5ccf84aeb22b021d8ef393db9f340b79ca391faf70311af747c6a29aa37a3e7a

Analysis

max time kernel
180s
max time network
208s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3db407e71df6e7612252349b59a3137d.html
Size

7KB
MD5

3db407e71df6e7612252349b59a3137d
SHA1

280676d4f927e54835664f2565f44d4be9fd0e2d
SHA256

5ccf84aeb22b021d8ef393db9f340b79ca391faf70311af747c6a29aa37a3e7a
SHA512

10b578875694f99f1647d782bd1ee6191bd36e9106c698543be8bf8451877ebfc155eac1ee0c905ebfbc2d3e36dd069025aea3e88835fbbb365f19133169e7e6
SSDEEP

192:50bUynUZH3YtI3C7oHHrRKZmvY3JCrGbQNwTaK58L:5RZH34vZmvY3MSsNaL2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410299905"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000fd49d5c9cb202b7dd2a4fb56a9f4711051230353e70c5d928c8e7e8e9fcba5bf000000000e800000000200002000000061d4a76ac03a871c2be906922e187695180ab749fd90dda2671c60610825e7a59000000006cca6e4286ee10c99759cb426800aa87c451eaa9ae2f3afb993d4889fc370a52e71408b8b61c8169d45a4cafe4acf49b25e4c25a3fce4957f8901dd0e423cc8e07c6ea9483cf0d9c2a538a20a4488c0519db532d6d8b8df55a3132900b00fbc29498c50c20e1bbec9946f364227274e27cb3451309e014569c4ad0f3baab3a8ace6b593b82ed117dc1203580776bc2c400000003d77eb9dfe5ac5aa37be063b1e84808df13977e368487791f57db45b771ffb6c7b16363f53affc0c415f6d00fc6f9bb0681343970819300c8d73b582e02ad823	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c032667bea3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CEEE9F1-A8DD-11EE-80FA-EAAD54D9E991} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000008d90c4698044cf628192073efdb8c2837daf474e239faed1539d15628a8360ef000000000e80000000020000200000007489190412237c22bd2dbbe32372c5136fde8a9c9ee046ca212a862b5b98605b20000000fe8fc13f43f654662af71943fa02dd0d2f8406b1191006287a854b8342d6d8ae400000001b0cdcec9f4596ec4fcd22091dd9603334b7ab94e74d64106acf329d76a2f60c005282b47053f3b633f3dde4f3a61a7e5c4963ee88675bda8e9fdac67bc9bbb2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2560	1984	iexplore.exe	30
PID 1984 wrote to memory of 2560	1984	iexplore.exe	30
PID 1984 wrote to memory of 2560	1984	iexplore.exe	30
PID 1984 wrote to memory of 2560	1984	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3db407e71df6e7612252349b59a3137d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f74eb8ad6285b08cf1ab79155686646

SHA1
9547585e55a5323168f71b6e8d92057baa965ab7

SHA256
57639e2f871412b691bc2debd41824d90fb15536cfbf29dcb76ad58b28797d6c

SHA512
a0743dcc47633501bf2f80c366526e3b2092940290259f0fcbc9ab283134b6cc815f45af39f172ed1eb257a5ccc0be31742d5df6bbb401fccb6e2a89f3dabc60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
664587868fdc5e60456b20618b3c98f3

SHA1
02358dd6c6c0b1949b0b470d792a2434c3dcf35e

SHA256
36eed3cfecdf41eb02f4ce6ca6ab54d4cab1ec11253e707a861c762c605c32c8

SHA512
c81fc2741b5d0c0b2b00d269c4425c93663c2c1ecc2f1db7ccd759a4ff8aef89362ec624730d41ff1bf213c209f389065ea0c871efbab3016907c65fda840bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06ae30926501532b3fa92058b602f918

SHA1
4e4a5147f5b42d6ac731eded7cccfb32172476c9

SHA256
b64f5501f6aa5beba8b3f1a69d79e94c2d99c699c90067c6dd37aed109e43e85

SHA512
39f01926de701de1bb4f6d3c77b7826f31203a10b70cbf91290587d864df29b032a25f97d90df91a283fbfa449b5cd61289f95b214345127e002c7937a967c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c586ea8fc3f67cf91b936edd79b8124

SHA1
65b1e296beef6bd715bda75155915f4a0f24c007

SHA256
3dc62ccee5d0700c4f90346e982c35412dfa12ca6d015577e8659ff52d484a7e

SHA512
88918a8ffeb3d994977187946b395562604fd3eeae90d0f73ce334a9716c3e002274953804e8c22c10502be51d15c781f1c9acf45e2e7708cbe4fbbdac6454b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c329d72a5420c91cc2cf1051719b8647

SHA1
5d72467d2de86c97a08cea23227334e57e828689

SHA256
287658f731e00adbf4ddf2b340e752b508b1fb5080df024d0c30685a18c4ff48

SHA512
6d769991f958943e5f7110291eb90a38fb2f6e07950a614f962d197c3d1326dc06ae41cb040902e0a7d9ced1ae2e3bdf5d1a0cbfa9703e5546b58bcbea4f350a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab823B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89CD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit