09c7ea06dadf8cfbc02f0f1da4abf845a43ace3b765e8c7dc5303cfd8a5f85d5

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f1edb44bf0abcac6b9b69b7c7e058c3.html
Size

53KB
MD5

3f1edb44bf0abcac6b9b69b7c7e058c3
SHA1

f6eb848f38b0feb8725a1eb673d6dd60463a4bdf
SHA256

09c7ea06dadf8cfbc02f0f1da4abf845a43ace3b765e8c7dc5303cfd8a5f85d5
SHA512

6009ffa98806f7a205620c3fdf64b40b7245bd2300fc01c2cdd37fa3386c55169c8188866f0e5222c2085c0ed13f45d829ab702b83b189e78e4d66c0693a1feb
SSDEEP

1536:M3HH2lDu5leIWAMSFTXW0nuoTYQUEcmqSEEHNH:aHWFgAIWlSF7VuoMQUEcmqAHNH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000011165ffabe230f883bed0cb73a7662c4229a4d94aa0f16914cd032675ff59980000000000e80000000020000200000003692d56a70587526a09d159d3c9ee4e65e4ecb6a4e615b511dfa8a021c14282a2000000042903d37054b91342d1630265352e51135d016a591cb013b7c49f98db40c9ac6400000009bdddf3d9e7a2dcc53af5ad3e3788bdf2b49aa10d899178bfe4a1958a0552a16c0b977ad17b9c4baf03a2e3581f8a6e6534706617f1cf3691053cd2c24f4de3c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000071f98018813dfe5f0bd971bcc3065698314df61f1f67c87dcd1ecb404f9a587e000000000e80000000020000200000004717b1c11fc11b60e826c95e1817d8fb28e9acda5ade87388a6dbddef375e8049000000019037746714d0336aae86e93701c8c8339667fb3f188f4ba630bff3c26ae36907fc0579e78e684a06772afa4c9fc14dad11bf21dbef915ce3ad0310f297616b14a33b345298e688f54e5900ab33a04e684583a6e62fa7216b72fe7d416e5900a1b67fee49310f70e82b26ca8e08e26904fa037c0c14fd810dfbf1ba5b3e8038f267ad7f0cb8b9d1f14a676286904fd9240000000f30c7420685a5cf630ed4778e98c1746d14015c1e649581d801d8b0ffebae8115d07a88b762b03b79bfc62d7e7c8eb7c7b6839bac4df7b2542a8ae6854b43f46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410480743"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7343131-AA82-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40573f848f3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
1372	IEXPLORE.EXE
1372	IEXPLORE.EXE
1372	IEXPLORE.EXE
1372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1372	1720	iexplore.exe	28
PID 1720 wrote to memory of 1372	1720	iexplore.exe	28
PID 1720 wrote to memory of 1372	1720	iexplore.exe	28
PID 1720 wrote to memory of 1372	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f1edb44bf0abcac6b9b69b7c7e058c3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
29fb7cb445505ff8608628d813a55e9f

SHA1
c5f040766a3f45481d62e4f9671741d8cabbff68

SHA256
ef099dac5243cf14d7fa57b682087aea29c3c67b1c4f685959745d6c264bc08c

SHA512
ec5ca0ceade8bdd40ed435d1f40c7abe18e46dd06de56b25e4f2eb3b7c2a922e96799a390ccf51539727b22f8919f7e5432079fa193b2f11efbc2ffbc4908238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d0acc3b7afa047a55bb65045111c567

SHA1
93ebb041fdbd57585e6a442b963b42e096f9784d

SHA256
e2e24c887b42a0f32a23b28e8958415d1a0539cb9159a68619c04b93ff46959a

SHA512
cce270aa279b963632f989718b16f90519fc69ac539257beb29eac7caf1d8c8d2035d8f753f11f6fd7422d1b7dd8e99d91c6baa6201d0bcb8490c8aa23e6fa50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3850e19b0d0d73ed8fb3c618acf5100

SHA1
b072cee613a558a475ebbdb7a91e60c20c2bd5a3

SHA256
3e25b6b1ae928774d54cf9538454e0cb4a9318e5870a3c2629c7c8dbfd99302d

SHA512
cdedf728f57c2d55b1a37e18d43ed8a7641454dae24ad409fce2042e4de856f259e03cf871a23328e25e43d56a06afa1524db98ca4ea28b1117f4a7cfac11948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b42fced96053d19614ab0bc76a891c9

SHA1
4d8129c1eabb75552e51d48edfc88700e0818d89

SHA256
db78254431d1ab0ed6a04e00da677f1f373482cd7c329e7e23974857635ed390

SHA512
bd356c4e006586db5cb82b1211d3f7f33ecb2f2b8f95cfe322482e433ac04a7ccbf9b74e329cdc0306be9a706ecfb49afe91d465d96c0cfaa142d17d2c4c92ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81e4b4b38958f3df5b2ee7e35f1f5086

SHA1
18c5bf4408bee04ca9905fe712e4c779244a5ab6

SHA256
f018bb721b0ba28cfedf93b572c5f5082cf8491c0a3be05c89e45b79958fcb0c

SHA512
14afd0c292c1368e566bba8522c6a8b33a19415fcd8dda69367a37a13b1674045fdc9523acad0be38f0f2ff817dfa6ace59e6b2cbd15f45b06647e0f137173db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d57acfe5fd0fd7246f64166f956e5c82

SHA1
213cbda067034c6b3e0bf2fa042fac96091476f2

SHA256
72b0d0bec81e21763730ee89dbc917402dd19e19f3bb0921c74f367b292bebaf

SHA512
8c5eebdc3b5fc118b89c10256ebebe9d0a4a069054df3d234393091310ec9a86984529efdc0ea4f078ed14b56851ccd0add27dcfb0dbdd05d9805eba479f8733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
134af2a7fc9ef22a23d5fa009b5d1e87

SHA1
e7cd02b2b4bfb2042c52607a16b222026a79cf66

SHA256
77bff33e8f554182aaf6a1da3ff00af0395fa0b09715082ef32a26c7c6afb465

SHA512
4547f24bfae0f7a6d957f73299259da6dc13a9d36d1fcfaac34f97edfef9bd019316aff0dcfffed65c9f3cca1affea95efb306fc931d71c56f050d95901e551b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53cbed1445b98da19178e5e9283f5f86

SHA1
75f5d53cde518b11a0d95d1744c721705d13976b

SHA256
a65879aece1bcd1fea3c6f54c3d67801c6337325465ae46dee3791c964ac56ef

SHA512
0f372b6c6caf20cdc343f11ff2c370846db5edbab2dc9cb115f7ec0d59ebe85314ab3ff72a817b92983ca6a300bb2ac0c94c9c535f2efb96387ad12659089ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271cb3564df76ccb63c2d701d99bc12d

SHA1
666eeacc3d54eb3a0eaaa4c424619f39af182175

SHA256
d5856bf88854643cf9f895b950e450346656415ecea3e6cd91ad5ffe34ac039c

SHA512
ee64a06e65b709ca758a3b1f4234ab914bb02b0df86cb81a6f7ef82f9eabce4cee69ffed75cf96a1d746e4a581775d0bfad1dc4f51381f80ca899ada7286a664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
411b7e3664fdac5606a9998053e82e68

SHA1
34c6d4c6632aa214dbe9935062181b4ce620953c

SHA256
ed4dd2cefd4dd39d470c01e5df8e310b5eb58789188c980eeb801d898e8a67e9

SHA512
97311fa9dfae1f8c8db4e0f045b14ff325069376b606da05d7b340be6d63ca92561ecfd61e85de57b0c3bf693cc7b8411feaaf60d7e7f9bbef2d15e9c6041ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e25fd71cec0cdde1456a3735a80f3121

SHA1
333fddc0551f24eb7f65dcdd6e997959878da023

SHA256
b1c696d44301e92d86af387aac5215a1a6909263edff7a035eeb9636bc2d20cb

SHA512
5fc3d7971fc9f99c36e286a4d7bc9eba3ae1378f6ba7ee0d44086ce01ff5b45a119f6f1a2b1dbccf178c49faedd89742b6a0babaa942f3bceebd1e3f730335a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB0C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB0D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit