e7db8633e825162058496720bffe4872c6f77acec4c8533f2307968a825350ba

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cda72e9692bdeac2c35bf921cb002a1.html
Size

7KB
MD5

3cda72e9692bdeac2c35bf921cb002a1
SHA1

5a2859a98813fe73664a5e729b5e7f32658f6430
SHA256

e7db8633e825162058496720bffe4872c6f77acec4c8533f2307968a825350ba
SHA512

5e9d214a7aabbd1fa7a1d5ed1d83439305c4298ecd5a2cd8e376f69b62859da647c9d9a63ad78792c4f6b88a836cec97b50acd75e2490e46e8c59b8fddbdde42
SSDEEP

96:uzVs+ux7KvLLY1k9o84d12ef7CSTU5zfAWRKxcEZ7ru7f:csz7KvAYS/3xb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000bcf11cd56139d1ea1cde65160b2d422a1fe7b255fd589f6dfe0702d0724df025000000000e8000000002000020000000fd4ab4e2cf405d89270a83397515df493d120883ef978d34b60dbea861dc8d5620000000300d5ac9787f9a18bc5b1d1b04f7d99bc41d2bed474c38968cbf0d0ef5e16fd24000000018d4346175443128a9b645cf44006eeb4bc4b55c593fa06193969ec9a788b535b23bfed41242a2b6ece35b37c7d1542a4cafd8a16f05bf0e7413639f4f6fa7a0	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ffb8b86440da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002f6d222663b557ddfdd52a85a1ae4781871f079096f039f5b89e340b2f8063c8000000000e80000000020000200000000df51fa9dc5efb96629082decd624e80fc598611f4fae8e6a7e3840958aacbd79000000026c9d837a8baf737a984ab25b8fe7a1dfb8ef8da3eea80f232f7e4c7d267f46a64c4e89b8c33483045c73390aed121d9bbebc84e6c776808cd890046e42324ed7fb9919ebddda196b8685cd845efaeb617d5b0dd1e95340b7443e661c22220fbe78b65814cd92317ffff7ee0da6e6d8ce5c71e9eb0a00a64ddcfac4116315d662727b1cdad770240500ba346c2be5414400000004eaa8b7f18803e8d99250b8433c26491d7808149cc304ae3c8ea471624249214147263516e10487dffbf7cd0e6f16c6180fad740cb95c0e5ad59376c55543698	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410682271"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2B08ED1-AC57-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28
PID 2220 wrote to memory of 2732	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cda72e9692bdeac2c35bf921cb002a1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d28494e4cd1210b55562911e48d76c49

SHA1
a0f77b59e5b11830716006391f6e4eff74245e33

SHA256
30d7d42c765f0caed6fa49e80502bcff5423e4518661271f92aa10430660f369

SHA512
df09ba582b121436d443bc63d3dfd05a41f132a7657db0a8d8a3f7a3947f6cf09aca13fa0b49dd63dcd9c1b7eb7ca8826ef61235d3fcbe348205d375e6b21a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59de9e7831eebde2e0a68874d0742155

SHA1
23096c0e23c2339ac34b82303e37776e25f29628

SHA256
e6e940dd991b4b9207e5e5c13e627cec2968e9e65167de56a60444158185a6ee

SHA512
32423d7556ce46423a104bcfcbea5d5fa4f4a652534b446ff11be50b9c8e7dc2abd8801159f9acee184ff8ec6d04c057a778e99493ba8d32ca685530100ab984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9671b8e5a961fdb057b1537fcd613251

SHA1
a2bc45d4e77948f777b8a031a3a1c968e8794be1

SHA256
9fae61473ace657b30832294534dcf3c5f046890e758045899e69eafa3ad9f03

SHA512
a4baa0a519d78da4f75c0da6c9f9ff9ff257ca92926ac200dc894a0a704b8ea30fb8f1d5d93ac491e367b36b683a50be416c6882d3e2406605c5bb0731526c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b21fe4092d3cc50a54b1b1655e21f77

SHA1
76ce2251983b0748d16875a9b4291aa79a54a01b

SHA256
48068d9389fe37a645390d35f9179a20886051918cbcf517e0e15becc6d85291

SHA512
22376c9454adfdd8f6ed542031be0147284953f3da4c672c5a1843a2e3fc947d71655891de53459618393911b69d743b4c0220bf7bf41e7b251f477088996f4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee6276ebf331baa5f5d97faf425bd0e6

SHA1
8f5f5e209fe0d95b36fac0a29f0e8af52f08be87

SHA256
5c45e7c66825119408a300e712f42134d8ccb33943ba36340db9ca2573f5919f

SHA512
8abf1fd15cfe3144682b70f74ca66c5f681138b552ee837cbfc89682c0b61bce6aae6094ac9bd6cc70531724589faec456e2cd78766c0cecc11553c2592933ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf1edbe63a213dc400e7ec7343e78f9c

SHA1
325e9de62f3a6634e8021a22a536a4dba37b858a

SHA256
4824102cab3a268dd85b328d2ef3f91f0e96407aa6706979eb5a3ff2c2a75410

SHA512
2ce7eced5b9f740d336b2faf27a4f91a8843534c8e39235520ea16925e80d00de1e81c07dd82c073af3b604b86db1c43ee79592a5a5865e5ab9015735a34772d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eaa6f75e9775f89a11f8ad25e3f7a11

SHA1
06e4438872df120740e3de3efe8c172fb82fb837

SHA256
d0c7ae64a5fea45a31365e8640db2b1269cee02d1521568b38ef902749fbc731

SHA512
a2f5b80137b78ff202e96905aa70a95575be78d09d55f72ac0e08225864fe18d67907a115058bdaa9710a87d5001028d585d5cbfd9de93b08eb7845d9f7a7e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df9d008dd5d250edc7e708338ebcbf5

SHA1
58b1dc5729456ddfb3a72721f8ee5ad4bf4a51d1

SHA256
a9a502f7b5b085d8dc5e0be190cec307759c4c466a9acaafb653d29850d10476

SHA512
aaf1521c10f12ef07e534deb5db62707cad2212e52072e77a27dbfef78e652753b77f1bbc85bb0fefa8eb38e408bd2aab43b9d865b75e6969eba87700925222c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb54a3bb6908b9757881f1be663b40b8

SHA1
329b478ddd6b8058d07ab18abc8f7521d45d9086

SHA256
26a59f4dde7d6d52dabb9935259b5ef103c96311db57a4e6d32a7eccd02c27a1

SHA512
18ed08e9e9e1fbbadfdf77096801d05f716d240305e5cf4e451df241046ad2eb000dbb96c5b73777feb10c79693bc1cc38eead4a5c750279ac94acfcb95d3682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd41bedd7df9756da2ebb0367fe176e0

SHA1
3d127bafa0eb4a6ef9e278b31be454156650416b

SHA256
39d8e288f7ec3d8979dfce2d1f0adba8d4706b0062da91a6ead1b86d6071f2d5

SHA512
24f32c43b0d45184c2a3b7875657c8d6578c535fb514dd1aba919a63d6920bd462cdd33d2ce9f5e29e610a1bccfb6c77396dcef06296ccb1a0dd16c908a5c9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecf2e5f6b797390a5d3697bb6608c3d0

SHA1
52a6f19154db2dfa20a30638c91c8d11d5d4b12a

SHA256
96f6eb5c7a8ccc3e978bec88920fee59c439187175979c42cba16c08f4921ea3

SHA512
b4be60f4d9a6b7bf9061be4d335710e4fa055d8c1f474d1c7a484b6c6e428cfc678f929ef9a691072088d107fc92629a5f1d33e3276c5cc9f65793dcebc257a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8346.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83F5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit