e8324a867d23b822a832d5b49996aab6bf8520f8e25d847ce9cc7750e0694220

Analysis

max time kernel
148s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b9a6a49c5b0e2ef5ba22f91e1f263dc.html
Size

53KB
MD5

3b9a6a49c5b0e2ef5ba22f91e1f263dc
SHA1

b9fe8e7c87bcc4670faffaa98608af365c2aad35
SHA256

e8324a867d23b822a832d5b49996aab6bf8520f8e25d847ce9cc7750e0694220
SHA512

82e387ae1283bff45e0b820a2e00423ecca5c959c5ac5d29ff06a2ddf126c06e87c999e0a1ad3eb8318aab72c16d998acbd53e40324c955db17ba5c8b0781d24
SSDEEP

1536:CkgUiIakTqGivi+PyUmrunlY063Nj+q5VyvR0w2AzTICbb9oh/t9M/dNwIUTDmDt:CkgUiIakTqGivi+PyUmrunlY063Nj+qS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002c841629293bd0a5a7b0806f4b01b3a0d152d11bf90ef6cfa00f92f6e9948476000000000e800000000200002000000028702b25d991d08324a2695cac88f23ed3cc6573cb064b9cb6423425252fed2190000000630d6f95251253e9d2fe62cc740bbf96222b33d395d4a50bd1de69e8cd1ef0b666aab5a39290961adccd16157749a7b6dc3e73e4fe6fadc762e431292ef17e6cd1a537f3890d79602bab5afc5fa5c7c3f7d37c40ea7860b5d90f4f48e3019452f1e45c70ccb48ca7f641a25cec32884f3c56cde59120624c9d651127683926cf8e288ca13dc9af61d2a3277066a19e954000000036d05bf5357bd41cac09ccdc7c56ac7e4e0372462e6734549d547f33aad576ad2d6dad2c6d512de4853621c10ce4b3544c93d3d8189eceea1b2a0d3548f6c496	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c0144b151ea629c8c7fe273bc1ca1e293e3ed58283dac1f8db6461cbf5513d25000000000e80000000020000200000001063b5a6675bf2c57e85ea5054f8d977f38f56e8bf1bfe554250a22f5f7dbb45200000001acac7ee50ad12ad3e8068fbff9a420167a159db9cc55c859781a95a5356658e40000000fd2b90ac94f2e9f659a773f130dd80abc862e33ae444b5631c9a15acda1f3ee448149a3a075b5b17bd92926955924dd1ae49deaac97dc33d51e6d3184b6659e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411093911"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b071183c2344da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AA991A1-B016-11EE-BB35-72D103486AAB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1948	2932	iexplore.exe	15
PID 2932 wrote to memory of 1948	2932	iexplore.exe	15
PID 2932 wrote to memory of 1948	2932	iexplore.exe	15
PID 2932 wrote to memory of 1948	2932	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b9a6a49c5b0e2ef5ba22f91e1f263dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fdb5a5cb029c684171da8f629f64036f

SHA1
20af92f93b62fe6e950882b81456f587b3889a5a

SHA256
c02cb82edd56ca7b4d6e94f98ac7b621fa39e46a948c19c5bef94f9a7958910e

SHA512
b568330176ac60c183d793cf1a0ce3db0d8907c3be5c0e520e24908dbe10dd3c1090c848ee734214fc4fa3033a0beeb08dc5d1899c1b946df4cde9eb0a7f321c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05c13930de2de6bd9ae02c2d8138cc42

SHA1
725f317c1e50b47e62170fa5f8e43f3ae0a2613c

SHA256
f21384d76f503f911ad58beb570a0882baf6f0f6bf7ce83ead6cd0d7e4a60a87

SHA512
e27cbaf28afec2de30e866eb731c05f8e2371ea30e15550e6ded530f79765d26eeed69403a7c13a6944c54924d115dac48c24ab47d23d923428458c7a8f65591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db615b973cb7c054cfb7f16a41f5319a

SHA1
c81edd9f370b4e014e2786dd2790f30e129e65e2

SHA256
1febdcc52523363c6db7082537279334a1134d2188461a5bbacea5cfd510ebe4

SHA512
7e604f8425ebc630147ec3242b9fa8d60d617caf345baf0517dff67bbf8d8ede43c08101bf38ff5f155a35c43abca4a87eabf35de9a18f21f70faa902dc48a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
958727783d1d7888a2c0b99f4a7e1d78

SHA1
4b3266e5610ac06b853ac15486e4d92dddd29468

SHA256
e8b333dfa4851e299dcf6eee19649cb01ac48f1293623dbc62a6dedd756b7960

SHA512
c258bd2ec355401e0556235c5680eb2115b710faf35d59368720b2c060ffcd510915a8ce708a05b91acffbb25925bed2d7ebb3847bf2658b3703bedfb549a7fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0557b016821bda7dcf3bef0ad03c3292

SHA1
ea88af905b0b8b96e7dbdf77745a17a032022243

SHA256
2784727e149fce3e4c14885c2898a159cc1d3b254f0eada417eb2c5aaf22dd3a

SHA512
0f61f5b1de270af1eef3d30c4869c903898947e99bad23a112a521bc70f3b429ab2477c2467f0ad30e5b4129dee0b389d80ed57bb4fb2c574cfcc7ee5fec2a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55963aebcaa0daa1ff4414f4857bb7c9

SHA1
67235b34e66581fc2ab30565cd8622621692d512

SHA256
17ffa6d693abcf1bb386430ea766421beff59131273b7c1587c1dd270cd1c3a4

SHA512
211ea753473fdc0e5eba0d5a817c20348c7487a946bf6201a7308235edf3e45e3e5e6a2095ba9dbf7f8f5cbf5c26218a6fa18564e3a21275030cc0a90d9ae5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410014eec8f513bcede2b9a98ff3d968

SHA1
19b06d9fe06a5554109a6a1cb447bcdd0a8f1373

SHA256
329f4fe18a811e51277f979dc126e033eb48b1633a23e2d4fd5f2422a2da28fc

SHA512
be51ba3301a6b2e8c0a9574b3119c39f43eb5f3c22ac368496c5c837205cf95762a5f4d37c1a0bec7d6ce4f8b36b471fd84a1aca50a49108b112b022e4dab94e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd979584e1e9590f63f6770bd0ce661f

SHA1
fe7799da4fe5615d5fe9659c08ad74a6146047f2

SHA256
9759710897740a114eb57b4c0b8203250556f25af7404a4bbc0ac3a406024571

SHA512
9daceb64a6db2ac576586740a29a5d7d627cb13647c83ccd1eb62a24c2ef14046f4322d64c11f059ae70bb258f0c0cbc0f227cdd85d25596ae287ea2a7b70072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2efda3043bee4aed0fbdc8d5a92e6200

SHA1
ba3518722bb1b4f73985d33d1bfdb32884baf11b

SHA256
3d9d98b41558ccb95476b8a102a809ac981c1ffc5a0d416083e8f269d20bc8ec

SHA512
8a1234740724d51350a4f2d04fa81fc63384c2e2bd6162d1d20f9c67b82ccece3f547b3bd0a07e3699625c37ad5f568c00f7e01acb0c63a63154566762cf6080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d93f7b28d637c3e21af81719ff1987

SHA1
56899e2ecc2e5b8275e687ad40599a41464ac5ae

SHA256
ba97651cb969fae2536ed90d6c16ff61a481a6bfb09049370baf78cd05eb5738

SHA512
782e5863f47e1c040c4e94b8c28a56fe39dfc5338c641f5f71182631ccc6d91e8acc347209830281410f085ab4f0bdbc75bdf0c1d06e3d10777cbf9bd34da093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
25565ecc41c4791c0fbc10895c1cddb8

SHA1
5710d8c482b54d7060f14bc063595a3a3b581b86

SHA256
f9e0f170f8a57f1d55c01f048a1b17c182207681b768e485aa9a504eb57b8dae

SHA512
a3440a46b2546fce73ceedc6cf03f253b9bd2cf941d4a65f71c1b66b9d64908dc1f8905d91d7390f39b4aa0a8015524376d681bcd60693922cf42856bc1180ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96XLYQUW\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD771.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit