a59bc4fe23e61b93a7cc661cfb5ab0967a17e0f8179b3920955feab996c832a3

Analysis

max time kernel
149s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e8125b224be86110d3798a9c82cb66f.html
Size

33KB
MD5

3e8125b224be86110d3798a9c82cb66f
SHA1

9a46430ca6261a343d2531022d4a83766a96b3d4
SHA256

a59bc4fe23e61b93a7cc661cfb5ab0967a17e0f8179b3920955feab996c832a3
SHA512

7ce75aa6dcff2365ced3efbbdb8fd82872cb67dd9e78133f2e37d2b277e940d6e1bacdf14e054cc553d739de220b670da7260a86b20c73799825d0e7c7445797
SSDEEP

768:/lq5UJ0QaEpb7IWMBgGUhzjQIuIC+ly+/N6WF9J2SRQrZ:/4k3pbMVBehzjQIuIRl6WFQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b6d4f39b3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{104FD1A1-A98F-11EE-9201-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410376124"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006729c5358e542c2e36ffbdb34ffd9d7190a06634ffb08267cd4190f84f48586b000000000e8000000002000020000000c24750da9c05277fe33a97e0c24060fcdc4cdec6839caec7f4768ce7dcfaa1b02000000033bf6921389b546841635535343d41ea6b7081f0b929a9d2ce4201192e1883e440000000c22a3074035560781a7cb555dec34608f97e756beb61b284ce7b4eaf173949d361e0319c6de65c2f9bee31591b018331808a84d9998dfbe83f3cc3b077dbe4f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000af940086bdb47f405671507b7a4ed3ed1c8362d7be968fe2204ea3f165fb2f96000000000e8000000002000020000000f27b450e4a866c8fe94a91a59eafdfca4d09acc4aafb0544308d48786a318f229000000016066c5a192d59aea9b739a1dedbd723b8826a85cb4c47b5688d93c9f27ecb55631b28d538bb4fd064964533a06e3864666d61b9679a40b97a58143e76c087109ab6893b7f757fc6ceab93a5469d1664c8ec98622204a04947d4c10a0d02ed713ff20ec83c25ff69297db477074c3700999208883b748197376179b8a327444ca150670a3eba09f026e0f4409aa65d744000000057b04e1489b124cdfaf871712bb949b0739d4d63d02c04df4bcd39a315f4612f45a3c0476928bcf2e9897794b40d4cb65414f24eb8630dd26fee946a3e22a5e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1308	iexplore.exe
1308	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2268	1308	iexplore.exe	28
PID 1308 wrote to memory of 2268	1308	iexplore.exe	28
PID 1308 wrote to memory of 2268	1308	iexplore.exe	28
PID 1308 wrote to memory of 2268	1308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e8125b224be86110d3798a9c82cb66f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f723df71a092ecaf024c5997e04f389

SHA1
e59a7f55c20d3107c2f04272387ab2adbdddcd1b

SHA256
54962bc7cd8a153d2ee4289dcaeb7b53fe3e28d7a952fe598bbf735a054bba48

SHA512
5c076c37372d3d676b2944ea532d61367f8ef5582a5c00ff96d3fe538555e799fd20c10e33f56b040a2548f7a4739116c348db24418d7b6ab376e6586b7db674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9b1bf2b3c7ceb669cae797c73d2e64

SHA1
46e719cf37992e12f6cd86bdf915bccb17793327

SHA256
625de266cc52ef80683df663e6a050c6f3d9fdfe58036407525e2e8327833bab

SHA512
ddb6e3019ab21961b58fd252773c942cf52b10d0389f75e533679f7a4bcb2c9deaf41dabff2805dc99ca99ff130dc6b506ec302f3e1dfe062365cc5506120260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3c44ffa11233999786fcdcc3e060fbe

SHA1
9ccbae3758e205e2d1d7914a85abe4852331d663

SHA256
687d95665d0ceb707d1edb7f6fd6567291cc6b7ea47e2e78e7f69f38f24f0772

SHA512
4595295651844f002629aef1c9b4fa58f5f7bf304b356f4fc8d8647008e928c767808299c987915e14a6357b362240c9cd22a7b81922c74f6d0c2d29246149c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4f994e64fa201d244235db737f10a7c

SHA1
5da617db43199aaf59e69b956f756dc4461702f7

SHA256
3e6c5766b4d19af2b499284060937f53fc2843e3e798987d5ca06230da6f8476

SHA512
56213f38d1432a4a63599373af7bcd0ee1cdc545fce43436c5e1df113c76a9e90760c031fae61c88432e1ba546c4a3083167dca41789523149a0169319a1e305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46503c50863a2c5ee055a1a185bb8551

SHA1
2fa725cdee4b99395a24bb3187707f3358f954ce

SHA256
18b5db2790addbc0dabed971c574584c8190dffd21acf75c017054892b958423

SHA512
a62c314dadf28ca8683493f312c7b619bd43881295eaa1d76cc810e6716c5e984536ae59f4cbc9da08b6e41531ac8ecb81fdf06126fa07dde4d7ed62d6cbd99c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
017a11293436de314063900658d02d06

SHA1
321d1d0dd22dc5798b1b111bcbad6b94f0ad19cc

SHA256
da345bb82fe802358c7eb03adceb6bbd96a574e1914f2ccaa63de50c4c1d282d

SHA512
51945ed38ce0329407f8e4aa7780977a823bb311ef56983494d67ab1ab9dafc8c0e0144e2739c797b42c402feea4092aa52df1e682ace999509f245db6e85aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02207cf71add3e389e3ae60ed12845c8

SHA1
244eaa4a4e43a421e194745bf52304302dcaea08

SHA256
57346ac634bdff6a9b798755ddbc068161515a80d1d525929bd5f2dcc7c1716e

SHA512
9ef8c30a8d1264b68a601ae02c5ad8a5e7ce4da606a5a0cde5e76ea4bb8bccd8cadcc8df1c64f3d2bccd6a7bb49d9b418fd5514ada8fce296e1934a7c668b04a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDAB6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE0F1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit