0bffb40b875f5cc88320e18242fc13256f1264c9749eee68baa61370bc056aa1

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b7cd742a10f147281a4e1148b29fa00.html
Size

29KB
MD5

3b7cd742a10f147281a4e1148b29fa00
SHA1

2bc0206174d5b906c9d182287ba6439a1a79fb9a
SHA256

0bffb40b875f5cc88320e18242fc13256f1264c9749eee68baa61370bc056aa1
SHA512

8498f7e3079a12b89d971071bd368ae3088409449ae45fe49b4f10e63164d9b555fddf6d630e4e5dc34bca3b1d41a2354df95d82e2571972d8ca20b094273497
SSDEEP

768:ipJ5IfGh/K8csTxSRSiHsaa3XacoOC8QcLQz:0HIOhC8cwEI3kcLQz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003b266529e77d6f148856222d52e6551cdda85fcaa07015513b301b917985839f000000000e800000000200002000000066c4999abd1496124510d0d8c4b01f8e691af732bc0483d9dc0c3b97007f26d390000000d8a39165d1ef8e1564b982ac700737636d77e57eacb6beb2badf1f38b51656d4789be700c48a3952d1d79aa3fa1094d7893938e7378999a6b48acf78ae8a3f72c68176a1f9fa72fa5672ee106c1975be8387d0c6ad468b66d28fa55396aa4606eeb2ec2b9ecd694ed6a338ad0b9e26d03102c57995f5a2000c50b3f4d4452aaed8d3d8cb7cfc847664bad19b641271f840000000a79fe66d5cddbfc7a668d91e13e93bb202403a58d49c15814f450536e20b6c6ee0679a5213d5c33c378663df75418e3e4f40ffaf506f6496e90da59901e2b739	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c2a8852144da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE6A8111-B014-11EE-B0BF-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411093214"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a5ccca79e9c581f700cf2fe94c49ac385c43cbddfdaa22e433812ffc7ebe4109000000000e80000000020000200000007b5788482109e6bf3daf96e3a48fb2645ece2ef345e5220600e4cb91381ee8e920000000edc420989a9b1d4421fa4ee31caa351de0568632fd997e7e8ef006bd81b4a56a40000000dfc16cdfb8083b523dbec997551e299d67bd607e90d0c6bffdbab777b69e8ff603eda1616fa8c09fa6cc41445339b9c33fc9029d7610b642d582e38766c28d42	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2796	3040	iexplore.exe	28
PID 3040 wrote to memory of 2796	3040	iexplore.exe	28
PID 3040 wrote to memory of 2796	3040	iexplore.exe	28
PID 3040 wrote to memory of 2796	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b7cd742a10f147281a4e1148b29fa00.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
208436403c400ee9d5f920c8efddbfc2

SHA1
6299385b5a6279bf723f6265b84ef9700b910e6c

SHA256
684fbdf8bc777a041e14ffd04ee2cb3b8fafc6564445134a2d8f4bffc2a4d644

SHA512
e19118636e03392499ffbfc14fe5c958860d48a48e87913376df556a7d0708ef1376d306372622c8b4d468f5efea7afb8826ff2b1c3a067802084cd701c33b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b93438a8a47c6ef498e7bc2c7f34846c

SHA1
bee8effdb98cf94bcbf40629e0268348774e0486

SHA256
55a6f2ed4484bfeccfb1e32df80c85d9648523e854f79f066f1fb8b68367e36d

SHA512
7123832432697caf93b4842ef4e9d8196419e196efab7c3f3e4409ef77de814e50f4c2df1553c08ae7b57fe7337edbf914566400bfd9c39bfdd397b76be5c712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbcb23bb2337a321c5e1712e76e4f403

SHA1
4a57c9d75f4be32e33215c50db7dad574e785719

SHA256
11a7e10573774074b93efc0d2abe46db04b1e3bf884a0421ef2acea2c15d2b16

SHA512
69547dbce1b8105908fc4a590f37a34e678b555426f5e1ec032f8bd039a393217a00695c2773df18a9b3d1414db607e452ddece4d6ed1f69d697a8c78ff039db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02b403e41bb02c546a4cc69fc1cce1ab

SHA1
77c200601007432f5fe2f3e1d73e32def172aedd

SHA256
bc7f4a75ff5e0748ef74f3054cc3846776f5eb13bb7da3799c5675ac5c39e53e

SHA512
2cc87cbf7e382554e3727d856a870536280f78914f03c3adce0b788f446733aec96f0569c5c2780dc5aef10bf62dac0fff30895fd15ca10f66a4304a2be87f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20840078525059c2187d1ac59844c871

SHA1
86181fe72c61783b00da1cc94be17786812a9828

SHA256
faebd7a0877a769f1f080329b259a54de001ef10acf4a5334f18193a9ccc6368

SHA512
b6769fcdef3dc721e3df33b46e160d59db45a31261967583335618f37f3ac611bd193b78473f10a2f7576859fb7c02485c3c17d4965917fe5c613a56b4b3c11f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46bf55184cbc067e1db00cdf309dbb90

SHA1
bba60251b863d3b4e8a6ae85f029644c4d5dc1fe

SHA256
4cd8c6b48cac52c78505bfa4f4cab39fa3a98d6ec67cc6dfe159a26e5fe7509e

SHA512
dcde8f8b3f5fbe017034064e9e1b0813c9e5622723adefe00aa17595f2d6e107b4c142db20d23b1213de2d0e665c8ab7ce78b69350734438edfe46a0fd1ea29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecfea1a930121ba226d4ab7576a5906b

SHA1
541b4b581ef2dc1729490e1ab835e7a5b7144024

SHA256
2bf343a22d47555de5546069cdd314cb085215581feb6ab7f29f87edc5f5ab42

SHA512
630212b096519803cabe30de9ec5cbe0e58ce80519f361970c655cb5abb6b69af198a68858346f17ab6ca0eacbca94d39343f1236282e69008740a9d299abcb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20181c7c16503f4d63fd68c13edac8f6

SHA1
de6d97c2f59b5c03a9e97b797bc7175d895112b4

SHA256
e1c338b0bb9d406e96c351d07a0c819bb68a82fe9b154713d1bfc8da14b996fa

SHA512
4996f2adf8429f52f9fe22e61cd23bc6383364839df84da73d8117dd6cd1417fb84cde21c2de283a6662ead05f3262e22c908b14b304e021b7e88e299d167f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
248075fa16d9e0600c11d8e352809ca4

SHA1
6edca03dcfdabf0726f36bf07c3ac14d1da62810

SHA256
ddd7449d92885aef882fe1f8f9803a33e5af978719ff2318e417fe098f7b3d89

SHA512
9e9b4f64ef2dfa31e65e74643995aacd9410d0ed63927a28851a16fad12eed2c47b96e26354a7feff8df021d1ffcdad05378b60ec46e798d3d15d74cbba8dc68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdbc16fb8c27bfed1c4b84700813f7f8

SHA1
7bc003c1dedc9892fd0f40d06af501a242bad2e5

SHA256
a5e4c4901fd78b03e398e4a030eabb72169ad60c484a58daf14bef59cf136978

SHA512
088f012df769f86c34a8ef230b5524d1edc40924ff92a2356aa1ee037942383f00e13ee64afe9b44fb0b6c7a3f78f3cd30f546f8db46d77b563fc4dfd3ff3d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\bWqszbcmS[1].js

Filesize
31KB

MD5
59322eb1e702e43fa4d4104c80d7770b

SHA1
eba102cd3fef8270e8703d15efdc3d0d0d4f1da8

SHA256
42789b56ef9ea52e8ecee805f214f4ce21beed10147a76cf648399f20318ddbc

SHA512
9e7f21f9d0cb51f916db08b23eaca13bd9ba77d235b670d0f85e867e6300b9c9974da21fb3034b5c6158743e71cc6f29dccd26332c282184c105308236b3c7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C0D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9054.tmp

Filesize
87KB

MD5
f233f386a119eab3c4bc75d6ad42082c

SHA1
7291a9a7f88497b35c57a287e50f20497591b115

SHA256
e90dbe70b79bb1bf8de75b9758dd97d1e571d8d5f057a9d1c73599d1834f8966

SHA512
40d12897e1999ac1785560c03f1194ea80d1d4983467b3cc7dd4e93087df9786ca39d7754654808ca910a7287ebfe81cfd9485f49b22cde98f472184417d68a1

Download Submit