e25ed456cd0220e538b89dd266514074f6090794c0b87cb7ecdf1db27c02eff4

Analysis

max time kernel
140s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3bb3486878262b1a528432246118cda3.html
Size

10KB
MD5

3bb3486878262b1a528432246118cda3
SHA1

10c3c3fec76eb20c7df783cdbf4f3c1db989c252
SHA256

e25ed456cd0220e538b89dd266514074f6090794c0b87cb7ecdf1db27c02eff4
SHA512

2f7bf87c776dd6af129b17f71c7eec9ab2cecd8ffe3907bd2a35ab39189b432df6743b1358285109544c823c640f2118d99d83a064f01eb12be3928a312440fd
SSDEEP

96:uzVs+ux70rLLY1k9o84d12ef7CSTUjGT/kAzpl66lq5/P4BU9lVHcEZ7ru7f:csz70rAYS/W2ZQPTPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08f3e7b2444da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411094477"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008eb98f7590d603a2faa866b39fc8df392e475cae20b54376badd3c6d3292b61f000000000e8000000002000020000000a3ad45a29c5354a095dd5ef5b1cb140186f77be5846f7fbd5cec1e9d1187f9ac900000006cffee2f5fb9dae5623d77cb59033f591276c37bdf6c2335f2596b43c4e90e82fffe765d09d5a05a9e4ce61b38d806cfe83855d07dd9a923a05788c945642cabbd00113484f3cfac222a8b93e6c10d4b6481c718571c36974064d28ed821d6bb14ff1d031209214c323b7087fae6a7f8445d1e40ba2f325b37c2dd8839ec920dc089ffce79ec5814a58f321dbab1b9e8400000006136e66fdad9de23d973793316b9c5df25e7a190d7595c878b4dbcfe88a1374688cda4543d3f2cfcbd0cb23df259798587891cdbf0865aedeb3cee80280ad6e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1465EC1-B017-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000bc724934fa233d2edbd45f0b1d111d9dac54ca1eadf12d7cf32a2616daa457bf000000000e8000000002000020000000260869a66436cbeb6efeebb820e0687860166074b71110ff6a5f99dbcba13b93200000003980f0061964421644747096c5e8167acb296526ee1284b519a72d3ff6972c02400000007abe0ca04c842ec6349802d17210a5043bb1a2241c53df8bcd01ab921e1fedff39fb60ae9a375838b4973d6a353b0bb0c7564e4746e53db9e0a205dabec7d9a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2360	2280	iexplore.exe	28
PID 2280 wrote to memory of 2360	2280	iexplore.exe	28
PID 2280 wrote to memory of 2360	2280	iexplore.exe	28
PID 2280 wrote to memory of 2360	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bb3486878262b1a528432246118cda3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f5129334e687e70ed5b1c5d3e3f98e

SHA1
c7a1bd3d65059611e7004a16417c5efe27721da8

SHA256
73ced1ffcbb4475768580b950ad19f01c66dfaca5b284053d60fded67cc2fba5

SHA512
0ee4fa1582474fd3e84e2db036eef4f49dcc98056698d86ba2e919ecb9b33de1ef06b81b1344dd1f84621ec486108cd6ae939f8ec418de3656387b5c65769273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd9e8bba0ca38db7873ef6b69f144ec

SHA1
292e75357c24eed94d03d3b4ffea5813377b5557

SHA256
bab35f03ec2d7b5b8e523bf4f5a8b3a244ec519a13fbeea6d6b8a9e16dc4fe67

SHA512
e57fdac11bba4bdc24c616f10b71d76524e6700e39e9510fa6e589d48a267533ab210fc9df89a7ef1d352dda87954e3e9e70be1014d78973346030f938effd65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ebfec10661a863d123a0b62ba8418b3

SHA1
bfd461785fdaeba5dd0235fb2b87facaf63a2cfe

SHA256
e8a1711ae0a71702fb81a0927e3aec84e22e711292f089b2b1ea4759b307e66a

SHA512
c4d28a8ca74054cdd44282a283e32898502f4bb10e81354b22b9b1a20eaf99a3c4892be5c6ce18a7bf7588f1ccfe7ba6d2c0fb0c16e174398e2c2173acc62796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b02d426b9f9fe57b13ade0aa17dc4ce

SHA1
bf0cc91ed072bd063e420dc1f8264f67bf72f8db

SHA256
468c958cec5a1202caf76aa9de7cffba1f73a717d2bce28ae4e36978c99333e7

SHA512
c85b2b423fb5c3a6ea2700b5ce3777088b937203f0dce29fba3962963481262c95df80dafd855808a127292e8f0b6e3538ed839bf618d73a7dc0a6f8ae5e8617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0ec88e87d4b7b081349581645ea4613

SHA1
b5604af6ea20ad41c465413d00aac1c473e5adca

SHA256
3decc9a68ea01315b3ff3c7657832b00f7e62a49b22ebdaf8c6e139c6420a3f2

SHA512
40ea97e13a5d58b1f5e884bb940132238f59e3711ee0328a2f6a8c8d870d1f7ae7e9513e64d6e4e8b8a2e0769f4fd781d9cda98d5f42c5ccbf4a1bd000cdc4e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6367d6c2e1d452db4227ebaaf8fe3bfe

SHA1
e41ec90b3b501ed2ce891dbc929be34a1131c2d0

SHA256
1d956a9051278d01c36b3024d2fa7fb04ecd50372aed30667e0aeadaaa30b5b0

SHA512
579905897af332c3d4d8c0aab3b8f9105c469aa7e8bc778967612a67a151ab1dcf288c3fe9e94d2267711b739de49ebe42ae140d0978d0a6e9355ed67aaf88f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8d7045ed27c5b9ee4fdab70bb73bdd9

SHA1
6eafadbcc2b75a6486de0cc5e009c594bced68c4

SHA256
c3f9a622fc141dcf7fb530b81621fe551165dc08e7e12d57a1599298cde94c8b

SHA512
f2b381c6ceccf48a8779ded5028c2ce6d09936b46ca6c53bbebf00639d197b2cba1e16aaf3e77ae7e0ade1455d8b5d0bd633858841dd40d0939fad3b4df85d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98dfc572189b0b9bf8319d71e07d6b93

SHA1
8164ddeba233cd89933d3870d0582852a90e0e78

SHA256
0f48dfb0323f1fb63b1f11b45cc563f26dcc4062f9c72c9b56d9290a86354be9

SHA512
461b5c705334a33caee665be3ed916e51a8656176f237fe31c1e0819b950ab195ca128d1ee9103e9e4d397b5378b5af6f96f0df69ac6ec1dfcddc70e4bc62c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc0b0d1d49095d2e53dd888db9a3af91

SHA1
362b5fbe8c687dca92fde77023f0c4e7dba799d0

SHA256
e274b6cd5970b606b1ac33978ea508754d8c9abc5003607483497bfa28918757

SHA512
ac966560ffbb318fac0e02026d763cbeb2a7d3a6e28a4bbd8ed95ed51466b35a9a6489e8e03ac25523bf160d30d9915096ea39418954d6bd9467e5101b7d23be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db8a88ca6023758f385205997eab4d45

SHA1
3ffa0680194f338d27e75924f055b0c781fa073f

SHA256
66c4c685e9bfba47f0b41d476d26133b0f749801fe5bd4ca5b6cc7dc64d8acf8

SHA512
e0d4ceae3dfe2fe43289ae7aeb5a13e0604f1a4d57a70cd1f3a85ffbb912d8c3a559491e428db9b49a80c551889101451f52a542068c262e9793dacf0f707c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5799e5c4b7d3a701c2b320344bca3ac

SHA1
cbf774021d20ea3d2b72e6bc5f54c29bc625c415

SHA256
6ce81d8b8ddd39a90c4660e7b23836720a8e4e0e6e8179aa7f2bca502fc4157a

SHA512
fd84e18772a4ee766ecb758d4da0e3c8b0e7082bb8820dd85eccf563b167aa2e88222cf3aace049b87a7b5b79fa8e03de6c5cee3cd992c6aa87fc4a2555a8ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e2883145ba1c5b40ed566560588b937

SHA1
48c438d229871dfdc5209b1b60fc9ba718474384

SHA256
accd54f2c5eb8f8bbd5389426a82b8d792b40fec605769a9ed9a04c1ef9c3c59

SHA512
2c67274b971d1220ccd98da973e5bce7674d24fda990dda9956e415baeedbccbaee1348279a011c161d64709d45e96f7813dfbbc81a64f36ea513b0eaed95463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b02705cfaeac07a179e0d775f57f876c

SHA1
4e3d4bfd86bce1a8fbf40ed6d7a54cfb3f9f2296

SHA256
00023d71385d74a490c5616204b848df97fda40a583789cdcb1c91aa91ae53d3

SHA512
160f4e94d5acbe2b3501dbc30c73d72c5852e8659342e3025db48538ff4656a7795f6705b40e29512465b727bbfc2def2e7291ca5d6c161de587deee3eee53e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC268.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2B9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit