5f16e4533d829f71d6fa95c5f46ebcfca1ea596a987afad24b181de09d770c6d

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e9fed782671c6e8ee6209f70fe30fa3.html
Size

1KB
MD5

3e9fed782671c6e8ee6209f70fe30fa3
SHA1

8b9c6962bc7c3108feb1b33a0fbe860dbff488c1
SHA256

5f16e4533d829f71d6fa95c5f46ebcfca1ea596a987afad24b181de09d770c6d
SHA512

80b5105406f12dda93eb33f6d0e12e43520f411c86798e7f3dc9a2829485742350da3feb966bb6b5a2bcff950b68e56e1dd96a95fb739ff2193dbcb3fbe8d241

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000bf5176df23351e049013735d022274161eb976e2346563263cdd555600b7e51000000000e8000000002000020000000df767df5651aeaaf9354ffc54ca3df06a1bbe34110fea91b87465e84162bafc890000000c49b4f9532c4658dce42a3e777e2f0dce5cf9b48d91b12501bcd050ba572a2be7bad766a47f0e4abd5fdfbb8af9ac684e5016ca19741dfc49b7edf286deaabccd1ffde42c626486631bf6cbe06e1df964460c041254f84e81acbaf4fd1064a47ea290968d8bedc60e76b6bf6eb0cc9f75e3fcbea7226216c4c9b3f26c366f5808d73e31b644bdd0f17282365519fa59a4000000043bc56d2578a014d98bc36ad5556e9c46f74c23b905638b6bee9c6065dacbe29cc5f0f51453858fa0ce668dc4b2a9e1fbd29d7d28efe8e43c48fc739d0544519	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3074aba1a43dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410379871"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000227d73a1f2795f1c5ce223bb8f3213d1f69fa497b6c830040dc4a1cdd7ef0cee000000000e80000000020000200000004221beb8f7e043a5df93e03466042caeb73548317a8eb73bb1ebe5c456a2782f2000000021bd0d33b52d39de62441b2524e5a1ef4321ccb216b44b90002f36eced128ac040000000da2ba6d8e19f92f3f76bc4fdbb25b4471a54a30cb8e2ddc5484e0fede8af3d058d30501532dde3ab86f897fb0992283718723b5d8bf0c87a9a4fd12ba358aefc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC908051-A997-11EE-B36A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1072	iexplore.exe
1072	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2372	1072	iexplore.exe	28
PID 1072 wrote to memory of 2372	1072	iexplore.exe	28
PID 1072 wrote to memory of 2372	1072	iexplore.exe	28
PID 1072 wrote to memory of 2372	1072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e9fed782671c6e8ee6209f70fe30fa3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aeb9ea71c59260b7fec8a858abdd887

SHA1
e90ed76e9ef96c4d540a4c7bb699c9b5c5163854

SHA256
7cc4d7706e2fb8f42686c455b00db49ecb8d33c304a412934536e0f14e029947

SHA512
a0d8748347f66a306c2c65b1ed969c52b75b3142d4e2d32dc0902e8351121f76aec6f7df5f8909150cd71f4aae925fc356fe92c0f85dc37d1b88d952648c584c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe555db9c3ed4de4d1cea28d00775746

SHA1
45cc0e420b31159a942da13223940a204b0da5ca

SHA256
c090c808f925d875f0d1c6b66dbab9e07b6efb93acfc9de6a100e0ffba45c0e6

SHA512
42152e8f9bfad4a815a597754b92c9bb96e8a84f6ffd94dddbb063da489887c8e32071411b67e712d298547109ab1c74062ba15b916a3d3e7ac912a5cfabf717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0769a4bf6a0a9d482bd2955d3535002a

SHA1
baf709dc180cdf9ff8d9b29e1bda6a0cefeeb479

SHA256
6d61f48887537b70d5f57b2dfe6e63570424d5d40684a5a8ed44ac2b195a985b

SHA512
03534db60df4124bd884ba8c63529dddd2ea565cc9f94582f0f24150e0662cd231d70e6c895a91b71d4c164fe7b915af87fd79edc30a6af2111f50c641e2015f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c8b213697d4d6949c5aa285f7e28e1

SHA1
5433bc9a62371775f2c5b1f77c28edbaf2a031b1

SHA256
993b4aa4c4dc277ee2b4f6a50ec2e68923ea21f39e0839caf63dbadfa7052997

SHA512
388ed71bebb7bd26f02ad4c32960ecdc0b085d35445a8e0ba17ba435185a283b2f7d7348cc0df1548187426c0b75bf7b533a3e6430649c48dff1c666c4660bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
527b48fea8e4e077e55b1bf5f3d231f4

SHA1
975a45c11920846eec11acc131e36175bcbbff60

SHA256
d41a6be55ae3953202524867b57c5e4f550cacb2a34dbdc9f86b023eb940f117

SHA512
3b197352eca5ce090f930147d44c717b087706be7a7175dd9d384b9325e8cb67a049dfd04d624e24adfb4c565b266ea40b334d31a300b1686e9766ffb1a57d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
381428be8041688f2a55e19f7bd5de11

SHA1
db8f229af754e6a949d9ba637a64f8c52cb0dbbe

SHA256
4cb0cd50427d10290d911904f1e5388c97b26e6c3da4e5239f64266e51a5a519

SHA512
57cf8931e0fbb5a164623e089ce031a0b0e52fe488f3ddd5a1b2e9acfc302209f78f6ab9afc78dab9a708b4580b323fb7570a36400721775f1d652d9a4e4df36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a63f1853d1476e1077891f3bb6b36c2c

SHA1
78fed23f915ba6daff02b9a342fd57d6dd71222a

SHA256
e9effabefdb59bbfb7aa1803c2e0368fa53ae62996fc328313d39356b30263ec

SHA512
6e5c0a80231ce5cf32abc5c8aa50ba0d464bd6109bc510df28364df08372c3a3e6d7b17aaa9dac12118d971294027ad3c5ec2736b5d7c719f4d1026b0e5cb2b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c9a6fbb1e369fc9e98e64d100fe07cc

SHA1
28ce2ed3bd03b26ffa96a52370865b832a36c03b

SHA256
eca9e7fde40ec9bdfebe4c0f041055b151d78b706c4ca52a4774097172b04bae

SHA512
eac88c70200716f1fc4884db221f5756afed7a1c81d71e5ec3b22e1beb818db6317f4cf75ac456fe3a9c0df52e281dc93394548a31c9bb4497410e82b3a05387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1212f5ac56d27cf0727468a7ec5c35

SHA1
c9186ce81f79a3a8c98a163a44955e466c663c56

SHA256
2371c02e79827922f13d9ccb1db9805dbcdf2a1d83dda25c88cecaf4bf98dfd9

SHA512
744d372941c502c1ba19065caa704f02c1bfd240b1b7b8d1a1324b8c365c6fbeb3d6f853a41c06ca1c5181561cd8b4c62de656bc063535fbcc52cb3b3eafbc32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
144871b878591a72f522f8bcd14dd955

SHA1
270407c7d57e61afbabf65f3c4ee776bf58e099f

SHA256
5e7001a8d7f08f764900544b1db03b46d407a3db4e2cb5bfde2fcd396ec2809d

SHA512
01b26a9d972995e3e60612ea8b50b086d54a439cc9a650a06c50a5c6dd0d6e03bfbd07e8fa7462bb04f078e255f1bcef6fc85abd99a9aea754e520b5f94871d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a1a89b5c748e5e314041d829321301f

SHA1
99470795f65961c1e1e5ce240326d229e3fc77db

SHA256
dd5a57db6089efc69654c6b6bc0a33d7587485986fb1d4d7eb2a8db59663c998

SHA512
a9db56f9c6837e6c831c9317f6f14808c6ee02cfa741d28f56460f891fbbbb3a94eb439946629a012ef03df516a7f7a5d70d474e093e6eb6eeef9077e85efbd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
205437ba99366b7f48246082e90790f7

SHA1
677e6159c48868025b3d7940d06cdf4a1fdcf2c1

SHA256
e2e2ad8670dcc5bde4558e05fd7c0794620d7227061ee8e9f3b250b4544bdfea

SHA512
13fe3f4aa5237af21a9461218df6e9835cd2d75f774821ac54c14c85d27e2ad8528cca9a5e63c71c463d739452ee3c96f805c4f8587f5d79b0fa1d8835b28817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6357d740cb666f752309e8ab01dfd615

SHA1
5b551ad0d741f2f319a8dc68684dd2b251b96295

SHA256
f9cf5e9fecc8d254e44e05ebb207ee8858d66d8e0d7b9772fa5dbe65d29b6376

SHA512
2bdea6aa0e01273075163201922711144c399b27980c68a1873542903d696abad896690208484925f5a6ad7d454eba9149cc394f8551032f2524a095ed654592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
902ba450d7d1c7dd90a607bdcd9efd48

SHA1
16f127c477f2b67577a48a3cd47580ebf3fc55e1

SHA256
8cc8ca6a770983ae967a37a6d259a3905eb709572704c38d83252d7438283ff2

SHA512
442f8de9025a9ca2e73b05580626e567699461675b7d36c75d50ac9707c78eca3de7928e62996d61d7f0a5582d58e26e93d1d7a23410a1c530f17bd5c481e787

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab55EE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar56BE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit