9186f4be1c732d14721235266351997914d7fecd82f0e06a67d996e7e45554d3

Analysis

max time kernel
237s
max time network
289s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f9ee500c0d6dacbda620530d3bc40c3.html
Size

2KB
MD5

3f9ee500c0d6dacbda620530d3bc40c3
SHA1

1dee494e35431ab519a625ec3c989b989e81e1d5
SHA256

9186f4be1c732d14721235266351997914d7fecd82f0e06a67d996e7e45554d3
SHA512

cab919959234c01d7c8aa0fffcab2954cf45a268818906d43d5c860d308f43c69445dc826a14a34b3d6ca0ad59c453334a0cc2c11d641781ba9d5d1d9c1fba1d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21E42160-AAA6-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007937ceb730208f2347bbf5c921371bc63e66e12f715ddc24a34b43d35491cf4a000000000e800000000200002000000086887fc85e046a3121afe0c6924ff0a569375dce62e3d5599117254811ccd32620000000ff08735df4f877c0e1004280e7c8cbf2175544d0274f3f570635bbd0bd05386d40000000a5e616df6c05e06f58f3a63c9f992dcc01d42326c46fed92ba31f76135d4c39c67a2de94cc37de966b0182d501840b0beb36e1609ddf9d8eab401bf4f24a45c8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e44609b33eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410495977"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ebd0ca6b1271e0be591d059743e6f4b17206617505525be8cfa5a7c3273a23b4000000000e80000000020000200000006f034ad5d3bdbede48e520a8e65baa5973de9d1d6c1b55cd0d51ffa6d46de2be9000000083dee6c6db429efa3d444ed4cdd3e22e0a919c5cf1f14ac353ff8ee3fba93cf250ed7edbbfe2c126b9ca120f68acc0c1fb5a1b0f5438414365a49aa6a8c18d00d9c48190c0316fb2abce54f68e8d527f96ff919d390662cc8c16c8a5f608d0e45016f608d891b04424294e068cab09d44e46d94735419052457d5886bfe40f2239cab20d5a7a3c2b6588986bf310491a400000008f7651e7a87cfe2a35ba71a3b02f120f4358887ff99d0a55889082f06eaed9f9a376535bc1eab78fa20ef41e0bafe770e9bc0cd46e22586ace3f4c1cf1a32df9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
580	iexplore.exe
580	iexplore.exe
276	IEXPLORE.EXE
276	IEXPLORE.EXE
276	IEXPLORE.EXE
276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 276	580	iexplore.exe	28
PID 580 wrote to memory of 276	580	iexplore.exe	28
PID 580 wrote to memory of 276	580	iexplore.exe	28
PID 580 wrote to memory of 276	580	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f9ee500c0d6dacbda620530d3bc40c3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c11a046106e34fa4b5d0bb3f5e5dd8ab

SHA1
0ae1d387d9de3d1aa9fb3c4558747eb6d98e5282

SHA256
09ac90e8d7348b6cc4fe8fe3df66637fd866d0335edd21a9e50ed1a683967d62

SHA512
c9b6c68ab41627f0f774361e98c8f1455290431504484339954cf88d1cf491c150c103067a78ca3a6695a2ca433604ce507d63779d8d17abf883c8e286e39811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da6fda3a5f97558d5bd13187e1c7ce4

SHA1
82043d4c55c2e9bc75413a428daa7bb7631b3eea

SHA256
d17cac2475c4311f59c5d4fd13b5162aa4775688b3b451cd2d3da6fd15fcbbca

SHA512
f20de4f1af3148c5d0c8cfb767ddeb56788cfe79f19c53fd6ca993a97aa76a1a91910c8b57bb937f23aae3be99aa6254f84fa4314eba184a6746cc7b6122184e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2588558bc24656d4f9d02e21af91642f

SHA1
8a39881bb0cfb283ca74d144439c48a94736bfe3

SHA256
7caf0aa16f18654c0929067694395b8d9dcd8faf689b480c91075241103152ca

SHA512
e498b43f3f6d5c7b54c2d675ec716d055071da99bd6a614585934a32591b2cd1771dfe21c3564725dd9ad61a91cf88797ab1612f5df6607746f7e3e8b3284b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f923807eca5aeeff2689cae28caf506

SHA1
307667047323734274a161b60d44364e2c224b46

SHA256
130b079ccff8f4d608171ea58fdfe9ca95427e70f05e3a336433cc6e7ea432dc

SHA512
daacd8ea4f3aa3c89641ddba2c7e7b379b63ba492f6020b555501a92b47c397d2c6640956585beb5bcb7449c25982f20bd5b82ea388d5232022d5cb080c0a367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8bc63ccbe6c96b130338a3112d8a1fb

SHA1
c1854d8d3668aa073ebd5c2233fafa7c9b4f293a

SHA256
f60bab45b9eff2f828e3d02d2a3354d2d7056561136cdc991c7aa76ac4f20652

SHA512
1fbc9872bae274b15ebda1658066f7d800705a70b8319f70c656dcda71af9672394b02c75b94e18e9734179b5c097443337febdfc9df076a7aa56df352245449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24a69486afaf802551a6d81e1937edd9

SHA1
ee1c727f9b4223d477e179165c693530da387266

SHA256
7e22ae764ed3c3fbe839d6abea074d50d9a82c81f9fc6c6ae669f8b5b8630ba6

SHA512
d6849dfa4dc8fbe8bee4fa8bbcb9d84080135623a932acbf790c3b62521801974b383e0ad1daeb7cb96c847b376bbc67588e1ed0d4a173df347ec6dbf3dfdb13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b4d250db9fedcdcf4101879faad4732

SHA1
cef40d06135b3537115e3d1c6574c497b5930e7e

SHA256
cd3d67ee94f162f34907ff7c04a2e5204d6e3a6666277ae6ea7783e6fe07b56c

SHA512
dff9a54fac9a75fb43c0989dc4847ee112054c4dccbeaa2fe8339896da1d5494cd3b1c86eea2f824e90e2f3f791315cd78647f61f555e0cf098a7fd99f363467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d88203be75c4757c4091de98653b3d2

SHA1
cc6a75a359c7c463f10b60632cec491a26566c2f

SHA256
cbbaf1de6309bcc2aed3e3a67ffbdb1e3facb137b66a44dcebc5f12e4c5fa471

SHA512
89eb7fed853438fbc689bf4fbbdfdb2238c2f501dea8d216fa5981ad22d484acaac685c7ec0ee3efdc678bc054c126f0f0dac8624cd3134e4472175f6a5e1d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
234923d2b19bdd5f3d39181d9d63ed0c

SHA1
a457932cbf9d23089529a35e57610d50d9c66b27

SHA256
425ead798e87f100c1c1d596886efeb3a19472680188153eef2e2f0b3852b511

SHA512
7df0ce2dd5865b1ba2d88655716112eb2c1a81c385e79960160529a056f27f6229e13c428d491bf992703186731821284d840609be10b1cce6dd64103b733eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
527ce5e22cd9b68b60d4ce4e0dacf0bf

SHA1
9af593d5e221f3bf9547b5ec8a76de3954ddb955

SHA256
e06918b4c366f28db165851d7a9b24f24c11dd3b2a875c0f0b044a46863fa4de

SHA512
29483867143e0d5cc5dea166352082a1ddd0c813f2be7d7b7bdfe1eeb41f3c088d9acacc80e37b2b69caf0bbf91b138a80f06c2e7ba53136d319eec64b7abeda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab409C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40BE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit