0bba2dbca74775444412b5fe11c5bb2cc66c89485701ff3554523ff84b19a315

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3edd07b5757ff1dbe08a0fe0e2f23876.html
Size

50KB
MD5

3edd07b5757ff1dbe08a0fe0e2f23876
SHA1

556f7ffab4ff1b6d0f8b92da9b72e981ceeb9ea7
SHA256

0bba2dbca74775444412b5fe11c5bb2cc66c89485701ff3554523ff84b19a315
SHA512

6e6ca9e5ccf7b6cdcd82da33ca23ab537dca7145b55458492466af98a33802e74326531bd9eb76b2035c233b4e8e7f02d0052a02436b708bd59d3025057941b1
SSDEEP

1536:O2a1veyCdw0ghNxgefN3MU39DMglNJfXwJ0:TfyCdVgeefR9Dt+J0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410471445"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEB3B4A1-AA6C-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000044a96d1ea01a5ae2e6b5da89be6e8611dec97b923303d360b3d942e6482c163b000000000e8000000002000020000000fca9c5984fb32a062b11a57a26c9a9295064ed783e83fabba79e6a4b9819fbf4200000006f8c650d8c5b7a4491af89e8b2669cf2102cc62b8cff26e874cfd42ff37e36ad4000000031ef27147768819daa3a3731950e698a2905abe2a48a69315b5a887b6306ddc76b827a953175392f61aee522e68d8afb64b424b4d5f7c30bfe6d2abb80e395ef	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d244505a998098f8c74e7c42c040a8d2b43a38cc0c18ac42fcc08229afa6a4a7000000000e8000000002000020000000921626c115ade5caeb24bbb2169af3a620a5362163e7b905f0d98e0b695176b990000000238e0ba7d21056aed8108210ad36c6631c5acfa8608fc8b04e2079362ef548bec7d6f9cf1b18c9206136c5337e24aba28394950fe1ca38a9b43cfddd809dba68e1d266823d1747087903585b88f378260e740c8c51b17f8d084750e6dbe0c7d77de0dd0a8194534988ef0d9e7fa2d7e4c314ef596d489bfb656fbaac716d646fd20e942ca6046b39e0a529f1e035da0b40000000dedeb5985fe220c519270388b3033157fb28e60c001183027eb0c6f2765a52fc3119c45d53d14b11ffdf594387554ff995de8cf95a2eb5e70259faaa159d8ab1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e67ad4793eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3edd07b5757ff1dbe08a0fe0e2f23876.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
962d532c4aaf91c0804df403bb8135f3

SHA1
3b60ddde1e8962ee4505119add0ce3116b8cc3f8

SHA256
2604e3eeb8872a997d4db62a49de12af275e8422d59fc24b1b106569331af61a

SHA512
bf6d3825db3be37372bbd33e2a0dc9c743daed7f42af1f26b38555fa6f85d6dc43e4866f9791eda34fd495a410e6fb27870c70c647341fc85a85a391de233d4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3d424300c391df7a4453dd0361a9e6d

SHA1
b55a4f3fcea3e249a29f6bea97d592613b503bb6

SHA256
9a9ad3b0b29e64b899943103bb324e9f5fbeb49d6db0b6a30db79338c226a4ec

SHA512
25ff1ce543e91f6cee03fda7be69f1a8063f8fa81bf3986f8e27ced72046d84214459892938eebf0935fb205e858b15c8359c593030f98a8487ff265336ee2e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e03b4636e16c3d0430dc4441d4560988

SHA1
237b00d99b36ff06c2756d767b52d836282ada52

SHA256
68470196ff3d11873eb4b38919e3b02e53c84bbe019fd99a258fec48e696d4a8

SHA512
212c12a8b4bcc799e885af8e44a58c9d066272cd1b133a6ce9acf709b08a29eed70b18613c99cacd6ab78b0fce6384fc1d481978b58220c17a4dd82a51bd3934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f586b4c58122c92a28c36c863feaa082

SHA1
81db2ec37fb836ab0bf30fe75e8ae126c03cccf7

SHA256
6d93c03257457d997465f2afb8f36f074a0f4c6a582342e784d3dcbf603825c2

SHA512
b01ad8e0b24fe1b31adfbc3beb6283ae0ab1125d635b9ab6dcaa25e790f9934da639b5493508ed87b6380a98df2001ee0e2655b00c30c7830d4a79a79562d7ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a41a17f7ee0a8ae88b870614c574a9

SHA1
4c7a9267765b688d865ad8ee9e97972312889ab1

SHA256
6a13ea6a0336a23bf3e94d7fa2943988d2e293ace90811154735b6d928c32d8b

SHA512
e10cafff5ce66585ad87ac895b09b261f3ebf734281b0bfb233487f8ef5e14fd16a630171fd99b4a03d54bfbff835184e492363814b97e37af882b1abc588ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1556fd8cbea5078b79c5267b3a735cc3

SHA1
03987631c50c6de7ae50fbac8ca820327d81aea1

SHA256
6f15b803bb6e101cc5a48600d5b31d2981a38a08602ec57492d81eac64419e1f

SHA512
5c9bb54fb8fbd6f05afced39f81d4abc41dc2c30675e449800005db7242c07af54a5321a2e6250705780a9e2478721fab103534a12cf6a312b0790d700cb7f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1f189ba5fc7ca33b264aebf21e8803

SHA1
d1fc45385152f72b3019b808baf35fb098ae772d

SHA256
0f34c79be7b4f0f95ab98ed3b3349ba458a91a0e46ce0f8780c7333b21e697ac

SHA512
04001158884ab4859f0c85597340789a4e2ec10ddb0a4f6bac7f69718d86680a6d2b06fe6c4261912d9315110ad2a17e70182df26da380cb9956cd7cf16cdfd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c54bc71268636e42b93ec3e06018e91e

SHA1
6c0df4ce6a19f9b6df4e0821242b176570f78f98

SHA256
bedb62ccc8547f31de983ef7ead0df33dd51d422c94d6fe4e5aabe29493dd88f

SHA512
6ca4e41500388bbc796c580b162088779c7e911d25da11b718ca33d3d37039cd4a28db44b0f40f3e6a79e1ef53b2cb5447c7e0f23e5d4b2d8e5eeae1b010c1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea0bc02dbf66b069ec53a001112d96d4

SHA1
5956a717d6211de24ce57eb5c590bc7faf23de40

SHA256
ec45c7f95bd0802bd69865c637c52f427233daf8371cfbfd1e255bf889eedc61

SHA512
b351ab71154871b4da78fc8b4710491800c475641e1bc27aa5173d41a26cb8fa74aa53d061913ea5f7f1cb222e98725b94bd7bd37709b026440b1e65029f01cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
523d01d25c97d95812f281fdefd7665a

SHA1
5abd0a79d88b8e29cc8cd41166af9564c31e0328

SHA256
38d7baa0bfe70ad5cedca40c6fb6e031a33212b177010d609428c5c016304c0d

SHA512
b034753bf640d124853d53ab7880cdb0910d7c6f51d0f988b6f9e3b5a2dc4e4cbc6cd7fd1faf8649043347cac91cff439b5f0cfe8753baecdc147ee0ec86e4eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dd82e9b1e2408a4af971c4a050baf98

SHA1
76caf3751f52428a03bdf5e02980574be45e7f23

SHA256
fa483130f0e661959f0c0e69910ad435c8997ec67dc7df1f56ba256a52fd7ee2

SHA512
4e02f3f24f4bab1e30683feec82aa7b74e9bf6bb8ab2c22c587457962fcf459e3bdccc93fc8a52f98c27f66e4b206b3b0129a02c10d7a46ff9d091cd660856be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ed60d1668efe03b4ac514cc440ba35

SHA1
8456402b30090cf72f3559c7906d2f8c8776074c

SHA256
19aa51f14ca7af0104f09b881f7f35f6768dcf53c7e830f73064908f8f8f7cec

SHA512
5af99198d2d6e99a864791418f63abb4f35db3f8c1a22a9a3d69a3db6bfefbb1fff2770829bed7b2d33173552da13cd206469caa3582ed3373db752565f3e470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8a809df1ef73d9bcf93ddd8c5a2487

SHA1
e378078f2ab3df7fff67920783f2c0eefb9888fa

SHA256
41aa60fe3353d397788b14ae7d60026511f48fa1b8dbd4adaece9238cd3d65d6

SHA512
8ab4b801f73d0beb90762ff1f18869e92d37a9a2163332bf97869b313a5553508226151e0c1a593f883c7adb44f5e7d99696db1ddd797a4a894b5bd8bcfdf8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
497a07035374bb55a082339ffbcde6a1

SHA1
d9fa7b048bd79c7d333a4d7e7e4a496a430d29dd

SHA256
969e7c3523e1e2e712256d201f392ee6563d73518963e7f7a8780cd8627bb0c0

SHA512
4c80044508fb2a799e44a7aab60c192b4920019a7e9f6aaf11d339d7f7ef6dcd379476a66edce830cb5bb9f912ea1fd83882aad1fb267e3b96ad5a4635f5053b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a1832b9270248c682478bb3ff83ff18

SHA1
8fd219b5426a7916ace6181a64e5e636ab006495

SHA256
9f2d052e4ba591195a212421f726ae77a70254df9e53df6eecc0d0fa1004cba3

SHA512
c4b5539ed6b54f6ec863354637c738eac76cb01d3009b3a200e6da5046b3988b0946fa5708ecf18d6f05731d5178f50d9ca3e0965dcd34b23496b47122c9b7c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7753.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7801.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit