ac73df96c9434f673a1483aa6bd981ddea37af39d01a3f5fbfbecd85871f46c4

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eab86cdc1a483c4e9d821b4175cf7b3.html
Size

91KB
MD5

3eab86cdc1a483c4e9d821b4175cf7b3
SHA1

a0d8ba1562c4b67bc972a97f6ebaad8175a5344f
SHA256

ac73df96c9434f673a1483aa6bd981ddea37af39d01a3f5fbfbecd85871f46c4
SHA512

5c493c38ac691e38920005cd2221df7687c5fd45ec32dd060bf5b98494d5f320f010b8e1184ac2f29294d486db22fe5ec4fa785ce94354ed7e2fee985f798c4b
SSDEEP

768:OVwpWZUmieayeGK5tFDqlk+t1oo1XigsYSZJix4f:OVyWZUHe5eGKbFDqlk+t1oohigzgJq4f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410450919"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ce21274a3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000038c0c6d94d6fcc280fdc3d4589c574059500b778618098e2ef53842e03993afe000000000e8000000002000020000000240e0a8dc10a13c95ba3307e48f0dbe51f2048afe88cfb071b4dcca8110b05d390000000ba6dccfd7fa84b32067abc669d65d05c4f749997c2cca3f199cffdbc8eba9cd70468f1248f90f3232a7696894c0431d4a7c5a5870088bc8f2eb4a3ab3aa87204b90fccebc0201b362fe0b4f96d6b8b34c4d01c7ea127d4b1b1d1ba1313652b67fcd01a19437630533c84bc6234cf940b26e0bca6c155efd8f2c16bddf78db0ce9512c4d32373e5b9aa04999d0f4f0012400000004fdf1d183326e066d76459556d455202fec4606466edac463e8f99c4b08cdc3d686a941c7ec05c3f12940f647854434c4056a767fe0e213eb22d12bef65e56ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BA90E31-AA3D-11EE-B201-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006a253b14dbc441e27abf5821ea9e9f098c52231784ccb5dabf1a7bbe88193ab0000000000e8000000002000020000000e1a6d0be83212b74d6c4143fb4227fcc0476145b90e1619671dff611add5c96b20000000a243dc5de52bb1e954a99ca6395deaadcace3225d7d400db5f51671b09bafaca400000000cde60c2110fb05010e64a4aa84a59e93880a14db7dde2b0cbcc1b1bb2d9de78d3af1bc4afd88282a2c7c2a90f187b758ebb5ac868888636e1e349cbc3c33a4b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1520	iexplore.exe
1520	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2408	1520	iexplore.exe	28
PID 1520 wrote to memory of 2408	1520	iexplore.exe	28
PID 1520 wrote to memory of 2408	1520	iexplore.exe	28
PID 1520 wrote to memory of 2408	1520	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3eab86cdc1a483c4e9d821b4175cf7b3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5afd9746ac9cff7e9a4407757c931956

SHA1
89ea41e326ef7a21afd1b64e53b7371f03046836

SHA256
89c6cd51ab9effc0ec38679d9886799bdb47f20daab7d8ce08e7b8d70895240b

SHA512
2926672361ec852ff803a58e1d1cb7171639ee58f1e0f2e108efc1fdc34aa8a4cbb6959d4bd3a1b5c62d028c87c4f7ab45298782458f1752835f94475266c28e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60db39addd711f374228026bda8e62b1

SHA1
ad938edcbb6a365a7c0726746595d565eff5832a

SHA256
cf7c3b917238bf53923fce54f694cdfbdf81518fe43e1500a99fdca6fa9c9339

SHA512
3c962c9c370feeca69236c50e7509e57c599f2388ebec1df35e1c13c46e8b48b8f8fed09a734bb18b2e8f72bc344c3a21db02bd0a929773b347d4f1a5a93587f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853146e0eac013038863519418538ade

SHA1
9cbb72fcb9994ef5febacbc5e30d965561a35991

SHA256
bd25634f1f61208da07919478a821096032b76e1aadf8f90158ac7147407235e

SHA512
c6b74aee473d324c3c4c518f83c6ba8c701767a35e560fb4cac38012d73725fbc55a31565faffa7082e2a17afe42ca71f790ab585d95006cc6cc52fd93e146e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c76b62084187572fab56b8886ddd9d

SHA1
47a01facbf292d51c5ffb9312d9beeac4fc00e03

SHA256
4087f8788058f526919e255f92d66553b2c606f7d0b1f7c814165ba8cdda962d

SHA512
4b233299bc2a5e1424890d304ab552abf76b0d0e9a246bea60cd6a8e04d4c351139aa50fe7d5df88ad63f7e81392b09cb77dbee6bd0725a0004ce767b0f03e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68e2b4bbaf7307bc1f75200b59d09772

SHA1
f4e3068e66c32508c4c417e9557db466259668f5

SHA256
f606cfdda270040e6ecb245b4689e9d832182059663a227b02e1f16ff65e375c

SHA512
5fbc6cceba315853920770aad3268aaaeedc8ab507af3fa3365d081578b937653c9815cf0057fc207a7b6c59ed0e73db2a438d4bf931d2da12f7d69fcc3f74fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49bbe5fd688bf514cbc1623685622413

SHA1
604c7f3a13aeca99c85108a8de30dc5202b1c172

SHA256
c798bcbea0078ab46a9a75f13edd15ceaeba44ae223e655f140166fbb77b5ec5

SHA512
b5f324b123dd90bb5303e34f3ea4853459af329dcab63b2574924b5056edbec35745b339c4ef507e4746a2fabaa33f320f36e26e44afc20b54b358ad64ec23b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d527bb4396e0cc7c118a15e50968cb50

SHA1
c13a3ce5ec75b209ae070c1aa94c00e2cb1f82cb

SHA256
1a3479adf5f67281d2838c2b5d86c50a25f8a0df5a4d27066150f34893aabcf0

SHA512
43ec40db7c673da9cd5686d746273a015cd18818cf65fe036a403a934a0cbdaa1a7565d4e3be47cf5c03ef5108aad05dd468832871557bbfc1377a1e84f76473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8957e69b9dbdc969f426dece53d3af31

SHA1
4350b58c1c7fe60c6343fedfc8613d625d6a5a02

SHA256
dd5698b8a28b495bb2c9915cea339b85826edb47fcb11b9222048febe3a54e93

SHA512
d6e40342ec2065e56b758d863b7373ba02b2f3c1f9efa3c4c14dcf77c89a292031fe510c76c56f86bb7ff51bafe90159161caa310cc82859149165f47bd42f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab10a9b57734c3049cc4bcba90b72f5

SHA1
7c35099ac3d144621ba56eaf6ecfa02aa0b1cf18

SHA256
4a0ce903ab76a1a96bee08d6347aac055919093e1e9ef4fd5fbea95a3d70f059

SHA512
ea04341346e4a8d57bc30dd7fe42043d8cf8eb7b059ace5fd7f99c631b9e4b3ad0c79a150ee9947830bcebe1cc4be86bf02fe1cf18ec6186b226f8182ae3417a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
066864cba6e425ab7aac398141ace3f0

SHA1
c67ed52925262c3ede1bc7e899249ce1744e4aa4

SHA256
191350cd9639f6687e4770f315c1ecae5b5f687d140a335b4f3f68e0f3ee9c19

SHA512
716ed0c045d9d5212492072aa94d39f80bf4f8b2cef548da6e1b0ffcaae951534886e5b2a05233ca5afb1a8b5da1fda20a1e28ea562f4ad9bb54d10733955a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit