7a03ab52c1703ad94a418b5b9721c953a5fbfdfed62d9af858fdf4f2072cfa39

Analysis

max time kernel
171s
max time network
179s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d8c48a069bf0a17c454ba19e1b830d0.html
Size

3.5MB
MD5

3d8c48a069bf0a17c454ba19e1b830d0
SHA1

475bff97697448960db7fc4e5a4145d0b978c983
SHA256

7a03ab52c1703ad94a418b5b9721c953a5fbfdfed62d9af858fdf4f2072cfa39
SHA512

866012fa17ffeb2e3037bd51632390014f3de80d1ec5b964247873c4f5a12775521f6dac337c7cf3f5bf39e0f81fd6cebbd202b1491475988141866b465d152a
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nyw:jvpjte4tT6sw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80175b9cdf3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF9C4A31-A8D2-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410295215"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000aab1fd8b565ca3baf603af9f10cebad5220c50c196368ad8462c65009598ced5000000000e8000000002000020000000c18bbb7ef830d8fe16a111bc5393bd3cdca1cecdca8555188ce373ceb380cffa20000000efedc948d19c5e53b5496f9ae8b0942e0e70e074efc193723f4f235f2a03e2c74000000063c84c63b842530ef78a737df27817c9544bc2fccea926c65f3521507fe5b645386ee9591c04503e5cb46de6089aee77704a34218a9f4151f73c1d6745f4289e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000bc0f39be425525ed83a00a76467767b93919af95622f570637ccc1464428406b000000000e800000000200002000000042067c8774372fd16c1c4466aa2e023b5480b06e8971782d68ce9e241f627d3d90000000e62b5fc63fe90d0447f470956845916407a63178cb1c0e16735ed3b2f7583f7987071f6fb3a1bcece72285880facd31ce8ebf282e823e8b41358d3eeb7a159222484f85ca6da9f81f45d8193d6450b941837093b78cee7b0f0626bf7bbd13c402991e6ba50372634020238fb43d8ba638b12f070f1ecd041bcf26c24dc299e69db337d5ddba3f8867a99c669f7c66434400000003d727f7f199184eeba0dde3b4d29ca4cccbb64d2b438a4ded322a74482145857a94162e4daab7cc0355d89acb32eeca470af6ac6de23c9888f8fc301b6a42f9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2556	2104	iexplore.exe	30
PID 2104 wrote to memory of 2556	2104	iexplore.exe	30
PID 2104 wrote to memory of 2556	2104	iexplore.exe	30
PID 2104 wrote to memory of 2556	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d8c48a069bf0a17c454ba19e1b830d0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775369f310c387be5782bac3e9560129

SHA1
4b2a62ca18e02687b9ce12f8ab960e11b05872a4

SHA256
91f7baec254ea2a977fcb32a56b5c0e48ce9391af2e30cfcfdc29939b045099b

SHA512
d8ad47ebe6e0ed0e4e92a2eaaeb1560493d0f84a3e4ebb7164e1578fd987e1146e69356c34202e8e09f7b29d135fbbe007c80a5bdd15d387af7c900653c910cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a547f3c3e3a74a6024412aa404d2b73

SHA1
0a32babfc144174489f908e1a112b6184e232449

SHA256
134ce10b7b09fe2616c57226d6b6092961301d51e51fd68eedbabcbf490cedb6

SHA512
4ddfecd245e79829fee3309a1993b97f8640f359a3dc407e09e184c58d79715e96178595898a8965f2dea56746db542ff970b28c26a2482e186fe8e0c9373425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38f4ce0b7f412560c768c159d8a3ab85

SHA1
87640a64276fae90c68ac7119e022c1d898ca264

SHA256
f54a919113dc3b6dbeb3f95a52f029b46570cdf15f1f7ed6042921b703f94646

SHA512
4d4535015fdf167be49a69284798b6a5415b20a37d8d252961b3eb7d5e4524b6d5a2d6a5aade5d0c333c962d27bfeb37e0a68ad613bc398d4f5423f414f9c590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7a1323dfe92a3a6c62bf913a014fc85

SHA1
271cfd72f63679a6810a47e3434c91e27a1402b6

SHA256
00b1f203d401f8efb8e303b1aae06dee6e12a74c5025c2f1b491daa2a8c9361b

SHA512
fcc7e28c910d4d99893009b6f9179eab1cd6aeb44c5c7484fd11b311a99fecf2f3172c8102fcca84742d152884c5c131e605b9d59636b3beb08c5ed06b7cf0a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f5c7877845659a972531f640dde195c

SHA1
827f6c196fa856a0218f1147aa74cf20b6d918e5

SHA256
0d9e2cf978f3cc1928ac392791e1b143e455c1230c5172a25efb87e15834fe06

SHA512
7dbf3fe7eace68053f2a95efd7bb542345c9ef3fe743c42dc05f67eca87424d152138ff32473dfdcc17c0a18a67a0d0b4d3c9161ff62e1bc37c01cf4f5d8f7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb43e533918093bf2fd169c956e3c92

SHA1
7ed925b21b531defaa8e4d19b1cb233831e46a87

SHA256
79e694439ba084d8c1166666e9e59089b548e3aa4658ba02ae8e34f1d62f4a90

SHA512
906528b607c2ad05b4eb39185564bcb8dbc9574b11b0bea4f76fb328c69cae453ed4a07445fa291099d4fd1e5d5d0b652af38e8fabc5d620c2f884913ed26079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46a0affcab4b825133756efde8a390d9

SHA1
27d28eec5df1cb1d7f0518a3b21a7747ac83370e

SHA256
79577b41005d705cb23185bcce0c4b83c7bf1ae6e4ba0a301b250511eb23651d

SHA512
b70bf8e949040e6135771cdb155c527b4c90db758a9cd5ebf019bea1f0e4cf9ab16109d0e37612cb957e1ef54f510eae9cab447557d29d052f2aa185de3a00be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
572db094dc797b6ef8f8755822640297

SHA1
d20ca94f4157d258513e3c13621d3bf9ad376c6d

SHA256
fcc91d7bf0787e2c8e6045c90cb5a633dac527b19d45a22dea770a9cad3cf43d

SHA512
edbb926359c43fec6c61bc7b080f3957aeb2a13698d4f2389dec070fd16389d25a175bc29ef3a74ec5de233b20659fffb8c6c1a41b6882b76e484e372e926a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3709655f8dde76aaf7b25b4ec4236ab0

SHA1
caf99d2fabcd691ee90dc1d1eda8dddd09af1185

SHA256
7b39b1b9eaacef5acf82c37d04f89b8aabe83a2e507a4bad72e768da50481a56

SHA512
397a1c4698da669772a4d8b6c66f897a7a8c438792362b6b80a3c3496fa172ddc02ac5344aca629dbce9ffd448c71af8b223d42a3d955cae8afc89cdfdb0f117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc0c94a8b9a580441f9f43efa633c2d8

SHA1
e597326b68c6a5f9dbdbaa512ff93f361cfae601

SHA256
8710e7e5588481d2289b6072d7ae01cac91f24a765b49660c17ceb3d940d5d68

SHA512
fa00944517cf36fe77c408004cef89d76505e3a137c40718d935df3e83cf37731bd45754b9f77c9fec79148088b1c1d2e72d47b44de46556cc7938dbff5fb656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c52a3ecb93b35596ee81113107a1b7f1

SHA1
206f25302673a5f6a46ef2d3b40fb490e1418f2c

SHA256
690b53c5982df629f96494bfe75f192da9435ffb6c9afa1efae6296748eb1a23

SHA512
2237c3f9bb9964d7e5cadd7375059e53c04b287217e901b235bb32a13ff62aa412def8ae107dd872e8f7c359e4023d32a38f19e6ce7cdcc41fd9acf9f0048d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f04a5ea01a3cce21e2ad2a5c709ba10

SHA1
180c072657dbea72a75501adda252383d69ae96a

SHA256
dac0037214d269109dfd590aadea73642abc46f15ab5bcf3be88d7ff272b1841

SHA512
3a310a0fd6fbca801332ab3fb2fb91d761395a17e4cd58c63d8d679350578bf936e3774cffbf72db461a4c1661f0b73c5a54c5557653e7464f13aa7046211056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1cb012676e3febdd7730ae5dcdbffb

SHA1
8d1e90aed208dc394423e4f3488ed77b7173e1b1

SHA256
61607dd806c9e050e2c17f82da0f2f267838df38a50ea09750e45feaa0b8ca71

SHA512
2970adf857d2150c6c8a611d6cb674ba6a5f168a682d54fb127a30a7916ed56bc2bd838703d01ab3ca517f8f7c77f67cad6b697fa1bf70572f4fcc7d9b4181ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d66fed0a2b1e7d7e62db63ad91ad4536

SHA1
8dbecab4e5a700475b3386f85460c2ead9c40e34

SHA256
bcce0ddee9bde2c5109aae5751c76d710afb6e1499a51ced182ad6f5799652fa

SHA512
d8188a879b58c2083a86f99b984c5c86c63c9a4d3c508438c3a0a165d75896a688f9b1b490bb5b6a56bbffae9be8ac178f20b7d8d058e10705383285d73054f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF182.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF195.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit