783ad6d8d3c12f6f7a72fcbd625115156486c1239bd6da7cac77678c6d2ed9b9

Analysis

max time kernel
117s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f4db1d2f7f4619bd414f2a93de48aa7.html
Size

842B
MD5

3f4db1d2f7f4619bd414f2a93de48aa7
SHA1

7d0f3f69d0888402e00ddc63bbfce68273c5f7da
SHA256

783ad6d8d3c12f6f7a72fcbd625115156486c1239bd6da7cac77678c6d2ed9b9
SHA512

88e1c8f9cf6843b5e99bed447ba920c01302fc82aaf292ce0661d158cca376afde78e6749e93dbcdd0b2c14bd58597d9315452bfb5c5863cc34f4f0b5f576626

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000015079bcdffaa655275988d5ad264e1051c54b70e49d95942dde88dd37fd9f6a1000000000e8000000002000020000000ba07e2ae7502de78b99baa4bf210eae6c12d353aa2d4114abc2e192e310530d8200000005df9f6cdfc1f510d93f496a18934b7b2cac23b3b7d5474ba419dfcdd51cb21b24000000084857e891c196fb42663d79bf38650fbf5b0b892a8c01b263f4b47c3e380e6498373e4add054ea5d892d5fc8c18eff178759bf05997e631f1d191819b6e3fa3d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F75535D1-AA8F-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410486451"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005a649a981960bb45215b9458fd47a929140239a87b1239b52bfb27672b87bf1d000000000e8000000002000020000000f455f96f60e15e2df84073757be687bb0d9ad3c52e570116ef9dc306056a6b6290000000fb894cfacc7c943d7ff690227421f1847e3a193c5398db3fa30dcc6805e5239e09dc2286a8f23f59b6aba388bfc80229ba6246ae67ad9d8ccc650d5f7a705963038a5decaaa08361ee979bb87a5dabaefbc52354cea3e7e245dea3ae883aceeb4c89225e0fd843073a64b07f192f1323ceae5d776f61faf69d455c01ab950c53abf72215bb62578a6d4208370156d9ce40000000850d0ad12d47a74bd5570a2593fc878bfff9bc25f30c6d0fecb87db05801875922db555616fa03d653b01c57fae61fa55422f4868d616676bd877335aba24970	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e086bb9c3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1464	1888	iexplore.exe	28
PID 1888 wrote to memory of 1464	1888	iexplore.exe	28
PID 1888 wrote to memory of 1464	1888	iexplore.exe	28
PID 1888 wrote to memory of 1464	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f4db1d2f7f4619bd414f2a93de48aa7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20c3941173b3683980ff7a4ff950fc6e

SHA1
6ea7c13a4b38b5b123aa64bf33d3850fd1ff684b

SHA256
c2d9cc52bfd10f3149ab1ae193b08cae2b8c93c7189e7fa78b091841a13fb708

SHA512
7267bca3267a881a64256f555a98e225c7fc4fc575816d8db9430cc9f8ba649c46c06b4c77ee65abbc7a5c43e2c8fe99008366bb496c9e18cede80b55de61981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e4882eb3f32e9cfbd77752df0af22dd

SHA1
3b026849a743cd4710b20c61fa12440b14a24520

SHA256
692feaa14fdc922e6e3adabccbef7eaf3a8727b5538f5572f1eaf25010c56d72

SHA512
41f68ba1cdd329a73b0540b1f3009811553b6c4e6c1506efa25e478bcdbff5c180e65d99badfc41f7e854675c1d8f7dce9d2f3339e766aa6c76eab31218b14fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc699b35b98abcd66d5a467d96578a87

SHA1
47925386a1bf6b9520b76dfe25e8ea75bcde5f9a

SHA256
d701343b6ac34d34b4a2d36fe0f6267dd77cc5dd7198186ce513856e50ede0b5

SHA512
09319ab8a6b75324cb096495ee27a377256a5acf269ec4a6e8e45318f1f473cedbe845cefe5e6600793f78f48a2cd606956f57e447098fbfce203493c772a49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c1e935c4908dddff046c257ac740f45

SHA1
ba8f03bacad3fe67bf97d2eee5271681c4ae34f5

SHA256
d8192171b9efd966a6bdfc8cac408a08b91dd66f46546fb2a5a6360f56e06dfc

SHA512
ea2be9d147c291c5951d9ceac8ae2378a16754fc77a04d23e3d6360c99841825960451722c7d128d1d09565b5a418048a69bae7251f72ce932adfb12b6688c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e84fb29bb08c94886d942d1a587a399f

SHA1
5fbf133983e77ba59ff2220a95a4b924eece293b

SHA256
ead888235daa1765e5b9f878e6d6e50a6bf2a8b4f1c4fd463076cda68bf6e322

SHA512
acf9e634c1f2069c6fac560051f074b8d881cb26e06657000cf0de432bd04ad32df4bd927682aa1ce5a354c8417d489c7a81453f0aefba10a9bd821600c96471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee9594f8f6bfca223657a874b7bf1b06

SHA1
b67769a4d5648fd8afb5031d30c6c95fc1882611

SHA256
84cae698f0b01dd828003a50dce835852515259398acf83e1543ab6aece94170

SHA512
ee0d1f090ee6677d6d8803a64394ea21095734c832a2a5d9bf54d8387e2f4b8ac5b30f049de3a21583b195a757a90692a2b4576a432073782c08bbefb74fe466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc2eb1c9201bec1d6ed779e1c86cc321

SHA1
c9e271dd46ba9ca4bf368c0118e50948eb56ca91

SHA256
3e5c136e02fb58510eef1f343a575baa5405ae6bd894d00efc45ba4d1c43d251

SHA512
0195a7628450ff7379dd55b525589dc48a61c481816515aa89209c0af4856078016378d0320e33f2936a3260972a74de7b07ce896a2d0a1e4fc8275f6314f1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db7f79b05bb0cba82c0d1e48fb094f00

SHA1
3eb2ca5da6d281d05f59172b8c1c3c81c78c0fd9

SHA256
58f07f3ab2030eec9b7faa1ee5bbe2d2246c1f0b9b7542555620649e0ff349bf

SHA512
d19777fdd3616060219cdde64877778fb0fba1f652bfd7dfeca22cc190930d7c13570392c6c519ce4963ac12667cfd52eb733a71961bd16e379d4d6f4af09d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fe0c340317fd90b7b295e07210d04a5

SHA1
7f34d0053ebd955778f2eaab8b96e27a23e7d4ad

SHA256
812c6707a8ceb93715aa2aef1e434589453934c8fa52b243df1257ea048ecbea

SHA512
330f1cc1f25905b25a067dc7aae8b8ceaf3d635fff80b9ca4ad931a2052f9a66b7d5044306398bb35c23341c2503ad8dd27d63a23659af8b82ae2d030c4e407d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a480e8f6edc5040551e6d8f17278aed

SHA1
f8e16d78e57d85e81f2530c25514afa50003d5f2

SHA256
8a81647526365e1c8038fe69836a52e3c47f28db32234f908a3f0a28b5a962b9

SHA512
7a449a570c9760f6d95038e007c78bdf66f28b8f68b6fa1c8d8c496852097f50993f3e3070d84f5118df72304f5e1289fcd081e2027f1bd34d2f3d4f03f73946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7dd72501d82762ec7b80f32856888b5

SHA1
d9f59b3697e965c7a9a27ac56a0df69749bb7692

SHA256
7279673e1dfb012bc781bcee3d74cdd5e1aa02b29716a24e76e4eac3f0a17621

SHA512
635ec677d8ab1c297e56be47c84659f349f16f7056d49cba43942de6118b9a401cdf0bf19dd97e6513bd66a490406d4f203771e23ecb49af903ace7a65dfa252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
682ba7bc3f76cdbc12eee692ed94da3d

SHA1
1ce82ca9cd0ce1007dd91362c9260b9e37a17a7d

SHA256
e7d3bde5fe36766aba7c4f24571d13de6267beccef8057e934babc5b73b73b64

SHA512
b8e9f10372c80470b6d59c445fc19917b95071fb7bf12ab02c45da6d203e316c0f8a66b901aeb006e78fe0663c61502b43dbfe849f5fc7a0207e835fdcfdadc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9031.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90DF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit