aedc9f13e23aa9059f56e41b9358755763e992905e8dc28af9bcdef9cd156a58

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3d1a1632e08d1e96bb7e546350201f0e.html
Size

610B
MD5

3d1a1632e08d1e96bb7e546350201f0e
SHA1

e2b5a1d24b7e47397c3551f9b93b7373fee7ca19
SHA256

aedc9f13e23aa9059f56e41b9358755763e992905e8dc28af9bcdef9cd156a58
SHA512

193026748e10244e9314a1bfcfd112b910d2ff5ec6941b32692c04f24551b14d69c4dd6fb83460791f63b8f08a40a256ec9abcfd5b404a9913ca8b3de158d5df

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004ca261592a384ebe65dee36342022fab3b83c0275ceb5870367e3f68b34d1b80000000000e8000000002000020000000b9ea10b8212ba61a638ad66d7dd02772c6c7a3699359aa82568eaf2ec944606090000000271859bc4890f4f0f9ae09618f2e5552cd2bf5eca40d62245a390a24dd4f4ad7c231f95f3ca9afec7404693ca0e3614e0d3a96d5386310d6eeb4c5875c78e19bd40d9da3fba025f1dc6a093b48fdfd3bb303f572522a28abfd292c0feb694ef38cdec60264b7743a93bfa5934eb0e044b268cad98a32a1e04e931a3b08f066878e2fec2aef3cd8960460ed45ff57a24740000000fb11e691941247175950d8c086dec05f61b121a35888c2c7ac308d6683b2a14087e8798e1e260b69975508bf9b1cbad4a2134c3aabdfc38b9bc9bac82318da2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9981711-A8B2-11EE-9B28-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000086dca368a01700d95a16c4ade6a396d6e2e4be8215989b0292ddc22c9a280eb3000000000e8000000002000020000000fcf940cc6bcd26f4d4bf374cec3557a65a66611e59fb9246dfaeb1468fb675472000000066c8f597107c10a85031f57288a2fd2e4f9d5e92bf992d0588989a53f88cb75b40000000a5b7de6b8ea6757697018796097f54bebb5d954dc975dd83ce4793723416b6231b9c78ab11c4ff2fa69f8d252de3307dc840406638fc26714f7dadafe33f6a75	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410281456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a070ad96bf3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2660	1936	iexplore.exe	28
PID 1936 wrote to memory of 2660	1936	iexplore.exe	28
PID 1936 wrote to memory of 2660	1936	iexplore.exe	28
PID 1936 wrote to memory of 2660	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d1a1632e08d1e96bb7e546350201f0e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
656cad011f03ecc8cb36f3519d6e1a9a

SHA1
f4da537c747459c146935514dbcd632ab9a5b22e

SHA256
b1661785f4dc74a5f0bd1417876378966327105ef8138d7beef86675e920c919

SHA512
288c7a19b9927452ed776775936e7d25002e85a9782a155ee3b471acebac870dd7ac359d56ab9f5d3b2ec7b7e1e42952d9cfcb7325a3920b4d907880b18f7fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fa6a4446e32d0ee638344ce31e511c0

SHA1
6407925791697230ae177676421cb3ef9625583c

SHA256
bd14d9b93441104bf69c846d0d9fcf0e6995e4b47b7ccaa9ce452fe126bb1bd8

SHA512
69ee94e237c85023ce5db1b517f57aa238bf1b1bde0a5614918292c1d487a400d18734880995e1f558f7dfc857a47d42c5bbb2434540849a268b71511b4ed2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33df5c054ae5d70dae5b08491f1079db

SHA1
e97457422b2e5ae9fee3d08fe2eeb074065f3c74

SHA256
57ad33dfc003dbdb550388eb415152235968c1cdbb75ee5b5bbeed090bfe142e

SHA512
a9590acf5d23498c3b20c1a2b25d458feb3aa1ba5e40b3d4d1e9fa8105d69c89d8ba770195e5e717cf5be45f86a4e1e5e44c5a58f4b958f9399a117f1e7d7aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0a18391356e8a8c07ac145a907aad2e

SHA1
3e6b1d68937cd1188cbb9eb0ad1462a79557e970

SHA256
f57914def7875c8b478d36129547cafb12ab987a782419bdd187c1c3e4d95fda

SHA512
f7d0a9351cddfff1e2fbd80510b8eb6dd581b00db12747371bda4ec815e2833617cb2d16a7360b9705984afd732411e568f15225bda66bd87d9098220df74543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
907a01cbe4f1099eb4ceb13fd6248338

SHA1
374ea44b85b6df3013f9de8879c626e8e450f24d

SHA256
7fd2cee9872cb7ad2d0c519de8eec68d32585c9496b91119978a4b266934dcbb

SHA512
2b38958827a5f4d9c63da39f9e66690af6cb8451f7ec98f63351f524b8a66d5e4a0941db1b65dc52700a5b1211644d6050b15d434412abeaf2a1fb8a370060d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a2a6d40dd863f696fb0c0ba4d5e5dc

SHA1
2a9cf5cfdf9db3ce657dfd6c9404ed59b828cbb9

SHA256
30227e34fdae83291ad380ac3e5719d5c5e2d52693a9e65425e5f7cd54b0dea9

SHA512
ab36c122b6640af0c06f91569619d1c51d0988859c2b0ec5f18564eb246c20284313316eb4ce0b9d989452aa416262fb15ec699f7a663ebbb94115b21bdf782d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d0a125721350b0d460facea0fc98860

SHA1
91954dd5948553576bdc546f8d6891cd835567c6

SHA256
3dd58942efb7382a2939b6e42c0f98fdbffdeff19c765455e16abafb44b0396d

SHA512
dc1f847252d051590b674c4aa00ad072a1a19bbbd98861773bc0b283429d24a7095a66a811d065ee21494ce67ba22d752b03257d1a5997ae1fc4975030535e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
016e27ba3f2573d6f2e3ce6a733048e6

SHA1
6cbe6d3af76d8e1df750ad9f74b0c84615b447c5

SHA256
ff27d89a249230c1e7db1fbc4d17aa63905faf3f70dbc4769e0c200e9c00c535

SHA512
01c6b98c3cb92cb84ecb128ded3a433c874e92b3092507f65bbbf9411cb770f552ff0c7ede2b01ab5404a76c0351673b2a273a4a1b20683153655bb9d39ec815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8ae8b3678eb37a4c9812ee9e35e49d3

SHA1
77adcb21ff527abee61ee708dd9c43702ff3954e

SHA256
817576465e6a32306d8b6f8a702b9a783b8c9a1e391c734812c61db83d2472dc

SHA512
285dd2d163a46e1c0d42522956744c342a58f8e1f6222c7e84ccf17d91f2d29afeb8751639dba6f34cde1af7187e79aff229bb357ad80ac4395c04c9d8c63b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c43eb6f05f233f1271d9c6a42dd553a4

SHA1
2d8c3322104755d8d94c6baa7f868331631cdf34

SHA256
036091bf85738a10652fd9ff4fb46a32f8c17812e12bf013857e920fb55dfd60

SHA512
68baf54d06b4002759dab2669e2b6f4f3c5e9f05fa384a33d9bccddab9146ef5c0bc56c0da230abdf6ace64234d88374bbda2f7ce4ad287ad5d522b8feaa8648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ca9b0b060c660bbb2e4e54e07a69f28

SHA1
9f83fb767e46cedeca80e6587bbd8c1e61f8f10c

SHA256
7e7e3b5f03c4ce0c57496e0074261178dcffe4ded605ebb1e32b833a9c0aed31

SHA512
ab6447421f599ef8f2126d63db0e168aa1592d74423fdee5cd7708e8aff70596d4c6df3966073ff14a6e27815b505a55c97fd6b6eb92480fd816a7ee3bbceb76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21ff5fd94d7b2689d94f7cd91223f686

SHA1
35feefcaab9d27c0b7ccb382e257f0ba42465c48

SHA256
6f66426c6bb8bcc07faad6c261919b6ce0cb2698e9ba95364d55379347d0fe54

SHA512
9de861d9f00fdd9628d025623769fcca1106b619060a967cebd7f600e7379eec2e8e89f8372e4ad322a5655a1923b7689f1018edd1234246167065ebfc3a8145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
406fbcfc71bcef23fc769417ce707513

SHA1
ca3d783ba1187d7ddc3ee0b1c97a90c128121584

SHA256
f39aba833a13b375554aa7d2229b7c986e56b0bca27eb5d03a0f163115674897

SHA512
d8dfa38a6b049f1a74c4f9839a384f7039d5b9353ae1b70d8b25eeaec13a1956e1815bc048934908f4bccf8b5ccb96e69f1cb4856dce0996ffa1caa79554ef4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d4ced3ffab3a69c5a6f5e68182a2e21

SHA1
4ab213adfebf30d06dff4036473cbfa1b59bf334

SHA256
d7c18c36c9af260ad3ea5ba0f0739821546331c0b5829612cd71e7d4a17f8a80

SHA512
56bbb8e5677d674d5de40db0e0e5fc42eacc8f7040e64c62587780a79edb8fed0d6318faca9cb6e7161d3b5414c06264ee0fbe95c5cab3196f66061c08713146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9069dd4135f010e83dea417924386bfa

SHA1
f4cad0faa3e3b2fe72d4a41f5cea1999291dccf7

SHA256
640ab76e79bb8257407e3fa7c78379b4b72bd158ff24a635f688800de357d301

SHA512
f1d6d15dcc9a68487b638b535c81180c78332931890f10273408ccb61e27abb4faaac806396eed3f4e9b1f3c669f6a9c7e89779962ef45303a2cd197faaf7bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b6836204dafbe70963b71608daede1

SHA1
ee951e29088958846a54d2fd43d4e4049b3d7450

SHA256
ef15258b03045b7d99ea602b9abcc07e428ac4ba5db69f121d256d3fd9ca13ef

SHA512
8780e5f1c56b3a21fb9d5dc4d851585270fa25c336e18d2a8e7870bff22ecc3a986e40d47f196ae4c6ab6445fe25bcac47573a70ce36acc7fc36f44b35d0dd8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3584.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4205.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit