992b0eb95dfbfc404126084014455c23342d180e4f3ac4fbbcef6991847f0315

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3df65e99d14c9aef550acb74b340c8dc.html
Size

38KB
MD5

3df65e99d14c9aef550acb74b340c8dc
SHA1

f7f5a2e0a717df4a7070466a12dacccd849e8343
SHA256

992b0eb95dfbfc404126084014455c23342d180e4f3ac4fbbcef6991847f0315
SHA512

d36950300918a49f0ccdb134541664a8ec4bd5a011a6cea6e27753e9a42cfa470c3b5ac43865afc39f38e9ed1186477306417cf6b86dbaa72cc5c34b9313bf55
SSDEEP

384:LYfeNIS2ZPxiPavHHw/PjU/vHx1ZaMD35854zCwhzURDIeX5vnebawn4CYR1rT9V:LYfk27vHHw/PkawW/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000963f6b12cbaa07785fabd577c88018c52b6bb7e1e02e1d84dbe9dce86b41dfaf000000000e800000000200002000000003472f0b98553ff0855707fa33e372dd92181f7543d172b0d8b44d085ceaf07090000000d1b04e1a3d585b9845020a2b5b3cf5b4442b65ef748320d9073ec0df514ff38cce710da2ca65279b052d0496f2e8dcb10a33831045939aa67893727e87ef62d6885c2941f9b1719c33b9f2d65c71f0eb608c759ceffc032177483fcd59627332ebcf75350daa042e6a003d1e279ededb0fe49dbbcbf6beb619010257095253f324c4bcaeafa78b4bba5cc78136c61d8b40000000e055be36c285ecc28656413387f4a4502c0e63b0f40e4f9398ed3de0c53b71002871271fb6c6d924de605cdeb1aef816fcda32b6165c3716130083c82d6368f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F364F31-A8EF-11EE-AEE7-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4088d614fc3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410307492"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005526aab1a1cae658009ac6860d8042bfe6aaa1230f51117b2a8e12f90396577f000000000e80000000020000200000001f2450bb8dce92448f66d0b0077d03447011612cc5ee59f75274b70334b9d1e320000000aefcf8dbc433d3499c088ae227ea2d16f072bdcc9cede9e6fc1550047f228ed5400000002f66659eda584ac53c0e7684d6e1cd65472eb3658d2c8b8c5fc160f9bd5e3fa16168981d856d17fd72730fc6216d0805c313d5402a2e59a3ed1cc231b3808f2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2700	2344	iexplore.exe	30
PID 2344 wrote to memory of 2700	2344	iexplore.exe	30
PID 2344 wrote to memory of 2700	2344	iexplore.exe	30
PID 2344 wrote to memory of 2700	2344	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3df65e99d14c9aef550acb74b340c8dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71feb0f48d9979a8f322ba4daafd93f0

SHA1
0c218bfb0c4e0ce29560734ca96fd1d9005ac9fc

SHA256
cf94a22bcbc9f8e7578a1874b1a2ecf80e1af784f3d8466f4375e925973eff89

SHA512
d007731389b6da70812885ae12a66e1b173dd048204663b5b739f3a6c69dfa521529521368741a2968c7f9ef56aa7ac199aaaaa9bec723304cb41e0b1fddd5ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41132cd0374e724ec2066cebbce16d67

SHA1
9e035f3516097d01184f421210247fca618cb778

SHA256
025592a5b3af0abf9a892b8bc20c3f5b2f608d05e546b16e709a67e0af0c9d64

SHA512
10c1683a1a8bdd9d5f2580ac7ec1dad022d14246219096d6f726bf78880b66eb67618490d5644333ac281974e781bc7389e29dcbe09d76d3989743d17cc05dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a6a303617bab2de1f5af0eb4ca3ce7

SHA1
aab73870e290b97444a549d09ca791012fd1565d

SHA256
2c1bdb7be6c4dc6fc759238d68db5a4d1754174b551b5afd97a6445d273c21e3

SHA512
7628911c9500163921ddc8496fc166b345685d633f461042eb4ffc7e75b57e66b9e712b0cf4c4166cbaceee98c53078a26b372e3a6d4d42f9fa4739d1f5c7c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76399846a283f028422aa0f94d21ca30

SHA1
7082250b444690e865fba4d06c8d21e0b12f9abc

SHA256
1621a4cc40622c361fb98b4a2c172a02a61fbfd8a3ed7129c5a749620813ebd5

SHA512
ec814aa36d023a46fdc236ed333a7324f1584eeef3ada6584dd05a570730dfb20e82fe7076b95c3fc7e75c0844122a602d9b88626094a293e0b619884d2fe2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5527ec21cd5cb95eb3fe35bafce0704

SHA1
96b4015e520c4e5957640a0d3c21f5f744b008fd

SHA256
6d15e949002ac587abb439ef668dcdc5c933201e343eb4f29b53ba2b6bf1440e

SHA512
be1bcc04b238b3d5ab145799a2b2a8201092988e97de296156eb971e3cc303fcb5df80a44ea6b1399462385e2916307727b15213d46dcc9a88c537ae84f77781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4cb461170a5b5c85f0074b55d56e41

SHA1
f7ea279767a8d054d5c916f68823e0f495e2dcc4

SHA256
f554e0e21e249c3bac4dd856873e8a0aea9fc2f9df1c658f233d91801f6c1e5c

SHA512
3c4aaecb5aa0f2e703b44b2753dd1a91e48f309fae9207f72c8bea7accaebbdae5c4ecb5065d451f8c255735130756ec8be1a204ed8bb56515c76ef45c4be153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8390aaadffa8731d4927ce848c1312eb

SHA1
14df7c4d5a7529cdbc6b25e1b8fcc7bca7802b3b

SHA256
fea8bea4d672c88405424016cefa55b0ced9de4bbac2a194d4d748ac1f6fdcaf

SHA512
69887df73a429940ff2b2bb9f77738e524e2a4951a88ffea99d6673a0ecf8ee34adc9de1195b7e32499bef9d9c0f31fceaf233dfc2de784552ee864b1a851b33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77635deeb10f86b664f75a456854e569

SHA1
0707a2546a7b6806c85b926f4f9645d86c32b531

SHA256
f8e2d5bd58932433aee7e4552e56801ee441b739512bdd54924f381aa79a2b65

SHA512
3e47fafa5158df2640dbbd99983b9949106d16cfad0ae18166fdc240ed480966cab7849dda6bd70b6ae885ca97817ef18a8542de7a47495ef969aa047906b493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3a2ff21d425eb023d15ccc156eb3c67

SHA1
40851736f79c20cd55b2f903fe0e8348c261dde0

SHA256
b4baac899e4ee1c19f81969ec246017f1e546a60945397ff5a59a0b86a2c5462

SHA512
ab120c3d72e3bf84f2a271c020295c4c2deb5bc0d3d54247937d9fac15bef17f69dd15792cf7d2db3f4d46b2d72ee0377e784babf6753f3eedf41d3b290dbcb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46cdc16b99f93ed184147f2a9384194e

SHA1
01815c97f1f508cc0f7db45f832ef4ef82013ddf

SHA256
3bff44141a6d0ff5bfaee29ed4b3e246bb6d7d40fc92a1d094d33ba905aefe97

SHA512
1069eb1acae571ee976f4102b67556d70f1af45fc1295cbaf541a63cad78b38104ce9634fda40e037050432a4d97f88739558a253367a094aeaab422e137eeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54140fe1a5547015d8d17970d7aaa7d4

SHA1
804743ae0291ea7e161c1d3bf4cf86eaa8589abc

SHA256
2782d924befe254cdac0f54c1f9d5e90b5452816f824d29a6d5c80e136080989

SHA512
0daf989f00b75d67e2f1406efc3a71739c4266db0b52a1539f18502ec3a7e8efb2a4f5874fbb8189cdaa8eb21d8329b9fb283b4a93f9e3b0c446adfa37bfa0e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar380.tmp

Filesize
148KB

MD5
31a7077a5dde9afd73734e0a1f67ffdc

SHA1
a7861242935919453c344c0daea8480d1aa952c2

SHA256
89916421c65ec37c339f3d0d1848157d3997a32ee81e4c9e5a103880f69fcc3f

SHA512
5cffacdab3c60e8635c84ced7c002cc2313c87ef9e84e359b50b4cdc825ee66db278f6c30721ec3b2d7e62235a32c1988f8e6be903a1043c39ad501407c65202

Download Submit