e80d42fc654a9bdeabdb30e164c3490fb487b6ec37af19bdd8ef7fe690c45cda

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ff896c04f0cd66582991f20bf9a58d8.html
Size

6KB
MD5

3ff896c04f0cd66582991f20bf9a58d8
SHA1

d2622c2d68e73dff07cbbff1c59e5d106556e5e2
SHA256

e80d42fc654a9bdeabdb30e164c3490fb487b6ec37af19bdd8ef7fe690c45cda
SHA512

876fc5063625e1cb40749dc92ea9769350781600008109dd995faf9c0d247b4245dfdff19bcd7011632459acee5d88f37ef5d6673f1ef83704331cd62deb7f44
SSDEEP

96:uzVs+ux7p9XLLY1k9o84d12ef7CSTUAZcEZ7ru7f:csz7ptAYS/Xb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ef6e3127d40c34e9cd033ba0a53792375e7c5ad98c0f84c5bbaef95124caa0e6000000000e8000000002000020000000d5709141ad5a38898359d56c85543fceebe875b03e2bf1fadc49fe415e93601320000000de442dd60d1a9362d61eb85cd6dcf7d024504e570c5b1b126b4d9daf5c21fe1a400000005586bd8f2bc94fcd0a097735172d153fa1dde65e6467e919f61a8a9c984f1041cb4828fb999bc9eb874461c605d80cbaccc3fb3c526ac98f44382609d4c06e86	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007a9973f45af7a92d466e71fdfd1e744c6274d3f3521a7ef07dc3a9fb4fd2ee9e000000000e800000000200002000000053039187fc8a3f4fe2a17ff4c4e104b61771dbf807b03d70baffb64340aeb63a9000000044ec0c051b355ea8ee8f8360f07cdeb93ec1bb0df2fed997958aa522d8871064dfb2a2d31ff1227d52e4b26198a79608f63e1577ce7a0b36b9395099e10d5ba6cab4f87823f6d9856c62ab001f1df4eaef497b77c742eaac53b34411f30c7b2fd20ed3180de9ab510ec373f91d01fbc03d1f4e0f931ffde6ff55d169d68cb4d958446736fe83f8885561785ffadb844b40000000ffd6a17c3e81e58f021a5211189ea0f97548d21672dfe01c3daa819f22a7e66589e101f7c3a6ce56abba922fd8545cede11694cb528eb95f6208c296f257a450	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20afdd004838da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B2801E1-A43B-11EE-BD5F-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409790327"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2740	2956	iexplore.exe	28
PID 2956 wrote to memory of 2740	2956	iexplore.exe	28
PID 2956 wrote to memory of 2740	2956	iexplore.exe	28
PID 2956 wrote to memory of 2740	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ff896c04f0cd66582991f20bf9a58d8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1f8a0aa843e3255c705fb0096e18fa2

SHA1
23fb6ed669a2870f28ee6a624e88be3f03b14b24

SHA256
12a483372a1d343a8450b715eca30e58356cfc9216b825c5c51ecfc5ad07cf04

SHA512
c49844474e39cbede1b28b4b6567bcb5c2900d03f8fa2009176cb172ef6ea6fb2765706dd488e98e12a8246e0bf59cfc59fde95ba91b78ffa4d88dc131301e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4ad05cd7895170cc91ff82f26ce0240

SHA1
3e2ed82311ed073635ddc0c528a04ac540aca535

SHA256
af326ae28cbbe807427a89e588e837cfbddec24ea22f52b02f368f7a0503ee9c

SHA512
295e1c8cd3cbba36858971cb60149a9582f4b1800a517cf514c6e4262ad2d4d9eac7dc2afdf34bce1de052239a2b45713a0847dfec4ddba06bc9d0ce0beef7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f9e126fda4a59d6d7726a565941af64

SHA1
a89eabb4684dade98306a1c75613bdf8968549ca

SHA256
1c6c2b6fac7d8b191365d6ca26460784da55e27d93659d78780da6ad2cc9f3ae

SHA512
2e09737f85af410e096e97f054b54c0c9194914d08f2dd0c64ab07d2af1ad48668fd2589bad05416396c79ed2614eab8443ba2fd567f427b3ac591e7dc2be3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7267c5a02d0b3465a343f15b1769723d

SHA1
a0d4afe676daf455a6efaa78ad59c5952bb8cbc6

SHA256
0da7328b11a8748c5c5b54e0a0da570b3b1725435b3de565c35e414acfac5861

SHA512
d2a00d8f0b60e7e28fdeea66e0b317e4e36a2e4eb418cd0665d22a42151d84940a3e3e13e038fa7c4cd0ff2202e9f83bb3fee61d40210463a782c2622f2ee3ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d99eb051356726369ade76a6022862e

SHA1
e64c83cf2e0566d46f1c6733c0f2899ad7f615b7

SHA256
0734f89bf00e5f46bea5ca6f112eca913e8e2bd2c364ceeb3f9874688e0393bc

SHA512
3822817db7528771822f494bf992a84e0b546c1304295b33748641ab22c8da186781cdeb86474c4f128ff88f71b7d8af2d6e4c8767d19e7a12ed4bd7a1b26a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51795201eb6b60d56e0c26ef5c7c0658

SHA1
b4fc164ff44ac526b0ef186c4f6d605a190bfdec

SHA256
81897f5e62d645b54ff31942ae3360993e920c068d1c08e2cd1e582668513ae0

SHA512
94e7341fbf647723feb4955458c9ab69c0a4b1da21e50749e780d5c870318e14aa770ab2ddacba84fa9d6307a1700e220fe6dd1e7147efafc2e8fca99706a435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9811b7d038c409b01583670a1eec39d1

SHA1
713a4d6101e12add0c8012dbe090d5ebee1267fd

SHA256
e72bc4381f8ddc6b23b00def2add60de6ef110c9c4ed6226b3eb6a9c3958dbee

SHA512
44348a3fcd7fab342e061fe636dbc17c2ae3711d94a7d01d1b962468396eae13f8c285888c726ff0b2632915c10495c13ce492d4f15ed9eae87492385106de61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab4bf5b7bb5a6c38fbed89f3b6f71503

SHA1
05cdca0b7055ef11638a4fb65489858ce4315c11

SHA256
1c2a12b7e3555d0019477beaa77aa8a10ff4b0d994cbcf087ce17abca17691bc

SHA512
3ea1b0c13eb09a38cb63f37a19741e72b56b14dd2f8c0e27351c48d6be5383f2b72ebe5d121e05fc679e421c1551a05d8aace5a223361ee715fbf2a3bbe3027a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ec5691e86ff465c280aca7b1ddc417c

SHA1
1894a90b27490f4bcc3893cc53bee48711e8e93f

SHA256
3ddda7e0f3f545f59ad3bc05093dc4e43fd463f3c0c2052ba2b91892a5a61939

SHA512
117411b88b4e686990dc8dd3d6838d878ced201ed2efddf334527dc5d5199bbf0a852fc3a1f764459e5723ee4efab998fb09bc18ac80c125c262c549c9b05aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9a1a8a15b8b941c484b9948dddc388e

SHA1
27529e52ded154ae4230682e9c1846b08fa675ec

SHA256
a6047c1b0cbf0900c00bc88ddef48377835fb1193bbd8a1f5191c53ef0f52f13

SHA512
f4d6b406ad96f128628ad692696bb9171b0a78fec3201f9139fbd1aeedbfdfbf83811b9cb5a8af22f46bb8d3e9d65fc387dfdf22b841c24939966d253e44ad89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05cc4949098ca780e9d429eae7fc2b82

SHA1
387d2ea0b754db7b37768cb478b9c2eb4022a805

SHA256
04a2505fa3d151a5f37df1341bea5d513d5ed9113aeb206ddbdc7687f057e50c

SHA512
106815a752253dcddf414e1bd758415a424ca4cb8c49f0b48d11ad88c4b836e96ceb37555b4131c18476f87afdac909c6d996b9994eab7b97f3b84c7892fdb5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4ef810c51fc93bd28a7963e825b314

SHA1
35fe8d4b03343cbeeb9adc6d20a3028bf8b5563f

SHA256
b43ac7a16624e0b584749c2a1423f32fd8eac9f5988f62a56ba4dad30be8d913

SHA512
f0769d7274ea9407bea9d675deb2e71a34d2a089d18fc3f5d7739bf4f0fb708b5bc4002a17cbf5de18cec343baf3d6f38e56277387dda34a8d74b279e0d5c1a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c3ae3f0aaa7942c6af072bd250be97a

SHA1
635262d7161eebb0fb6adc7cfba62ccf0a88117d

SHA256
81fd9667488eea44bbbf4578b115fbebce19065d4ede8c0236c2fb68c4e56eeb

SHA512
cb4d54e928db9a57312643847965316b2958f9d3421d1d1bfda38849d2f9f998f0e1e97ea4c11679d432f2f2e3c09b237b43a35cb3ee814e00c93436a91b7f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6FB7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar70A4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit