b1fdb4ead2d10651fac2223813f43d4fc5fe91c86f1e1d0d0cf4e7b0ba880fb7

Analysis

max time kernel
119s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b021a1a57fdfc7917444f545197d8f0.html
Size

1KB
MD5

3b021a1a57fdfc7917444f545197d8f0
SHA1

e0a73806f543ad634cbf1a9f67ba6bcc651b9a11
SHA256

b1fdb4ead2d10651fac2223813f43d4fc5fe91c86f1e1d0d0cf4e7b0ba880fb7
SHA512

d04a37a2a6b95c9541fad014092251dac60a3a3698c86050809d48b4ecd7032d21366fd95b00285f3d45b70c71dee7fe54782ffd6daff1646a5ef9930517f374

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09ddc13493ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000591ea2ece871b93d0016615d74b239875394da1833c16e56ffe6c80b42fb4d9c000000000e8000000002000020000000f3318f6b44d5dd1c55717d273d881b9f9bf1b4c3eaf3c33c0da1648f6cf5cd952000000060ec36a749e860a899d92e6304b66f9fcf79b65924ea602876f1f1a47aad8354400000007f69b599aee43055e864cac3d2961249c8b532e92847b7e100fc49fdc58ff39e83eabd8da5a890dd9662bcc8f79fca2d612638db7e4a89bd41197bec6b89c1a9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410010682"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009402e634dd957922b51a1ee4e2ea27c390fb1a3789507a350cd10cbd03421017000000000e80000000020000200000006a58b2fc3786c924401a4b2c5f4b6a8ab3e2f89098bcd5c4ca06ebbcba9029e290000000b96ca5b5070a8bd14956407b02a921d408d06905e59796cad32f57eec51bce499d73f6dbf05b9c4c390df2078d9e3159329d2d2c66683e92baa1684dcb1d776f947217e3322ab017496383b81ff1d5b07e19a46a862df40368a826625997da48c10dd604b07f36a6e85bd4539a2a19355b820733aa65cefd931d41e0ac516a4015f530c6062f8b6859256e16a9b99aa4400000008d5f5fca9a3454ae29939d0992edc9900e7757086ed9dc00987beeb030ee2ee06a366120269045ae48750d3ab523ae08572c005d3a9e4b9f5788575b34b52896	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B5D31E1-A63C-11EE-A371-5E688C03EF37} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2652	2448	iexplore.exe	28
PID 2448 wrote to memory of 2652	2448	iexplore.exe	28
PID 2448 wrote to memory of 2652	2448	iexplore.exe	28
PID 2448 wrote to memory of 2652	2448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b021a1a57fdfc7917444f545197d8f0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93706bf4d0b1d4cfb66896cff8991d09

SHA1
e2b84c0f74c05262983122f0c301a045b8b03831

SHA256
f416c85c6f13ad9a44789267d8bd6fdf62b2c0bd44e65e8140e54d4dbd01c0d5

SHA512
5f9e2a395d31a8f673d3ba3898004a8874e8b584a179feb98a423ebddebf1f853cbcbafdbe6523514c17669155a9614a3a5caa5ec71cec974bbbc1e4e3c627cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
929b628a981075c564ed0859c3201a40

SHA1
721ae7db10cfac045065f3f3a322b6bba2b21012

SHA256
5ce5d68a2e5d34a23d560ccfbcc33a4b4aac4e6c18dc6ff993170dd37fb00574

SHA512
f74c10cb00d8af825d4fa59ca56c9f5c36d279c50a1c23e7e3d906cea95d43ac8b528f7cff51365fa19b2f21174d06e9c98c93b57bf50ce31b248361328ac454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a615df136e5549f9c3714cf07999f51

SHA1
7914a2aaba3fe572da13efbc83da1ea27fc949b0

SHA256
349204fa325a1e6f8149cd5b09a28c6672a24f318e63d9dfbae0e0778dcdbadc

SHA512
518ed6e12e76e8bd568d6405d698bebd17cf05ed23f0c2a6718bbdbecb78e38dcaa7804c46c2facf0d98044feba8f5ee2342ccbe81b381fb76deb750f3dc2588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dabbdaf44b7d025278e094ff0af720e

SHA1
9acc058609e7d16f37990322f949bf56d5f55f76

SHA256
ab2457e5dfd4d2206f49bc47ca6522279f57a1ff1ebe6108b694030aeda52aa9

SHA512
9d750b90196f9f6cd1be64183a5975507ab1abf452b7dba0da2e5d2ea06a5abb88ba585480812be02072d37b00f27d4e84724110c4a2d9cae3caabe1305c4c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0330b9c926098015007f514733cd1f9a

SHA1
09d3b9dce82bfd7bc6fb865174f50e3307b55bb8

SHA256
c3c6735835a2c0d591a17d00f3349862253aa42480f52136304c5154bb91142f

SHA512
09842f8ca8ecde380473fa250a9b04abbba15edf238fb193e18877de6600fa2b2c060504221d8fac638d0299fef9e6d688064eba2d9877c570aa0281a79b1c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff2594cea0063058d5a17dd438b60123

SHA1
6eba93a37280f8f088b37c6ece1d3707c5e975a4

SHA256
c5da8477bf3f7bd42786a2d72f181a7469558973ee25f523087e61bb9736f1b2

SHA512
a21da8e84e3efc7055722a5239f7c59edfc7f95e3f5996984cecac5a269333cec4a4ff22c0c358008cfb2259d1eb8e8d8e65d7548556e44e5f78c18aad4b7b27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20509a06b38900d5f5140838cee842e0

SHA1
422c8ca8f2e35e2a252488c2c9e280c846a824e9

SHA256
29df078632c9388c3084882dcbbe25cd6ae75231146bf0c692057dcdc0ff669d

SHA512
151815c2d7e1241e0f099d103fda5ded0f1ede2409a3ac81dae74823a18756869b027eeeb07fce6c16b799a548721039c7199f44a585755a77b27272f243f14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb1d6028578a8e00301f1d135e118659

SHA1
df3d0f8e5bcca33dac1cb02794fc8dfc15a4b2c1

SHA256
3c4432147ca5742dd2ff1dcff9f08182ef348daca4142fb5668d5e65189074a7

SHA512
cb1097054b602fec573812674607cc6eb016fb7c5ed2ba30c39d6e559f84875676ed80341fe59e0e4bec2fdd10fa02694208d8ac5b1e989d64df6a186074f8f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB01.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarABC0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit