0ea7370e2f7f08092c42d38f0a85c7087343abe1bf0d9241f02e1e8576d38ade

Analysis

max time kernel
252s
max time network
287s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e77574e9730cb9a298fa010c04bc283.html
Size

1KB
MD5

3e77574e9730cb9a298fa010c04bc283
SHA1

ccc842d5543cc3e6f3cc8ce8bf30aee421d08a27
SHA256

0ea7370e2f7f08092c42d38f0a85c7087343abe1bf0d9241f02e1e8576d38ade
SHA512

1221c55fc3a0f944ed52b15af63031e59e1cfc610a6f3fb22f93f1977bf8dfbbea80375565768cb51fe3d9a5b7407dadc6deea023469d3022766402505297f97

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78B24281-A98C-11EE-8CED-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ebf14a993dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410375009"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001e8a9f92738f6d6beebfc0dd32ba473a49671416295e934e01b456e11cfbda3f000000000e800000000200002000000037fde1321a9b5c0a088b5be9dfc2b0959e484e42933b2c79f96d679d7202e334900000008ea95691fcec32d6d043bf9eb36b201965ab4e6b427c4ee3edba2fd921ed277ceee4262ed83b1840bc0635c3232d00c5bd5dae5d4ad7b38bfefa4a93b355da8327c7a09b5d8ff3423e53f5a66dabd516ce22328dd03816999c5c93eb27b9f660a6865dcecfe8e4fb474700ad0a7ab0f94aa6967195d41bf0f07d931111cbd67cdd522ca10f94d450ce6c56d7e5aef74c40000000647f68c56a9e02bb92f417e6071c76058bfffb11998f6df4f824360ad54ba43310eeca6d454eb861b84bf5368ecd289570e726c5b4516bf551bd381a2585c8c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001793f4926efed0e21dd005f0845ab29f3437b1a8f484c1f130806d5e6d77b8ff000000000e800000000200002000000048aa712d616b66c79524ff1e0dcc44d90d23df6eb1c048d796cfe79ec2b0d5d020000000d908d4d75a775733080e543cb3decdef628ac716a8e40580b2576a00ed3fd45540000000a6f2c8e407b12fe410335090a78f437e18ea6ba6a6e4c300dff46f9e1c15af7d7ed7d9f094a7b21208d89c959493338fce1803f577ec17271e056bf1e699e48c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2876	2972	iexplore.exe	28
PID 2972 wrote to memory of 2876	2972	iexplore.exe	28
PID 2972 wrote to memory of 2876	2972	iexplore.exe	28
PID 2972 wrote to memory of 2876	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e77574e9730cb9a298fa010c04bc283.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
447f2afea0f0547a58a547a892427422

SHA1
040cebf09677d8bb3546e20813dc6939c1beca70

SHA256
63a9ffaa7ab50d92e8dfbc45ec8878d82475574f4e6e4a6fad22117d094674f4

SHA512
fbfe140a387c520c320e642f809f51fbb463a31978cb3efdcb099ab88e1e7e76a0577705e99f82408405f9075fa683809f3d6403417efd7bf06612d7f372e86d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe96a63f2e6a1f1297ad6884583f0b5

SHA1
0ec258abf30578bd090810bde9153dcea8957916

SHA256
5ad5e48522e5744cd404c63a8ef5d7776593503c65ad4fc334ba2304b229baae

SHA512
969b14d40343e8278060397e999f8f06977642ca8a616106ac899de135c9ef85f89e71ccfb39393ab1a13c9cc472ac93ec94a358dde50e8e7d1d6633b98bab18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8675f86c5e3a28a800e60cbdf00372ad

SHA1
7d5cb45563587f867fdd25b8ac68b484ea84223f

SHA256
1180eb59de3770c6f4d283efa394e531cfe5e8b828538a75969150b75741cda6

SHA512
1f0d326ac5f4c6e69dea72f3c19bbf1231ee31f0b7934c275bc3517c1a86494c08bc7b83ff7efaff9c8d1900681b3e79d8334c703864505971f8f1ca0fc7297f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da866856816148ff2ff2d8728d73d479

SHA1
874ad35afd3d90b1ae242f2f6784956993c79058

SHA256
8d2272310cac9290a74d592c046cb467a08a4d7e05499a6a80de03671727a35a

SHA512
bc0aa5ccaa02e8b0002993a5978a0ca2a733b046fce8c542992c5becacde2f72ee54beeb8a32f41ceb0f9601209866bfd9f8b52ed07295caa9aacda6c91071dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
477376195249daa5847c6b0df77c624e

SHA1
54bcd6ed58f69b2bd986f2852f7ae3ae94fb954c

SHA256
3100f329ef7874989761288f8c29a689b5e4809bd6ec0e9e44acc56be8f601e2

SHA512
221919d3bf0d2cf079d37aa6a57a556ab309520da9c6f75269ef3ddd83a9e1862bdf2cf43ea09faf2cf8ded80decb0eedd3a3795bd304a33933739d1d19a6ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e533f545295741c29f03aed93e89b1dc

SHA1
2f568d9c63a93f68dd679930a765a902a0456c13

SHA256
b3b36702bd99d838bfab6eb9ab80f918a73cbb69d65e52a8fc750a4f130f7300

SHA512
7f8e9b6871244901354ec75b5189b40805b24f6e7b9bde074bd2c15d336fa4cbd967e074864bc57ab8f811c5225598c14473483cc11e273745db1acbee3c6086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfbddd1abec7199477d8de138d78ac1b

SHA1
add8db6f5ed75720edc9219f240da22fd8731d4e

SHA256
1c56d8e5a56e13b08b6764b28e74c8ce2d1a77532cf7da00aab96ef7c2150bcb

SHA512
43d2b2319e13edb96b4d95640be69fa17abb2abc8f49ae835e40575a4ed516b4b9effedaec2d0a41f64512c74aa9acb29e119fbe0ca0e05ae5631af109c629b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6003c8d9342245c50e1330ea1ad678f2

SHA1
f0f4bdba10e69dcf6056fce6d940db0e295fb73e

SHA256
24a12cc494b813daf0ca8ecc3b9bb274494c927c3d6a125d2db12d8ea2be6ec5

SHA512
447faa4232ea1f68c5ec24cd67aa88f65e332600a6b6dc3f08baf77aa3e69af8dae935d234ed7835afa9970835a5d355805e66853efdae08a48a243dc0592fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
640c0658bb207e27bd9775beedf12eaa

SHA1
88120acfc479e1e9eb82210fa04807d650ad24d5

SHA256
28f2d29c9eb5a1699778d6ade2e97aee5d228af6220701f5eafd24da91a6ce50

SHA512
8ac3310c7d135cf0c67da30a97e20325d18a3b7a3ae1682fb8a08d273566d00c02fc6b4bde0dd82be639ad6cb6d669f5689368a6375e32c678fa9dc5a745f61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86ab2c57a67403bd4f79721221e78675

SHA1
fc5d870378c88d1b62468055f074c89f9784fc00

SHA256
0289082c5ed2f7c109b6171c02fd3d833b1bf0f69761aa2c8c0a0bef6d347b61

SHA512
cbcf4f61e39fc1aa740614b38f592c469107f4ec90bae1c3e04f84a33848b3c858ab903750f8b9135f95d7fedcde5400d4285f56dda161d1b67946fe21a8b6d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15a7f644930e35d4bd8827556b79b56f

SHA1
90df6473c06d32f3283aee9779f8b5932bb5d13e

SHA256
bf6644e369012231c91bc0834f52cb7948cd87750ee00278cd41fe48056ac049

SHA512
a9bdd0b2cf4be8d130730199c78711ef2a2d8ae4bf7aa1a311eb8db7eb1870288e8fb8a84e1196e12481896b84bc51bd03a24b935eb5224ad079946340d83ace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08b1ea4b697ccc1dd58f9516c9f80e29

SHA1
c106263c0d3703e7288191b18074a301b810e053

SHA256
dc1450cda943bee51cc1485f4b8a5e4dea57eb5f02a5546ccddf4a5d1b92d539

SHA512
8d326de502643c134f7f9c633f11127472f2c43fd67a1e749ca9add2e9c74730cf446cc0cab0112f8dec0da690c249e8ddc62534210e0b1daef9d044da362585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d14a9108da88fc13937de3b6956d88c

SHA1
957e1abddfcac91f5981b7bd61d5f2273935cb83

SHA256
c51ee028047bdc8a40ab7960d442145602cf9a1cb03ae65ed4709353fd044fb9

SHA512
80073ab8d6e726357ece500e6c6d74fa55a81c823db0e84489fe8baf620babcbaaf9397bb44942326f0a8c5c379934e0c8707871e7e7ba4672ee4393c734b48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD645.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD79F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit