39f65dc7625662ba4611ae924cbf3cbb0593c5e6cd9f03fc2974e213da7bb5ae

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

403d30541c826e2943201731c9302b13.html
Size

3.5MB
MD5

403d30541c826e2943201731c9302b13
SHA1

6138fb875d8af52f15bf06d34b132b9a2326abc5
SHA256

39f65dc7625662ba4611ae924cbf3cbb0593c5e6cd9f03fc2974e213da7bb5ae
SHA512

e3a2aab97e49a19b51e2e962b25a5b62067f7c1319a35f10eaae83d0faf79c9caabbd513e4bffc7223c7c969a236efa4e4295a2d671c719a6885b3516e589f6c
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfk:ovpjte4tT6Nk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410514667"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000004f66b227605c7642206fad5112f2f108ddcdae89363c48a31b5c4883438e1796000000000e8000000002000020000000f4dc2d73e568893bef4faf8c290735af33a074299a8f5671f6a9eb0d9ac3283290000000f33783fd28d2cb8f7deac4ed26617c298ed77a0e766286d3b4881d97351edcd39af5eedcd95fdca3d8fb65bd64cd8a24a72bb1c640fa3efd5ef2556f7f0fd0ab89b564aa601ac5dc10c6b93ebca7455e53342a85df83e0bcb589bf8dd772de5b9a5028ae073f8289cfee323b242b57bfe20040b73a9cfe2d4c3563c86522ceec07d2d5dbb8aa7094997f1479eac547c8400000007e488b823004cf97b7e4949e10afef9f90f70efe7c8f8b383d9daddc2517cb185cb33c65e2bda1d0200fcad1cc93ccb2b91c33d45dad3eb5eeeb8920823f0c65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000fc7e4bd58c0ae7cb2b96a32e9231dba620b9980a1ed1594bd9ce3e3219f6880e000000000e80000000020000200000007300ec918b20da9751a30378c900852a1ef8f04f99a19b6a171894d3326412f1200000007dd8fb938ac733740920ca6ff7e8612ccb10eaaf9ded2cace18f39edb9ecfa074000000070f9c10da97ee4d902400498e20055c2f3a948811d7b4b34e919e07752d3003ef4872a3d2b007746a9ff4d04e311f28eaf6850d4ae2b944b96bfb202735154ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA122251-AAD1-11EE-A497-46361BFF2467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f04088de3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1992	2936	iexplore.exe	17
PID 2936 wrote to memory of 1992	2936	iexplore.exe	17
PID 2936 wrote to memory of 1992	2936	iexplore.exe	17
PID 2936 wrote to memory of 1992	2936	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\403d30541c826e2943201731c9302b13.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ff82ee9928170ec9c115c8985adbd730

SHA1
ab1c4b561546fd117a2a3a60a1dfc1f898e22552

SHA256
ddcd122ac4e675903417b76424e803534e6aa2533d998d54be876072515d30f8

SHA512
3a4dce74e1470aab66f3c18bc3d6dba49b02be77afe76d29f477683688830d073aff970b571717a060596c656fe12e4e2920cd5433da3c1a6e2cf5775a79358f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f79353118f718d5d09d29cd2ab5d9630

SHA1
c44d3277ef3c07ae1c297fab0ccc045959c0b0e8

SHA256
1f75eac3c6f10145c115fcb1c45f765a637affcbcda3ce7bd2ab77720b45b7f3

SHA512
67745c6b948348b10fefdd4b20de074f7667fa91bc140b2cbae2aec7dd90b017cb32db6d8c937578c587bb6ff90c339929624a814a84b56819711241dd66dec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
850d552bb5f68edd7d7553e2aaed393e

SHA1
4f78e26f0ddfd6ff6218ae7f2324cda66cceb1e9

SHA256
84944437a6b1c5a6f10fec9538b6b3175e67e4a5b0b6c93e6d905adfef2cb71e

SHA512
ad70b777f0cc78e6fba2522aa3cab83751fad554194d85f718f3106ce1d777324300c0c3d8e8182b5819036c0dc296e5eaa3f429c0cec16842dd9e865117a461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61354dc5c7f51925c14c0e51b32e7440

SHA1
52840c052a8e8f2b99db72b552d00ffbc8f50df5

SHA256
ce712ce9263ae08f87fb25f06625defba109f7fd9aa42a2d10d4e739e9a5fa35

SHA512
adea4653edd6bd2c5ef97778d6ebf223f51b42eaf32fe701705c300c3f4a67d9cff6907e976039e0ed4855de15417e18e40402edda6fc6c869019f47298f38b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
369eef3a4e449786937e173e2c1669e6

SHA1
0ab5c6166464c2b244e7093ae7609e5132af775b

SHA256
d763765d47a736777901991a57030f04b39d3e951714b94604fc4a34be6f9d6d

SHA512
86599eed58a14521190c7d763eebdf6ab89382e78b7feb9c6ad29af74878a48ff698a73ccbebe980cec31fedbc2fa98278f67f893e6a821011e7c558786fffa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0180b19b27a20244f619dd032e282605

SHA1
a7befaca116f4a7dbac882c6c44134929d165871

SHA256
3143521f778a943004e6871612873d77d25b90b04eff1ca3273b9a3abd055d80

SHA512
cfc2a5373d54ff566a35dfb95a9f2cbfa35133f3d2e5c59a59c3ce895632fe23550b43371416af2081f3eae04945f88d07a9cf0020d277fcc207dd3428130078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29f55e28792b315a6f3a2b2e413d88c

SHA1
d4353f7534479c1df07316806aefd4b6d025e884

SHA256
91a49ff0208b4188779be4d6b876f2cff3d4ea75c66327ce6d1bac0052a2d5e4

SHA512
5a1055045c745c0bb85c24279c9ea22baac31e3bdc7bf33e7465138779006117761a137545d6b8ec2ff489de3c00ee030083aa1e75e60ddf00d43d88d20c4955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4fa952beb368c7fea3eacd70bc03bca

SHA1
d99954dc6464653856b72465cca43b094804b705

SHA256
f99f8ce7452cf1e45b11fa55e299bcedd9d1d81201a432fb932d23569f67c7a2

SHA512
84c01a51e3b5a49407474f6d25dc700263a8d3a1f0857a8e9e335760597456284db34ddf6f1be3500245b75f1295c34af8aff6bc2cb8e667a12cf8b3745c06ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9b111068952a0faaa94765a2b9646ab

SHA1
9cb7907ae28b7f9c3d66cb0e7d316f6d6f44944b

SHA256
7239aa61cfc0f07f7f2038cf68b17abd614360af20c7bae79beb6b5515bec06b

SHA512
39a6e2d35bea7d4774344f098f028335f012033757bf3e4128f56d6ff100ec7eebbf8944b0373966fac95c47e5f1a42ff35727e24dc9aea8bd6c87aa27f3ffda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07368767b4f33fa5173532fe9207da6d

SHA1
e93716e0b875fc2f3dba574c6de09eb484d3277d

SHA256
7cac65a19693be32ae4bb3a4e3e6d50ae646c27415119cd2f87057b23d5ee8e6

SHA512
2cacc42530816eae4c8b8d872cbf99dda8d873dddd008984823055ddfb2adad4421866726fb41694795b5f5c9ec03c27ae158562b944ea49975e8ff0e004e089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
16b78bc0ba8906a59c12d374fb66bfb7

SHA1
acbd0b502e9cc4a58a58fbd1efedd6727b0af3c3

SHA256
e5d0bd24ef14b9a1480b86d5c3610ca83667409c9a0cdc377cdc9742a8ed6c69

SHA512
9ced26dd41aa057cba0a45d42d311c91b03aa7133c280289af7494bba8ec8f0a38c3813adbb9f03770005fb64cb923b68ef2f64a3e6de32e6e478627f316042e

Download Submit