9da7b97dee43e98adfbb9c7da7803b2f36fc2334becbcbc932fc8a1dc1ec4bf7

Analysis

max time kernel
142s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e9e2bc7513f1b1ce66c83a30ad6397e.html
Size

3KB
MD5

3e9e2bc7513f1b1ce66c83a30ad6397e
SHA1

2f9f364bca3392d71d7a0a5fa1b3b22ab3f3104e
SHA256

9da7b97dee43e98adfbb9c7da7803b2f36fc2334becbcbc932fc8a1dc1ec4bf7
SHA512

869bd3a370b7e7d1e7f8a8cd65605f87b98fa8b1b5805b31cbc00083eaf3b779f1f18babc404d354750b3529c5c0ac9eb3ffe806f659f550cab723f7de5363c6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9022177da43dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A85A631-A997-11EE-966D-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d7b1b4182f577df12ab60caa300df038d1c327e27cda96557ed2fb6ad2363ee9000000000e8000000002000020000000427f77c572fe63b7ff81978ac4b7499164163cfd2082033f760d7b7145d94df29000000033967b53d0f281b13b959a5f6c2d6ce95ca6aa257e88bed14ce14effc7ffbead6302888175b5851af8b64fce1c20a023ec881103b31d9047f62b641a03ef4acefaf4aa94e586180fe9f182ba772e7b4f7085fdbf459bb65053e2cbfc36a977d6a9900ee2dfa9b52bb773164ef584f608bf7fde5b06dc22b2d436287cef5830a60b6e0224a2ed857976d083888188616640000000c006dc4bd73b9d56b2f6e9a181517d1146cd5b6851ee8e13e34b07989ac3fb489b58b678410521e72761547124d20c62ad00349f3bdb9c6b69011856a6405433	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us\ = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us\Total = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000479d7ff12d8eef3275961e6fa2d8344775d8802dd0f73f73abddb29cbb7e6ef0000000000e800000000200002000000086698367e728da2502b1b9fb0699b155b95a68ae3f5d6be7c57c0f0438d1e2bd200000001437550d472f0155e23825af1169f1fce67de324a995f8a07c1e0aeb3a8fc70a4000000009ac34865db994c2b5ee8c5bad5a51035144b805f6ca6ee233587e049f1c05049d039631ae21c4895c1dfd34ca94d2577dd1bba3c4cf673537c4f76276a70cb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410379789"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2312	2004	iexplore.exe	28
PID 2004 wrote to memory of 2312	2004	iexplore.exe	28
PID 2004 wrote to memory of 2312	2004	iexplore.exe	28
PID 2004 wrote to memory of 2312	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e9e2bc7513f1b1ce66c83a30ad6397e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5ddd8c88d8d31414f1c50f6f4924f52

SHA1
4b025bd7eaa42bfc3b0636703b248e38c9735828

SHA256
d71dc484faa655499d85b5a4468ef82c7cb85825287087a4a15dbd40d08839fe

SHA512
ac7a5ced77ed0e44fb140269b2b4e1666f8c49105c91f9ea9b31c4584921db2f745b450f5bb36601452d6ff3b1fab888bf3d1ced2ced81688786b4c2fe31bf6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b967538b73335c752bbd233e050563ca

SHA1
1ba4cdd1de0612036e4fdd2de271db9ab317c5af

SHA256
1f0eac179565b153f43b0f0d018babbdd71ebb6c91fe184ff6fb1e31d628b8e0

SHA512
631fc9f52894a5082243f8f8f844a152632fc971d0484dbbee0b12535e740da579b07f221c85c71cddf24f066ce679308bbe3261d0b2c076464c856c7181390a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
048c934e2830e122406dea5276c05798

SHA1
5befa12491f67893e9aab6a83a638e0643331ae7

SHA256
239e5f06faf7e08a3a0b5ddae0141f2dede727f2106f5c615f1143fd153a7b7c

SHA512
1296bcb928734e1090ca03fc0fd79e8c65decc43407306fad752f165cb553cc30676a07dcdc0ff40bd35e1f84e9319512f4af1b0ebe61d12d7d36f35eb0bb203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
134cc541809868a64421d37d8800de80

SHA1
ba2c7df058e45dc690551b70fb71bb4dfbd317e7

SHA256
04d35786e9a85939197ea0420369b7d1db7be1d245143c53443e822053de1034

SHA512
8c2a804c8d69ae42c5d3b7dede0fc8d5aa6bc87a3fdf72dc4633f60813b6a1fdfe3280bbce5612701c217715a35844a84b2de289224ef24a194b3dad76f12b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
259668acc6a28c1431b1664e54382d46

SHA1
248bb1c5d317a60b2e4d953abe9329bae826d346

SHA256
cc95abaaa09aceea682f08409e675f6c967dfa7a71cfa0842d2ecd6797de23c5

SHA512
a388d5d49bf2050293eb06f62daac0d877687cf82a73c25161c7166b42d6fb8a308b070b5a228bd7474dae9d403f6c6026435166ecbb750ce7c0713815532f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73dd6f0212ddb7b3d0106d9d6e538805

SHA1
2f4b8699c868c7334f6390bdfbd49634d759fbe1

SHA256
142d3c9fdafa1e60f25c6d4bf9e6452d2f244080bf9a516f46cc63e727c78dd4

SHA512
8be00e18d29524866f55ba13cda04003d2b34c587ee8b930fca64a9cc02988900fbfe2b33a2d80070031d627e7a757cfe4634e55c802b3a10b73aa38f2f89fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc0a4883914daf2ccc5529569a58dbb

SHA1
afe9af9ce6e129713533c19f5f5a009234b2369a

SHA256
4ff79fbe0efca8fce31ae37929e58c7b80e3f79feab6d6915b5e9d53a3531d3d

SHA512
baeb4e02b170317f56e32f661d8435f2592e29ce9a91639b057577c46182c6bafb06010ff4f7d080778c967d77d428346d3e021934ddf24b949eca964ba04a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1cf941eb26f0cb21ddbd587c54b8be1

SHA1
bf228711b8f446961af096e860da717d7084ead5

SHA256
c8fceb6b7491154a742df033827b26b1518a2857276863d286f57a09a88d52fb

SHA512
e167a9b0912f1be2ad68ddadb12448581901c3b8c752eb1d79214e4956ea963064080adc17d05aecdc7c4c4fdd9975dd361a08ec76dfb432555834e09a86446f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b97159db0c063e2bbe7eb97a82aa129

SHA1
38267b14c6751f49660545c0f0196605b56fe416

SHA256
529ad8c911da9b25cdeedee86f4e67a915275e4c7d2a98d6ea8338edd2b6cf43

SHA512
e8e7fcc1d01bb5c870737f8dd5c046c4d5782ccf10db7cccc2cb0ea6cbf6c4d687e3a937e37d3dada8fc2aa6bb2931cbd21f62cf654ac4798d9145176425e784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d84624bda7f6b4f5c57d686d2839ee

SHA1
79823e1088fbffd62ea308c0a6708276a0e06829

SHA256
0ac9040e8791a133810657b782033b22f13c9771391da98a34e5a7b1daa7928c

SHA512
780ce6c03a004a708965c58b30c66f92b66846c01fc9ac0416b2b0b2d3bceee6968f8f7d0a7c32159fdb04db6d280cbb80cb2317859bde14751ab1026c7e6657

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD7BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD85B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit