0308ef1fdd52b0f2e0a999ed69c39361e73492351729cb3c2c5505af8702d503

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fe9c17362a60e10c83deb3493556596.html
Size

15KB
MD5

3fe9c17362a60e10c83deb3493556596
SHA1

845d5e4867154a7d9241f510cb2a08fece65e1ea
SHA256

0308ef1fdd52b0f2e0a999ed69c39361e73492351729cb3c2c5505af8702d503
SHA512

45f2c43877bdb8534b429868da64c53dbfe7382a6ed04f44100e3f355f05d431f7140b22222e36b1d0fae324b6846d8434f39afa371ef2b2491c0c3b32631ad6
SSDEEP

384:WllWJKaW6GnFniLiXYXsehV0qhdN/nFZgvT+aQJIi/barq3+2VcKBvT+hVsxyq31:MiRl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002d59453df15ea348fb8f72fda5e87965f8d694fb8fffe95ee5bcf7cac45ca9d8000000000e800000000200002000000062fad34ab07167d2f0015289f181a1ef5d5a8843ea49a10f1146309609ca8e1a20000000471b095fb49795bf069e31a1d28660eb2cab492d192d7f849cc86cd7382fe82140000000b134b0f72fb70081e45d6c59ac59ec7f52b846fbd4b05ac0eb43752076af596903567592919358887f7a91c83d2296959524311d9b3544724d59781b9a916178	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000020b1703ef95f0e046328d65fabdcecf6c9d77a83e83bc0ee03dfe61241f2affc000000000e80000000020000200000009af325f2978535e75cf96986ff7570935a1cc54234d4b3936dcf2bf37aaeb19f9000000027db7f4667b3d9bb71dc9b4bcaac6c066fedec2f20e128c156b293d890d5b6cc41dde4e6928d77205bc935c568f5f83f7bc61c22d4ad0831415bbe132b6912bf4e59c0dffc77d56c4b419ce117f709f99df4b0af4616332381264da49eea490974f10dad580c88bee05bdd4831deff97a658d8e40c739984d3eb66a66253bf1aa0f51d69b5a033b8bc6ad31bd92c50eb400000006bc92fc9c3922041d9a54f21d8aa316827e2e9862288346e4301f060484460a3b3de8ed545850ac4d4c895939943f63b32c58c932c4a5401c8918d6fee7b9d9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410504890"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E43A6031-AABA-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0079bb9c73eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2144	3004	iexplore.exe	28
PID 3004 wrote to memory of 2144	3004	iexplore.exe	28
PID 3004 wrote to memory of 2144	3004	iexplore.exe	28
PID 3004 wrote to memory of 2144	3004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fe9c17362a60e10c83deb3493556596.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30ad8c6580ba0d112a4a282787cb899e

SHA1
848ddb7348478c946063861d748deb440a4b5e2e

SHA256
d52f75571bf574515481920a102770ac13fb798aeb0c25ccb08bbf97bbc885a6

SHA512
f0de863a35b5979a64e31cd7e07c4a9286af59f56b9270a990d496dc787206384369b3ca8fbe19fd670fc93a59fc3ce5df9c3325711ed4a958def260b4411781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80d760268a4574164b71d0ed66a08766

SHA1
6ebe50fcfefbd0081da27d6e58290dd38be16c4a

SHA256
c8f2c7f9f72f95a6afe5208c732c9911a5d5293a2cd72da7be5939a2158ec8e8

SHA512
cd7527abfaa2ecaf464b585bff4762f35270207e7fff41c3e5e808ece375cca167866d4f5e4b7bd9eac437bcdaf7d94e37712c01d528280063038dce5ff11c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ba1ee7561d8a24676aa69afa136d74

SHA1
ac1ac351e42ddfe989b4b5b6252b65a2595bdefe

SHA256
c175409a8c08726af5a8f8d429419d6ed8e330f78512a3f7a398d60014f2d1c2

SHA512
c529a35a57678be7a8b98bfdf1f26d4cbf7477345c3006b7c7c7f2ded57626a661d15eeed01df1afc48409de21fa9e7dacd0e67971386919d21a13a4bf017d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36951cb11bf66628c2faf546035d7a45

SHA1
0f0a4776beb1c5cb41a33a8a51ebbbbf3a1b67e6

SHA256
ca2d05c58c6c4703f24ed838a75c5dfd07c1c9eb8a2b60cb8164aae98d8103f2

SHA512
3dbbff0d00ab7fabf62173fc785963acc84af4f65e38e658b872cceeff2e7e936b69fa5b71fe73f21e064b212e64ce08fcaaf10c249643c1a77e36235af48dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
060aa29158d866fc3243b7cc4e9851bd

SHA1
51f2c9160abccae9e8a2b2c5d593f79c6229c535

SHA256
d3cb87292d510f0ce72882c2f96b31a6b6834fc1c3b79ea95a12bb578aa2fa97

SHA512
fd1413b50fe1a818a8f111d0535faaf84a31be50787e60f3401bbcd09230c607eeae622995a691a1d6adc79c421dd78ac68dbf9c8723a908f24c1cc50e19bb20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16cce220e933c6232f406de3abaec592

SHA1
981cd0c4c4e230e7452fb1f02af508eed524aac1

SHA256
a30258d5ffaef94a30a3b9f5823e7846c1eeee7bfbc596a4eb197e9899006b8d

SHA512
f1a6e3b8473c4311cdd82b7864ce8fe0abf751ed9e893fc32fd2e89cfbdd17c3e117e987b42af3e527ccdecdd2c68eba9e0ba31f266618dd682d97bb82ddb631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d5efe5547f2d20df9f97c615d86961

SHA1
77f6b5a6d55f8732f1edfec4e93a6d61dc2ceee7

SHA256
34008789b96e7f05c1c1a13af82446be2c57cac34cc3579c75cb58a1cfc422b7

SHA512
4ce614070052586c7d4da13b79f1d2992c9f61902913e19d99bae3e0606cb6a6f1d629723081bfac9be3c9c0de3b2effca8d18722d94d34aedbb28beedb89a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d423295e6ee72b6a6c89e38e0996166d

SHA1
10a87d9d7cc3dc8cab7dc09310de79f1801d8eda

SHA256
dbbf403dc5a66d697b493d494178ededfc3a52ac2b1335b6c079dd8a72ca3fd6

SHA512
e755dbff25884f552598e73b8f5380e3749628da268b51fbf82863db47953e1c3a86b30d0697ebe2717e8ec8cbfbebb80648cc3521220edadedb2c47ab71b603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
482430c6c166d35284a6ced692dd3e17

SHA1
c68f9a4e019c4195132c472d455ddefabe23badd

SHA256
93b80ff18fd8989632833ed78ecf7921a107389883715b6a4b86e7a8cbb379fd

SHA512
133b0c7ad05d8014b7901942670799aeff8158506996a9fe7eef0391bd4a4ffe07664f1d4d98f56ba2bf4fd41fe1d8ab18988a7e0049fb6274d83f5114ea5423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1787f43bd6e6d01e8094d94e238808a0

SHA1
7b9de6828143cb47830228fcadaa7d1630348dd7

SHA256
65c1c6b315bb65962622b8f8c2aea58e37ccb0d2f6e3355f7e4c894b4a8601ba

SHA512
0a7a3a18f7cf72c7940fc1ec71ac390763c55fc07ea71db8e22bae7650905ca63bb424206eb53242039acb7c2a7197b5d6420e851f2c2a934e187a33a84fc55a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db176e631611654c015d285a53baa78a

SHA1
7e70f27fab561551c6a02d6fd5e98633ff7446a2

SHA256
e6d02c00f23562e846cdf1a365a603e8c75267fedef64970e00abe26891669da

SHA512
f30f67028da8742284b7679924311f02049194d4609267086c747c36b4584ead889dcb3bb2591332bd4f5183b56a1a9c28df037b60ca3960ed0911df04aa3653

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC140.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1FE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit