89487cbb801e156d0c642bb9493b6f42b6657a3b0a1c85f3f416793a1b93a7d5

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d7ed8fbfffeaf2dffc6ed7b5980cf50.html
Size

9KB
MD5

3d7ed8fbfffeaf2dffc6ed7b5980cf50
SHA1

bd9bab4a01fc1183a22c31e47961452a40db7986
SHA256

89487cbb801e156d0c642bb9493b6f42b6657a3b0a1c85f3f416793a1b93a7d5
SHA512

18e2810421aacbfda88d11dd1a3eceabb24403f1ffa3648a7dda9c264e3bf1f7f3a11798503ab4be9203e7759b9d55c747cccd0b10b175182fbde111074c4ce6
SSDEEP

192:ln8uqnGDSSW0nq2sHgPFJFPRI6J9tACsGKybOGl04yx2PcvaFdghosnbLfDLUEo0:ln8uqnGDnW0q2sHgPFJFPRI6J9tAaKyK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e41f8edb3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000eb2cc6409a2c95389e61d3cebad2e567711de3e3d311384ca7a5d87ca1e0b8ee000000000e8000000002000020000000016af996f22981d0fbdcd770f6dcefdc92a5074d4084beb282e95c70264cba3c90000000fc1765107bfd4f524716a6fa490eeb5ec1247a4905eef94a27f2d82294ac8c1d1bf1bcdf6f55edd22e023aff66251aded0e49035fb7e9220955378ba5442c2e10b5f5bb5a6922ba95f0550047df6ee7cb2887df11343486177901d2c211079d95d7186cd222abb6669c6c6c5cb5852ba0664552b0f56ec0860af1c01876863b585ad9b66380f3a1a90d8170ecb328a5640000000e52e0e10429134b6b94cc6b726af32a92281e6d379bd338172649ada6aed017719803e61cd01997210b34cf80892dc884633ea48a24edd8b85616ad261468fe2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4C3CBE1-A8CE-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410293496"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000008419a680bc1f836ef7547efaa57ffcf51a888378c6d57242bd741a24c82721c000000000e8000000002000020000000b5924f63f596c4db7d7521769a97052e157b1c5aefaaf334efdf0d3c0a4ca62420000000ecfdda5517c2613da80b099684e09bbc83ebdea1e1d06caf2a1dfc997814ab7b40000000e729d6d2463380f331144aacb3276e3ce384987ab5bd8f4b6ec8144b4335ee22821df544a7726c16e98c0781f08c2d37dd1e10dcc7200b9b4061f3b3496fa44b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2676	iexplore.exe
2676	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2816	2676	iexplore.exe	28
PID 2676 wrote to memory of 2816	2676	iexplore.exe	28
PID 2676 wrote to memory of 2816	2676	iexplore.exe	28
PID 2676 wrote to memory of 2816	2676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d7ed8fbfffeaf2dffc6ed7b5980cf50.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd52a9288ee45fcd3de3aec93524a0c

SHA1
1ddd73035563701be4717979539299a52ad22c05

SHA256
6231803725774258c82b1147855c570dde0c7cc5cacfed530b57574917020fbd

SHA512
828916eb79376206e73bb47f89490f9cbb80f4331fa867da06d848dd18a91e5641bf8b147b7f9bd0a9148684d2b17fd063f06a0ce17e6be7e5450d976f2a2cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
692286b01bfeadb8cc0a111912b4c580

SHA1
4b012725baa87550c018651ffd7668eba07f456f

SHA256
007a33409c9ac482017525a117cdb1e0e17e1e8264c730803e60262218896995

SHA512
fc3be68a93b9d064e72749394d055a824ba5767c85c9f3eda5a9caf985007973d917f086926ef01fa89eaceca2736dc277e253eeab9026ced37b29cbe912e6fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b30b5b14ce0abbce883660104c10114

SHA1
cab8b6881ab6b43e1aab7c7f39968bab962fc3aa

SHA256
d178b05b6f5559fdd36f5d29c397e62cea8f78868144d6c32fcdfc284a9ca22e

SHA512
b668bdba3b8b72705826a1c4c08d6b63b40b61d4544aa09c51007760ae51b5ee777721dadbd945d57bf34f20195c409de911e1c10134b7b96768e7df0b5366c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b953eaa123140f8dc1b1aa4681aa958

SHA1
0478ddda165eff5044f592dd285796ca8620cd51

SHA256
136f338ef1be03e223440ff8bd41ceb809c72c56cee00f342620dbbbe754df21

SHA512
b281e4a65442bf1217bb6ab2fb86f26c5b4987a708b95af4e7bece876eea75ea43534b08176134c5d5520fe12c1a9cecea08e4ca713accd1bce860e1b76c39ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a82117e56eaa6df3a3c26cd3c342c59

SHA1
dfe2ca2a59c52dc01712432d8ae580c4d487ca45

SHA256
cfd9e6863bbbda8e9824e7a9da4c523a4b295f8cfd6b89e6b453913e044cb518

SHA512
a85b8e4147ce721bdc7fddc83b3095f2d454189f1df4a376c89e9b66028eb0b5cc78087212ef180969dc54a17fef0afdf692761bb741cafbe27185efc7bf1945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec5ce92f63342c4822bb129a5a73434a

SHA1
8b443574281b642d74bc3e6c498481b596eb4649

SHA256
a904750a987405b8ec0dcacf841f55299dd3f8978ddcafc5fcd2afb10ac2fbcf

SHA512
bc0c2d4a5c713ca0585c0325b175b9d66eef250f0622cbdf6048487eb1b28b5f31db2456a66fade734969aa98422d34c07aa36382608228b7336f1486d82d8ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce3aa22bdb77634b4c169bb13ece9c6a

SHA1
9c3920b8797572eacc4d896904c3a8bcdeac3e12

SHA256
419b50b5fb15d0c758bad655377718ced8f4352af0387aa30379a47f56a02f43

SHA512
f79928afc854a02ab2bfc744de0f044aaf9c13b922f8432eaf4656b0142f64838d07c98db0049bdaf9582fbf11d7e864ecbd7fd8a17570c84c1f0c11035334bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb2e8ca0f872452029c17b2e1c33400

SHA1
f64d8ca18680c44a9098d0cc2c6fd3dad38ea599

SHA256
abdbedf7049a28bef67f005e44a366d2c8311ce76da3154f97a0962f652af5f8

SHA512
6e847557fb48f308ccde465ff2f0e2ba802112064462dd42b0e12923b0e82c660eafa74e1e232bad32c65b5230ceaecd893869ea59d568dc3be840cfce11e012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bc7ed29111d3bdf54fff008d4fe09e9

SHA1
66d0a8fb2a5865cc03a5f40fa22b5896a97e86a9

SHA256
70f3722be1975d8c9a9b2daab6085eb5783a5a6d2e07d32f2df45ad22e350d03

SHA512
b14b4bd6cd2f7b0fb6a030c947b9e23075d5826f2352f8c381ed5c4b731fde17e51d677109bd008b69923d5f2948c04a6556bea9663f00750783505d3da7cbd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
589cea81dcade31f2097c720d0a9503b

SHA1
c307add405078fcbb157dab0b68e05034253fdbd

SHA256
11505d6151e07209aad2e0ccce4cbd3bd20ba154cdd4a08d5ad75ba330717b60

SHA512
299f85f1193ba34ced98cdc43c39ed381cb27de111e902e1c1e43e4f829dd9444fb8903b969a5bb733a2971f2d4765d85b051963e7a1c34be492702c0ad94c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c918ca3aa0ea8bc2b053c4a52c8a4d8f

SHA1
dcb9775f8325d5db3c7980e9a30197da5fe3eb05

SHA256
e4f1fd8c643d6a0312215878e59527f391ff9a6a8d2384c3e807056dd53e0db0

SHA512
cd1fab2330ce817410c72c7cd96b2d4ec344763b2dec0b83d4203db166f420902c843933947d6e0cf3da451279eec83ca15d800ffd3738510df0d227c2b938bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5efb65d9fb0a2acfa6ca007c7a2a4092

SHA1
a6cae92fb80199aa37ea801d8e40f529214ed800

SHA256
f9b7e1032cbfd39c7521a5727192b148cc76223e52ed93ef1f9ac17a9204ba9a

SHA512
344cf97e66210c41327919ec33185b6aa635bc9f5c6206bbe02c1c734613c907ab8b1cd02297d75f9b7183f9873ef9372b4526b3c2f7eb6580c608352933cfe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6911f4d0b3a37ad57e30dbc6e40d0309

SHA1
45eeb97a9822f28deb91f0532a68ef52bbae03a4

SHA256
fc178151ab8722e7fa907b420596e60e087f8b4059ad468876f36f4d9f5d6241

SHA512
15b7b0f0781d1a53bfb13721677b15bd3bd68a43e6aa9b0c7ddf77aac762e59dba7194d94f1052f05dd63fb402e14c49aedcde09bd57c6b5f994babc46755f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7858663a94076086a5cf01715bbeb7b

SHA1
23bce562d56a70a267e95ab7bcfe604fd93a6a67

SHA256
82f04dfb9d708589049a825f5d3ddddd3cc4e3a58ce745c282ec688f7de0a485

SHA512
06a95f9cce4aa38d38288c323847f529d26faf5cfbe365884eb9fb484eeb52fa20e3254fb120d533374b02d4b97661279096655e2e50666e9f31d4709e7eb42a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4525776c8e29aa0750024a07346c2d20

SHA1
0f6b052439ed9f318ee26a9eb8f6103d044f112c

SHA256
da5070310447db634980316deb88fe683a57e1b39d2756f46a43fc1e402b881a

SHA512
77aeceb5c4ee6f0ce732db0e86f320b8b177efecaa082233cef4da6ad2a16703c9e9d506765ad2cdb52b4f7d0c1d745133b5a58787ee820ed5c62743fde0443e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7995.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A92.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit