6a915b39230a417405751b9c31eb277cf2b0446839d91878cad1f20ba2a02f54

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cfe44722eba3623cf479a7be0864e08.html
Size

7KB
MD5

3cfe44722eba3623cf479a7be0864e08
SHA1

9a7c2cd6851c9ba1eb00bbb3366f0ee633a7b4f1
SHA256

6a915b39230a417405751b9c31eb277cf2b0446839d91878cad1f20ba2a02f54
SHA512

eea71486b5a85e7edcf16ab530058f357e4f484e438d17335c726d2872c6344e27acee7c684eacb0229e2534cbc0e2c4af880d5acaf0a913907dbd3b7518b9c9
SSDEEP

96:PZ0BJ5swpl7xl55U4oflcdefQvmhDnv8C0U7yvFK1wNjDMPkdfLwp9C/s3VYvNaV:PeJewfh/DU2UK0NGLwL3VYoeR/TU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000085adce9d45cb0e089fcf324a2503f9270ac73bbefd97fb4be3d1e5cbc31d6b7000000000e8000000002000020000000934ca44566e9b58f7554bf6e51feaca8667d4b1958475598c8f0d92be1ba5e772000000040371022b2b8ed6eeaa83f6a44ee13fd3cba256bfde90dd47cb1b5e806c744e94000000000d268ddf05471545634ec6a28315ef94b6bca5ccaa3936c326f4dac231bf46c889f4a122117c0a32042c7fe732642daabe791b872be9b6b9342b545204fe61b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002e29b1365408dcea99eeb547bb13a3f6588f14ce7d619fff5beaa7a275e9b658000000000e800000000200002000000068e23cfe3e17bb02e13948277cf2fb1f2cc02a56162ba8e78f0d59039e43d14c9000000089778ca13beb7cf3afd1968adcda8c20abe8c90f7f2a298b58710ab40a3d8d8c54f0f54284882d161cd0c203c76228a5ea8cb6407e6a50806210f09abffe7cb60e9ac9781c387609d7def0799c9b1c92d82fb641957b6b14fbaa857152e80a3945b062aae52a961b308af7da49ce3be8d7e8b8353f18bdd43d5922b58f3a8b3bfddbed82202b56ea87c22fd6a35c4b944000000046a6da4d1557647fded5b6de0f3430bf0f13770c56994dc235d0de5746883ac40bedddf6e9beb58e7c3779af1554c3e055a1bd65f523bdcd8a981de5f26fb649	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411103048"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{990CFE81-B02B-11EE-832E-DECE4B73D784} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1009a4763844da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1448	iexplore.exe
1448	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1648	1448	iexplore.exe	17
PID 1448 wrote to memory of 1648	1448	iexplore.exe	17
PID 1448 wrote to memory of 1648	1448	iexplore.exe	17
PID 1448 wrote to memory of 1648	1448	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cfe44722eba3623cf479a7be0864e08.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
704a24d5c5c18a77acfaaa18437a80e1

SHA1
fdd69e89e3e1e901a825d72d6fd71160d9e03007

SHA256
53e503c0a38bcfd280e1d985210ea27c071f5b762136a1e66830de012c911219

SHA512
761bddd0565eaacd98de07d89f827264706db2d7a237ba948fcf6241e1bf053ee8bd155cb0320033f59fbd9ea3449a319b2ed8201491cdf4eaed4edbff4fd207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82101ce097da62cdc459f30afbd86b1b

SHA1
2cbf0aa348650c9f4929c58d3923301a03f22859

SHA256
fec5f2a8af23e1040f6f97b4f71db305a34adf409f7014ac73d43d0252b012df

SHA512
e0b297961937a61af4edccda57778b5a89e2629fd99202b42b5a49143b08deab8d847f02fd12d8c16438518380c045147eadfeea02e904af4fa2054c61c876eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e25ddc00b078d73f03d35796a78cba7

SHA1
3b0b793c86c57f17e17143e4769e383264e93112

SHA256
bc693bad73e3bf29b02a95fb341962ff2e1a4581141e98706fe21bf43348c58b

SHA512
d71a7c819acb15d361ebc9128682399f4ee6a7048ed99e5398a9ccdae35f2975c03ebddddf54e72c8f795da9e8a842e185653b8c4fa034b8081891bae9f4cfb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93657d61a60482ea3b53f10474776bb9

SHA1
ef0cc110e968f07f8c69cc6e489c6d61cd4e2764

SHA256
ba01fedca9c32c68a92c182bd34a617634736c47ddfe46283ddf0394d7c9bcaf

SHA512
5927a9afc4dcdfae7d1d01762e3f453fc3d50642b60a159dc01baf1702400fead8fec84f72ff12f9f5bd4515e0cfe958a4b85a42a39a4a29ce8ac22e54443b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85e44c8c80858f93e5cbff1e76317f5a

SHA1
d9a6a02e97b8eaace4d252b91f0d9a30cf2c1f70

SHA256
2aad43580c813545023b588ccb7d35df29685a1587504b3ae3b6e0ce4f960770

SHA512
445627c314dec9ad6319451406dad02affe23a9ece8d7532ff2a3070cf1059707e4120d36c8ae20e67117618196ff8239f929123785ca5f25edde1fac10843c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82392523512d69c76b33b3e6ab6e8def

SHA1
1423cc29b73541055a8c336827dbef7b1a872019

SHA256
98b24de980eb1a14f14f5b55b994ee9f602124ed6afe51ba1b4c0bea70c94451

SHA512
6c4803dcbe99463e847b8537e0a91df06b666413f8afa52dd505dc0e0f859832e2ed2a8c4375ef49b1836d55bcfdf55e1ce1908077311ed59feb79fcc2288e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495a450692e341d61715baeda5b439ff

SHA1
73a1dff0b839f214cce1e4785416cb0f2e857299

SHA256
b1b535ad63aba47ef422c3aa12aae125581a9d915654981391e3f4815b213d69

SHA512
60bea4bc38a7b14d6f483bb134052036ecd854ab1fe6fc1ae276ea4301571057d0f0501f52d0ebce2039ab52401ab144a84af81821639a98bb09590602cf0b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a87b51ad79b312ecaa6f416edc756cd8

SHA1
1e3ba30ffee9c4f85b747eea4b1027daf3b9b14e

SHA256
c9963be77d4f36b441aa10af977cd9b87b64da2a00cd3862dd407e0a68b0ddf9

SHA512
62c6794ee73d1bf0ae3de6b94a12fa071ea876b8440e9bac5958d2acd54b00b1e62382561783dd0be5306f4f6c2846d9d7fbe842ab41b0f75cda7a44e36090b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c82876eb6ee1a7eac0aee35e09c9871

SHA1
295fa53d17c4bca1c0c881db436fad27b6dcb92c

SHA256
6b7982d91329821a84340455fef82a031103d8993339928492ba3626e85e7073

SHA512
0a31357a51090e077ec9bcc7539ea2809ab663bf58e3e56c8c29fcb40b3bb357c0de51aed3dcb79ad76812e35916469a8c519b6606d31d219086dfffc10834a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AB4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit