05297f2188ed2be225f969644a00bd0f53dbf2be8a8afc583cf15eb0fb75a916

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f31bad6e7d909e2bf4aab9eee0496d7.html
Size

1KB
MD5

3f31bad6e7d909e2bf4aab9eee0496d7
SHA1

0b936371491d3cbd9194677ac8dbed738627ca70
SHA256

05297f2188ed2be225f969644a00bd0f53dbf2be8a8afc583cf15eb0fb75a916
SHA512

cdf05ed4587658220fb15b967924ff91b4a7cfe0f16b4c2c431ff0862b348d31db54a66e348c1a11b6de6131471e1cb77adb5a31342b42a5a7228c2c698505df

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410483007"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC01C571-AA87-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80109fc1943eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000060593208b6060d9477d9a3c3515873e8962274b5a892b5f53737a1cb6ec5d244000000000e8000000002000020000000b3cf51bc39865862b5dbdcd1ba265780c89daa3503f473549f2c7d30519ba1b02000000081e5f6334e046104bcdd7ffb9acdf2e2f3981252aa25b4841a4df55f77ab3fe24000000081f7fd9453124ed95549c65ed5c7dfb46b4573e713c3e31853b6c092ee0f88c4c11a23416b3fa666d05be2d821a55b64aad2bf8dcb074395c366b1c0d9899c24	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a3e35631ba81285f2645c4aae4c2f6d21f0b1dd4fd42584936edeadfa1a8bbbf000000000e80000000020000200000001c1efed7f0b1c6ab9c3286128dd9edeec61fd053f72c7714ae63154e5f8a30a590000000b6134c57f72f1b8ce02a011bb7c90aeb403962cedae84fe684c95b8ff8ee231859532d5f7daa118c88920146f51a56af91dd4517e3b913130dc24ceff889c59dc3ac43d9dcaf95d4615cd68727fbf60b5e46621b53776cb3cf7738080959e6cfe211649df13eea9c4e47a31cc3fe0e3cd149e338645b4a8e476a751d8bde5111b28c293b12c20c3d281db6cb21adae89400000004a35794eba792f8200e3ae47f977a6ebbe3ac701285c8a6dfde2ece8c7622c9c3120623d0bda287242c47d02eaf51a2a6ffb9c220e1fb1bc087b99c4e203ea6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2696	2424	iexplore.exe	28
PID 2424 wrote to memory of 2696	2424	iexplore.exe	28
PID 2424 wrote to memory of 2696	2424	iexplore.exe	28
PID 2424 wrote to memory of 2696	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f31bad6e7d909e2bf4aab9eee0496d7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2be99e442dc2d43baab4a7e76cba78de

SHA1
ed61b16261836a50ac8e6c36314ca4fad1c8474a

SHA256
6c17baa423545f5c2af7df7925587c360e53aca03ecc6fab1000035e95dd803c

SHA512
7bb976cf592b04c1e4a6f8b57094d5d5026599a2e719905345f4a2f350298194190abac0b38dfda6007b7c1851442f63b425e353e5d71ebcf4ad6ff82b564cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bff1d8e85095912099054aa292b1788

SHA1
ab2e9ecbc73fed5c559c54874e48acc61e3e65e2

SHA256
7681779f05183bcdea96463aa63d0ecd0796cd28583910c1c354505a3df7206f

SHA512
8a87c0d5020c9f10e6634c29079e288069a76a0b44cdaa2e25254ba58b56fa8455f5fd56fb1900e80705cf0d5640091418bcc986f64776845c4b90ca4cddb2f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da1a4a6e4c435dd695f2adcbd3174172

SHA1
dfa2aa087357d95daa6bf063da1c8cea404b7a83

SHA256
edf3cf422db0c15a4896a89bc229e5a5734d1dd3546663b71fbb397843b2b2c7

SHA512
d012bdbf72d0827a770b16fea3073d43a2c68a32902e6d67479e91b53a0d1f8101516193a6b1e895eca6aa1b0af2202f18bc38e6145eca7dd5a89923935511fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
779d1205c01b8ff1e8ae7ebc0d464ed0

SHA1
6c398779e4db944558a80cea1606bae132da8be9

SHA256
a33fe98106e230bfd255f22de04547db604d50dd2672ce763ea77ed22bda8747

SHA512
4bc60f6e3a6b90552ada97a3359f0451a9b9283f319c13f3217be7fd59b5c0c46059315239a2e751a21b19257f7ce28aa7f3d008b96b276ffff93687833a8023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de0a3337ee48e504847f2638035a4896

SHA1
29b32f5472d02fb2ff8d692d7724d4afca651413

SHA256
5f7f3f535c8c51735f3bb62ba713412eee46ba6b9671675b18b289bc5bb3504a

SHA512
edbe0cb223e59942e5eaba53abe8825f2c7da03d720aff8a540a0e407d681a3af00156eb53b4d91a51320680970af3c3036060a45e2f04402a6732ce07837b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f349577ea2179d57944722e34fcdb589

SHA1
960a28797282b49de1159970511a14406b283586

SHA256
112b75c3c2236705e9600596ea64d1f6eee2bcb8e0494d816a60c28024089ca0

SHA512
00cecf62c73baba5de96a0d19217190b35e7a335c9f757b62cfb707d3bac38b68bcbff6be5a138b5dbe021420421852711721288d15c4e3aac745cca582918f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6926f63fa2800fcbba2229cce1756be8

SHA1
487152a2e1883a5bce0dcf67654643f22a2dd4e1

SHA256
4dcff393526418c82954e35c772e59ebaf673d2e34fb569f3b065ebdebca01fd

SHA512
cd1d7e919237b1cfa7bc49c01988b4d75a30d4324fb201ca3552f3996735721b8193697c0aadf0469ac7c81ae7580b3409b14e0786f207f445b7276411d692ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9f92a1baad4a9dd8b0bac6c3804fddb

SHA1
0bb65a8747e45fe4e3386a57fc8cf05446f6095f

SHA256
e20a1f5145e2a395a40bbbacb79caa1d57c1b0db5babca1d5d193003aa769d92

SHA512
db3b0212b2f679c299905d6a2cad4618c92d0742a6ce18f408ebe9a57d7a8a5bc4ca666d2945c3dce32e64f610d4f2ec4ebd5eb72c2f5ddda6dc012f43561744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f20aa367618a4e3259d3ef9cfbecb6

SHA1
854851d6988611d9f24d1dd7a342304cd193353b

SHA256
14ea37e70f75ca6dbe21e5e44dd3541957dc465aa3b2cd528489c660570bbec0

SHA512
a3479cbe1b18335efb51b95e4b202166d13d549d812839c4602e1ce757817e7f7f209f2295a7c477a7d569b3c6d34b55d801d56914bc96035c582f3f0882efd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d94a97d730ce0e9c0a3f07aa9cbb7696

SHA1
9f4624a36a07394d2772f6b1aedc5ed1f7b266a7

SHA256
5e40e608c971514c5bf09027977f3510fb9bc01b1f98de8d480e1f2a8e645699

SHA512
0a1eaa803413322911a4907164e62ef738daa72356c71b1b79d223c7c9a23c4a1a166be7c86a8634203d00c6381d04e342f6fc4b9b289726068047904e662fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ecdb3413f036dfd263ca3011e7a7bb4

SHA1
10f70a26eb6cd6a9214d8d2fa746473fb504dad0

SHA256
53ea8cb22a7e9e251dce2ad709eb9c57a5c52ba9979994e7e2fc1efd83ada5c9

SHA512
5cb73269266b0142ac9ce71f27f4aa1f660d4a4cb1b23c2c34897a971f46345a9941e147d1572c19436817880b8704a0fb3809348336b4e549cb25d6cf9b6b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CB1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D60.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit