77754954a9db3c94021dd71acf15a56de5e08e6521bd419e1b6afe3f40897c86bd72348b616c7ce5ae6408c20d43df4463a056c8b21146bcbbbbe7e55b3489a0bd0401e04f031b27cf86b49699497f590266982a659f11527dd765c04886c71ecff41137de5399add74000000095178b7719e2ecc334310212b269b987297b28c81a57ccdc060831f9346914fae892f823b3c84421d850e9a560578a5b84b29d2e8bd894cd67281933c814feed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002987e3c9091666e823a7add47c42b09cc4429862c451e4c301d4d24418dc1417000000000e8000000002000020000000514cc56524d5d0401f693c7f5dade76d8c371f5d06aebaa52b506385ed8161c320000000c846f79c083fb4bcc1f49bd9b01b782f07b2919e4dafc982bbe328b72bcaac1340000000f3bcc77da25e1624d2c18f6fd2001c7ebb8f1bd92fcf2dfbf97a8baf10fb64face311530e8fab7447c494467bddbbe09cef517e973cd7c30171a0f451bedac2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9560E0F1-A665-11EE-9439-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410028471"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
284	IEXPLORE.EXE
284	IEXPLORE.EXE
284	IEXPLORE.EXE
284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 284	2488	iexplore.exe	15
PID 2488 wrote to memory of 284	2488	iexplore.exe	15
PID 2488 wrote to memory of 284	2488	iexplore.exe	15
PID 2488 wrote to memory of 284	2488	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fdd1d061afed23273087b923924f7f6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7634183879d9f1a34a49a6c26b8b056

SHA1
2f150df6b5a010abf571023d4601fee1562561ac

SHA256
0c6aa988a22521c28f8ae499a7c0a161a58bd17c76220fa30edde7a3653a5995

SHA512
6222f7dc24cfcd00619dae583fe50cec8e3324d0e0269dd348ba489548a00eae5a79bdd2f328eb1b8b7f2688c6aa7aa542ca83ab399d242cae0016d2e9bc5922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5ac72479526a6ee3e2ce3730f30a96

SHA1
33581d21d3d62a5d46e7ec9b8a485ff7578e3efe

SHA256
bd438b1c4c8e6d7187e36a00de1e1f87b20bf93c9ca2697960f30b116b2b2f12

SHA512
50115bc466cda38f5eaba6a9ae6b8e4c859bc05b95ddb531b9b05265b8fd93570904e8e0c5a06f83d4760837e19ee28d85b7b47b0e03fa8d6cce75c02714acf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e468da6bd752d2541b20ba1a6d474425

SHA1
87d38e59d6dfda9257a898c2aaab01dc1ffd2e30

SHA256
a6027ba75b62e98c71f68fa20770f4cb13d6e7f24b0e6c7a2e1c3c2a3c3075c7

SHA512
4550a0ba0467b5bb407d60041d72b6ab3c49aadf0612abf29c915cad4b49381345e8ee7e81e6fd01c5c2745c27e37f1d60c0334b98c20e887f13a3c00e136a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ba62d8f8b0e8829905b6fed1a3a4e2

SHA1
5840cc7785547f1daf0ea856e1da6b168b715e6f

SHA256
e211668887725229c520a3dcd2254969606ff2bb3f496bfd4c8f2f01d9ec42cf

SHA512
0b7ca1f0104a4a67a7a9f52161c175b67cde35ff307ca51f2241b590230fbb67665de179f2735399ff72f6bd8d525603d3c42eda11ce344c209c6a716a84d4ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d181269d838da97d4fc5ae7aaae753d

SHA1
11b683934782b4406791b82553cc67987e813597

SHA256
f26a0e90b5e68aa3afb6a8986e949014f51abc85fe28d1761f0af84216ed2afc

SHA512
c17f730c6cfc08e1e810a48f6381b0a44bfe80b4345592ef1cd9067054dd71cdb5feadefc8e7de39d1196a3bbc45814799b47983058bb0fab3c25b51d1be5cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18db9a37cffad617d4e047110564da8a

SHA1
b3347ab2986a982cc94be69099513d5bd6bd82e3

SHA256
904760670997d9dd22779678c0552ceefa9b63a92ff303218e89b5a438e8cafd

SHA512
4fb68061dd87308229b99606f7f5cc924d18161343df93aca0177c8480fc660dc4a04c120a97b797a5aadc297cfaccbea7893667f22225776c7aaaa4834cdf67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ecd247c12913926437a998b0a285d5

SHA1
657dcda9fca09c62fd6a8e20ccbac1853d6c3daf

SHA256
356a3428db7b85b79d0efc3f1175e9f22038b5611b10f2389961f3bfacd31055

SHA512
7d30a7ee75dbff58302216b3fddf887947e4b48dc8ceec771f9f6752a97932cb830f6315bfa8738e6c7222bc203aabe481f132409cd318a50f22c6303c023a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c74172410d31f4c70add2fb1cbc50c7

SHA1
1e8128229f1a7d1538d0fbab83e20e77b55104ed

SHA256
950a8b89414b9ea4bd82547ae89d19f07ef1289c577f87801d50e7f379ef11d4

SHA512
5839be5be36643980f5afc4c72d5c4305ccc1d035cd0086399cf4ebef6e70808ce544937abe8e4158ca7b251a279847a33f3818d9c5f23469d38c00822ac8426

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32A6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3356.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit