dd955ca0f3ecfbb7417ee9f4c6a7ae0b6be1a970e63e63b6966011b862874a59

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e8bb1cb3ecf80c1b3f6e32a295d7c76.html
Size

53KB
MD5

3e8bb1cb3ecf80c1b3f6e32a295d7c76
SHA1

f4ca7a8fb68860b16ccc6b69eb8029fc819b40f6
SHA256

dd955ca0f3ecfbb7417ee9f4c6a7ae0b6be1a970e63e63b6966011b862874a59
SHA512

57b98611e5a282195f7f390abfd4224fd1f3f0f578536f9d034dfbf94f06a88dbc4bbaf214ea3cbb7ea362a0555eb6f34d9273c590db4a4bc114f83cb3e00d82
SSDEEP

1536:CkgUiIakTqGivi+PyUBrunlYG63Nj+q5VyvR0w2AzTICbbHoP/t9M/dNwIUEDmDp:CkgUiIakTqGivi+PyUBrunlYG63Nj+qL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E24CC21-A992-11EE-9D16-6A1079A24C90} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410377405"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3029a0fd9e3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b05c52080de175fff0b454340a111c59b50dc3f52cfe2c14b5e65c2b9a5a4e3a000000000e80000000020000200000006e3f63cb897c2b53ac1e1790222c569cd15125f7199ab36c0efc307718fbbf722000000028f40f6e7327256d62da4374e614cc2c65622247e506804a1d67d81bf47110b940000000501be4601cf7147c648642d47a5ac0d789ee46e15c9815de84391696d4432ed87b403727a44d0f40a520ac48fd4eab9d02455fad35757fe22d8ea4d4068bdc19	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d3de74206084171066b8404ea58c500d79f6f5edb071e770f0b2fbc494d01766000000000e8000000002000020000000dbea72b97dbe73ba26a8d3c79df767c37aa63e3fe972e37825f0ace6f040236090000000d4e83dcb7193d22082ed0e5bea6eb1336c1f5771ae2d2de6b3dff0bee1f08efa61c233a3943ddbd532c4e892a87ef85cea8db5c42700e01b98c4319ae271cb89d71b5c502d33334c26c486d0c9e57409d5e86e18f9b6e34c0d758b3d2404f337eabff73da01f4e94403ef38e01dfd607f955ab5161cd70f826e1731805f5e2761018e90a133da4a2c733be06891df13a400000000ba09ea691f14e83d85a17ecbe6fc85faeb47af0bfedaeb7e69d63d899d80c375f0625fc06c309c6d03b602db6fc5b493069b4f6c0c777b9453e4494919b7825	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2476	2128	iexplore.exe	28
PID 2128 wrote to memory of 2476	2128	iexplore.exe	28
PID 2128 wrote to memory of 2476	2128	iexplore.exe	28
PID 2128 wrote to memory of 2476	2128	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e8bb1cb3ecf80c1b3f6e32a295d7c76.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef3b7771281b93c8a46641a8896d6b56

SHA1
7a1b4554abd3d9a1e57d5028f09dd2591f803e62

SHA256
6773ff27d7a2cea8c9cc2246b9a1e8de04cb4b1ad82cf30af9b4f67f90f8b803

SHA512
c6bc98f0f6b31e806b0098f32694e22c467d24573119bcc54ee28e987f72c2d711a893f92e9e53df232a72cb43ffc57a36175efdf426977ea14ab520991b1ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ac8f2b2d292c71b3026008d2f0ac00

SHA1
41faa5b44d4d679e8fe9510762d59c26acd57af3

SHA256
6ffd865aa32af6f53a5344b9d9538fcbcf422f6b2428b3950c411484cdbb33f4

SHA512
995480ff4afa88ab272286c3e27c33fa6e2d8d28c37c52814f334e321aee51764102b24ca6805aeccebf7eba045265b52eb1f83074245671643808801dbb3af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1f1a93728b5bf788e0876f7872f3723

SHA1
f34642635e99855b7dccc63ac9c1b8c4e10558b2

SHA256
0bfca57af5851bccc3ea030b61b3458be07a5d1ce50b7ba5fe442d30abe632f0

SHA512
81b5eb16421d328b06b59624999985b1e0001e31cf7eb55591c1cd361ec67e7c8c7c879680fbc23831d7f85b2016bd7b7f7e0dc674b98f750bc54c57b6689182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aaf7dec4bb99626ad8d4861394fc2af

SHA1
a810f6e1458d5097db72f7f008d95c4167f69c0d

SHA256
06188967b7ee39d66dace04d4d8130f1858de6777e4556764deadf6674715887

SHA512
5b2cf2fb209ee83a37a6883b34a4c81b1b66334efa3c3afad2f66d1801fe7ed168ca35ffe94555745e6459e4c769eb363ba12e150e8131b6773aa4bf49fdbdf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce9d5c910e6da4b54226f415b6669a93

SHA1
6adc7361f353ee96f13694105ffc1026bb40a36b

SHA256
34d23ff1e5aeadc36cef5de15022783c7c7508b735cbc4ddbee66a3278253c92

SHA512
1ad6826ccbabb849b45ee8633a8c0ce5a6061d77c9253fd203b2b1ff91e58f825f1047ab788059915d9c4eb1a9a5fcd0df26c6b4dbe966e9cf64304596a535dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb12ae61e9330270b720899259c92570

SHA1
ce016759d08340228fb0a6ececaea232757b6252

SHA256
bd801221dff6931ce3340b8987f0122dde61c6b7d70289611fdba7cc3a97e54e

SHA512
fe6bc973c858c541e8066c51300cf638b3d2815aec5556cbc0f89a2f2e6c68b4dc01ab5c6e2f08b5a62ba62912e748ca1bd0633050fe22a034808652ef186807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3532eddcae071ed1981a52beb8067dda

SHA1
0b6645d78563bc0debdc8ac6ee30e590f836cf3c

SHA256
a714737ca76a955ea556c6f2f98bb123e033a6abfe4c8247097cbbdb853794cb

SHA512
0b7c508a349b3abb8da1abb486116247a6ce5225540d145fb30b72b3cce6724f984693a583d81078b8eb98c47d84bec44e35345002416831e1a3bcfe296dfdcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac93073f762db4cd7e9f39ebac2cf08

SHA1
8cac11c54b0c9b3238810b007a0dea75e3247600

SHA256
d296ef844b4b9797e22fbcc52d7d0e4be7d6bca241b976bd32c6ae5e437d84ca

SHA512
d329b93adfb7af34cd9789f1bbe14f763d38729351d1b8155acd37327c47607d38b54306e894291a817c95f2794d58b16a3d9682e1abd7ebc5c6c85471a27e00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba662e3950efeb2bbad4e865c84d20a7

SHA1
c9d45af440d09180631b0d1916252811cf8a9471

SHA256
0277f9d0bd2c94c6ede18df684f9590007ea289c8d68d48c9f8037435ccc080c

SHA512
f867227d6077d572ee634bcdc7416419ff4b8e08af1fc2b7a23622257bb254c94c5610579787774ef5a01b3f02308ec6e1c3ff2411cf0e1f7275f41623f07962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae977911667a13736610b86ca18bae7e

SHA1
7027729c7cf195a5c97459cd76c3355533a3a1ed

SHA256
d48837dbf20db14fcb9881d4934440a5b4babbf4a70b824f67564e6261db28b4

SHA512
53d687988266eeed03bf4ddd73aea68b33efec55bd5cd86052bf15fcf84941f3c2f3c3e880f14450d44482e098f471506d8874345ba98371b09875682a29d71a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1539abd615e7b44e4ce815a4e2686b4b

SHA1
2d6f5f670718c0b4a9ce4f36c89222cad7e8aeb2

SHA256
c5272c5de387d713800f3d8f9fe1bffa12e2ed0d937dc05fb23940ca8700b527

SHA512
38adb15499355b22576b644596379b98462d0816b01d63befcdaf9624d68605e5db2804fa6fa4f0da16d8c0b86e918f1863bbd7a759e0d756870fe75e44cb00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9787c1661b04a3fcbcf31b9f11dded8

SHA1
0c8cbe3a2ab5983b26562dcf27243c12f35cca34

SHA256
0639f67f84c1af1e5731b4067cf86ccdb6026b2642bd78fddf759a0f9be7ea3c

SHA512
6923ff70ce93917d2b23b7e493c3e474e95c0043e70d29d3cceac76e88830f92ca305b3a0cc476838620e90a134f93abf5bf1712c810179843af21d6402adb5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\upshrink[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA3F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit