1c4c803878aafd026c05ac8536684de7948e266f1620bbeb0852fa66eadc869c

Analysis

max time kernel
152s
max time network
177s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3bb19b66c978fe3d2a9f0bf9ecbaf456.html
Size

71KB
MD5

3bb19b66c978fe3d2a9f0bf9ecbaf456
SHA1

b0a72b9ddefa431533f327affc0a2bd046ce411c
SHA256

1c4c803878aafd026c05ac8536684de7948e266f1620bbeb0852fa66eadc869c
SHA512

0e455504024d2d255134792a167fbb6b24352f7325179e216d253efa098dc5856306e051f4d9c182addbc3b7dbfca1da574813c388e6957a5527af8e54a481d5
SSDEEP

1536:+ThiUJwGx8BUwg8zoah5Xgx8wDctqvLINRxbBdGW2PFbevCnZ0IPC:+ThiUJwGx8BUwg8zMcpBdGWEjnZ0L

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410669097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38FFD621-AC39-11EE-8183-5E688C03EF37} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002baa04e8580c63cde052086b71b3b93b5a0a5247468c5d2b03fb1c150d54ed54000000000e8000000002000020000000d5cd85ed46d471f5c7313cd382f76454f1e997fa85a6d64ecb32c0d42a6eb0cc900000000193b5afa2e4b8cf57e259dcba6d704d89045ee01c54c516228e599b132904569095e86d1994d7f4f6ed6ed4e31d484dc10e5c2c22456537e7ce2a21ea6b834c8912fc5344b7fc8d36a0161a4179efd1442ad6ca4ba27669f4d4ad1bf54a334f044ef19af9f18a0ddbc2282388581fc146f6d2a740eaf86c5877a6b14a65e7f33259d17396956517b89aa0aa7fa1ce8f400000005d74f7905c30523efe37ba674461fa1fcd0b75771b49935c296f3c9fb8df00c87372121e0144316695d5a0712b4cfde0ce150c5b99ffcbe8c42b0acfc156a15c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b33e154640da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001a737300e3fb75a5ffbde8360a6e84e09182582b0c287092246a625d46855eee000000000e80000000020000200000007b8dfbd1356c37d79eab2d594574929494d5e9bc03fee6680b8e29e3c8f2a8a920000000bdd774438b60c1ec97295b2fb685e558c1349db0d8d19a91f4b715a5db6d318d40000000e7550c304c4cfde53d5c32a8f245c90e762a08c67a26c9f860465efc5c9194ddde7aa4db40ddbda32f2a0d68c3ba7d7608dffe286db7cbf8391e1dc992fd9ea4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2708	2544	iexplore.exe	28
PID 2544 wrote to memory of 2708	2544	iexplore.exe	28
PID 2544 wrote to memory of 2708	2544	iexplore.exe	28
PID 2544 wrote to memory of 2708	2544	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bb19b66c978fe3d2a9f0bf9ecbaf456.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a42513a40b79f86989c6e55de230d2

SHA1
253a8a6095122bfc0fb4d154fe19adb36e0f0693

SHA256
e1f2397e9e92299dec4402f0e195f40cd1a79bbf65af4fb3a001d8b5630db9b4

SHA512
c357b20abc2db8489c974c8310dc57e9f2fde54b8bfe7914833bcdeed66d710328dad2777ce54ca115615faf57f700eb32dc5437e5c3d369ae73a7b848931a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
113ec77386aa096d99093c8ca124fd42

SHA1
7688d67b09d186aa4605cedf191f0108e7df4519

SHA256
de05bac7e898caaee90ad9ff82fe0ca6fe05fd734c7c73e86c50296945ecb9ce

SHA512
bf78987ae6c26d9948445846c0df5e8e9a5eb5352728f7b821621e43e79ed1b650cbb1acd5fce7893b4739e1116a5bd6a3eae56a4f8acc7db67b75f43f429b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed970f85c3e0c322c66fdece7f26c41f

SHA1
051a1437b0752a053791f6e7ccadb274385fdf13

SHA256
282aa0c8c6c3c272f27a708e6f9d4813e9d26fd812c716b64edc8bbe976bca37

SHA512
718a139d53793d257856df758be57df8409401cfb10147c817af1a81f11a61b7bd359c828e4e8ef4e802a370f94fa7347ce216150711f303ce206e85a959f421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ade5b052843a12e5d82a528c6da569a

SHA1
beb8a0e5187a969f266355b19a6e81dc7147c4a1

SHA256
dc729191382593475e470e3d89b0d420571daa7a3fc619c70578a9da5db2c0f1

SHA512
2fc1a145f0f5b9f76c00f0b559ce4c35fe77543a98cf5c0e1617e4a4489297d25403f3339a3af83a18ce086f48d52b19d7ea97260ce6a74b48244b4d0c81a41c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505208d0f34a739de353277475f0de7b

SHA1
e407f5279db4067364acac19a76a70df713bab59

SHA256
56632a186e9d6c0ae6f913aabb87724af1bc807b1559e6fc1e2dcdf066e632b4

SHA512
83ee8d1d068dc45187b7fd9f1688927c074f1eb4af0fd7ff09c7008294f0d98da1717f2dbaccff111d4c3d25ad9665ac873405a2a6abf9c16f3fc70bd1be8133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0db53a206c0934b2b90fe3421b4614d

SHA1
af86ec7fa40ee2704601981d830940e49437554b

SHA256
06d00bbec0b8ddc24f2a0d849cbc4ac423bc4c6be928f6ccd54a9614f68297b4

SHA512
19c6a339d8cc3a0dd186c4455f7213fb786bb87dbfe7a8ef49dff415b0b8599ae8b0456ec2bda4f2a6f29c3d952d999084d57b80ce611d907be81aede34251e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cffdfe0c2825cfe1fddc995ea32ac859

SHA1
01ae5f0a04f74076a8e8d8bace31809aa70382eb

SHA256
d337a53add24a2a713ac32ed34248dd425669ff599ebae743fdb3d41d04f45d1

SHA512
da2689bd4be7fe9a30e8931e32bb3cb5767494de862fa3848367e31b9b19de7f1ed87a742b5f63d4b5810f0d4da70472b537b4767ba432415a3b9f9e3fa3f1d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fe384621874a1ef748a8900cd4c5b6c

SHA1
1db69e0157066b9b679c28e0f4d7431b65c4b15b

SHA256
569b57d0633b25e775f676b985b54e0b4c623cafd31df4e510f3e2267ab304e1

SHA512
ae327af67fb46e6319cb29154be7845ecdde8c75a20e4dfdcf3077a2c883c6646bf8a8555f54d7b69c8cdd91a616be0f2c22f86a62450d9c3b9f140ea2275ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb63022a4f513eab47831fabfb5b9234

SHA1
02d384752bfcf47e8cf121271e40cb2ca4a0edff

SHA256
fd80c39a2171a3723dde8af29b988fb50b1c0bf124e3ed075963001d5b223106

SHA512
c5fd3dce8cd6c34a1f54a0b981465359ec1a30ce932365a093d74c5cce1bc3c73c699a556a9a18749eab7c9316b13e791ae68f7d017309c2d37a2705b9b10527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bdafd18050d51dc9af848968dd21fbf

SHA1
db827276629adff3d403e8e615f7a704f560ee82

SHA256
83f58929c68c0be4911a30ae5a677aac002b119a23e629d3f75c6bbcd2aff41b

SHA512
25724eea716f435ca1a261a92acfba43ff384cb2217e3475cb0393f7be06fb4ce6cd7722b1fb5cf745feadba06db189afe8cd9f2c099b62c327383417cab0857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3a76a6638b6d509e53aee9bfbe5083c

SHA1
31fb2993eb2ea52ca11c0db93b5586550da76a62

SHA256
4b3ba9e4726df38b9f51dde0bc3d10e8308618a3ab46ac1b58db71cc287fc87b

SHA512
9a39d202444e5fdeac3548f08b05e3b0e3acba3f3bf901212b94675b37621e3125a6f1815ca0dd5c8194b5bbdd11c9817a88d4738d7a9341f13e4508fd7c1a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3dfca0a9d4f8ae691cdc2bca1dcea44

SHA1
b16165f6870a40f4a4bb7a0d9d116f76f865faa8

SHA256
26abc8fe45323e053e029f25ac49e819ddc416470b1fe99b53856f31f4ffce6c

SHA512
e7e9d818e35b33c16044a5ee44e8612546f1a975d7b91da8058aa4db05a734982f65b1d9e79bb85569bb64f81b8caeb4e7f4900d6aa51efd839d260e1f33cd71

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDE9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE6A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit