9c56f4ffeea4117e358941feb60790884bfaacb005f1bef566c8d0401f34c902

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3da82b7273714b6cd342d0ad4d2cfc69.html
Size

432B
MD5

3da82b7273714b6cd342d0ad4d2cfc69
SHA1

19b01a498658f4aa952b28320a35553e9f75c094
SHA256

9c56f4ffeea4117e358941feb60790884bfaacb005f1bef566c8d0401f34c902
SHA512

7c5af37015654cc7ed9f1ab45cc068267f6c55e2cdddfa8a29f0de1596559bd6f19f4298976ad30631e08d8420dba66c4d7e508aa93af24824c8ac6c1b604301

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000008846c026387074c84e4f9a018638d0a84971d982819764f3fb8620a5a7e0a24b000000000e80000000020000200000002f9d887be4262e133e5e694bcb1df26fb8e0e1d1e3a0d75b011d549b9b3b6c6b200000006c508170b3c4ebb153e8dcaff1255974655531793a0f3555feb69de8cdc7ce4540000000221557f7cd10ec6166e72b272fb6ff07d5097b53c63a24feddc2c80233449143ad19867a75f8ebd071c904c0d484783e3ed010e9cb0a43fee4be2dc3e3dba5c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ade9b20ed3acc165ddcc85df7212dc5fdfd107c029dd5863c78528035146a6dc000000000e8000000002000020000000bd49e30594bea77a722f2331c0449bd9ad4e3b413f15de37d7779857d72a2d429000000089e1810156982dcb57278d8057cbbde73e11ae4fc63ffb49c76c238f61829d169a1d408ec95f088d3f2be7ccaf5eae3601a0ea3adc79da8397bb6f04a9b6627d59c522ea02dbe4ef63c7f0c23c3bbeaafb9c927e18a82d6b9c348713e68c10dc385d20c9c936f0516b17022ab27a18bd01828eb61665160b5c2552f2023c93486449382b89cc2518d29d574cdff8e57b400000003ee2276f9d54cc69eabaf197edc103ea58379ea10dd8c92a7d2b0c96bd7a880eea63d9b44d602cede7a59ec914f26f885ed18a11f823cf021031990a56ce445f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dab823e73cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C7897C1-A8DA-11EE-BFFC-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410298502"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2688	2128	iexplore.exe	28
PID 2128 wrote to memory of 2688	2128	iexplore.exe	28
PID 2128 wrote to memory of 2688	2128	iexplore.exe	28
PID 2128 wrote to memory of 2688	2128	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3da82b7273714b6cd342d0ad4d2cfc69.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf0ce02f6c8f7d0e7a7f5de0c9a5e09a

SHA1
db2238039fa0f6250baf7564bc05f4ec9d56e240

SHA256
0b1c9dcbff8246f848496dc80209568835254fcca65a9799d5f496956c5c6f37

SHA512
587705d562cc98acccac27ae67096b962059a502fce7ba6aefd1b23efe8267b6f57691804fc6d5aa58374b22fc3408d39500f0fae934d2d8febc8a4ea9ffa3b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
400e298042c74e6512fc4b1f2f8ba4d4

SHA1
344c7a653fbe2c6267764687a92d78c39da13a51

SHA256
340d3fadf0c66a90c2cc297f272a31fe75c27e8b56cac760d6a5c2d57a29e82a

SHA512
be5a84aa0d74991b1743f395738eb0fe12a0ee51c1e92c3990ea7c5e3d6e9be2f233078791db641595d33c63a7f74b9c5fcedef900fa67ca19b5c285bcdd5715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c30e79a6fb63f5da11fb4ea217581b7b

SHA1
5da09cfade5e26de56801e699d7cfa80137d25d5

SHA256
97fd0ddef6cf8fa322c9b94cf28b8bba530bd5c3168da8b71770b55149c264ca

SHA512
3779bf9cc4b6eace0c88c5d11adb0654bcdb0c287aca440e8e5e48cc5e7ab769e0e2ca2f215c71e874f0649a1f7b1edd18af9b051bde3e08e06c3c974099f55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6d94bf707bf7f09cb97e69fe418b662

SHA1
0597586908d0b1824c9ff6c7694bf48d8beccade

SHA256
27e64f3580e7c360b98ba55acc843bcfd23b0523ca90f5132854b66b71e07973

SHA512
e94d9bafab5082171e38700883076634c65b7ae8c18cf3a720f56c4b248fda1e316aaae00186204ae7b3bab7259dd704809e5592bf2c9ba5783505355652024b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe43fbba5c85f583237ba7f460c1cc3b

SHA1
f18f7804ec45af79ff4a76010efabe9d3b6c9ad0

SHA256
e7e974b1eca74960a66c7fb5ae0042be55dc75adf47417553fdd71aa26705037

SHA512
0317e219b42a3f3900df2098c384a9c47b4895c4692259fc61612580147e66fcd1f245c3509bc521a48ad7dba7b8ed2feedc3260a91130f35a9abc638a73d34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6baeca2b0f033dd15b80a0583db19fff

SHA1
7bd4ac7c79575342f3837a293c3a5b94063b5f7e

SHA256
78b53c29dbc21a48d8d8d3716fe41444fa29adcef5f9f873fafe461e16143202

SHA512
e703f550b1112230ef0d4ce8b5c4e6acc90a2a19da84571d2d9cbb8ff43a0f399a998d6b5fe2ee6f085e59299e555b4ce7f0190de728d2bbec191b334225ba24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b74499e943435d54db26cc2122bc090

SHA1
ec5fc31363b5cebd81bda0d8d2e3d2c1f7ecffa3

SHA256
829c5d6f9399ba867b5f3f26604e140214e8c17fc7ba003c3590286adda3cb6a

SHA512
069369ca4316effd7d3e11863d9cbd819f051b4665233725b641ee3c9f1d003a381fb5b39494360934970a940782df129c8c385cbb57d0da6d2552e596ce5431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87992f680ab7fa3091db6e7039616566

SHA1
9e808cb6d67439d12bc281d66114cafd4c149e44

SHA256
be2c07c6cc8b9bf1990132b9d21cc8ddc18ba7c63ecbc332af87fe993ed1f564

SHA512
952baa1e42864d55bd614f9bcbde8939f4bf4b640b73e423095ce0a57dce57d5e5fa995a2b93e240fe23cbd1d473e456b4ca7a1d7db24f5139d5668b62d635b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4380fc3dc9d8132163ca3197d6b3ec

SHA1
9bf9a35b0af338ce537ef107ac4372a4a4432947

SHA256
b27e0d041870953f8d9cfcac862c12e176a9d7655363375b4ac271e168b08319

SHA512
fb1c50b366e827e5cc2754987f504dbc9950feda8543d4194ffd955bef6c3256380649794a5bad909546056471eaa97288356a3ddbb75f5713d291238265d139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f310ea950d9c538c7783fca5ea928f

SHA1
b0ecdba07808b01ac4edf5273ea31ccda08eca2f

SHA256
98aae57c784c43765cc02936f4bb82c3bd2fc791e4a86dbd2a8391ce95fc52f2

SHA512
daade7d4e3cabec44b82585f8bad8b3e8e0b39be1cdbdadeceea0d4c40685d1df365e70a8c846fe4a50531df604c9bae575c81af93bbde291e289a06e2cc267c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d9e8ffda4cee799e1e199fc30a5682

SHA1
49f476a9060deb7d6b3a5af20d3ed37c28dfdafa

SHA256
3c9da224e1921ca3cab213f94825b94d91371c41dd53a062c438a114b9000f1f

SHA512
b6a78e2c74aeb6237f7ee1c3846308768d8aa8437a239c0bbea49c0d3d2cb953a4c9dda02abc0edd3ab3a7f7de9edebef1039bbd1bde5eadfd3a3114046fef68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a9f29106f2f91308554a5a6e17bfce3

SHA1
1d1e1c9fe48658baa8a363f53501cbce84125f58

SHA256
07b2c984f56b7ffbf4114f9eab61ea737be2c7bce1c7ad799d5a8db53d98624e

SHA512
7722eb510a6682ca64d0bc2b160469980a74820ac61e6a6bef952855eab43ebba65c6c999210526d1490e8829627e68384e5fb3f2887b45d3ced4e34de448fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7aa6e8c76b66a89e8cba70db0b6f73

SHA1
66e101bc4fa1971ca64ce0d9b1f6ce8fd9e61335

SHA256
6cfa76adc7ca119cd3445b36c8e6e9c0c07aad3ebb4babaa72dc1c98b4ec3490

SHA512
d799ec623c119cd51f49cdd66c76f186db3e462ebf55adc169b68de263fe842a7d0c2d8c6a730a8250f6fc88504d1d2f00aa2b848667d812dc1f4857c6bf5f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb4935bb48decbd6e4bca23741b3752

SHA1
b46987f7db7f078e5ebb5036249c5b9116dff94d

SHA256
0f452651d7426d045d2a55aab1b6c88a471dbd379e25ba71a9ddeb4b4e4ea67d

SHA512
9425f86236b6d11b60c07c6f64add4e0bda77771ec128610e94b0fb2e000ca362b460e9e904e0397bfe3fb0005152f051b8c088fd4692f3c0a7035d8bed75246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2tj7qpw\imagestore.dat

Filesize
1KB

MD5
9b87ed4ad3ee694c7aaae1d9df8616d5

SHA1
59cf25bb32386b2c68b11c537b45a34f5d8ac35f

SHA256
839691c04b67fc33938180463c3b912ac8a48e5ab863d2b0ff23b2b023f9de5c

SHA512
9cc185137e08d340b87242285d4618fea436e76b2b64909854c59adec70d6c658fcae8ecc91a7a9f984a7702f82a0cf1ba5751ae10bc3d986a5b8e1b4a62585b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A7D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit