3ed8dc92dc9e9be2cda0054b1f8c3a171834a4c43af3f2951626c3bffa9e194a

Analysis

max time kernel
138s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a429fc3d2613f84e7616a2871435e52.html
Size

14KB
MD5

8a429fc3d2613f84e7616a2871435e52
SHA1

83059bc8062ad4df776872260938370a0256b4b7
SHA256

3ed8dc92dc9e9be2cda0054b1f8c3a171834a4c43af3f2951626c3bffa9e194a
SHA512

72941cddff14c45bd1e20003d8489cb79220866866b1b9d7dc1aaed26ec99918a99c1d5380ff72155e0112e49bce17f1841804d6975db42c20d86ef1708b587a
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vdmlKt6DvE:aioWD/ZmXg8SZQumlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413061369"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29895451-C1FB-11EE-95F4-C273E1627A77} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000009df4b7f812f1d78e868a959db8852c8be3b7c064e4649eee78fc79675838213000000000e8000000002000020000000839122b662277764e7dafdfe711febab097939740a757bb67c1f118d836cdc839000000005ea05e8e8f9ae1396f86367b70fa377791e6366fb863c2fd1a080e583ddf3da3fd479fcf2a8a171aa175963d660154918eb666fa08cd7aff73732d3746e4f1b496e4d77e36701e4e3c8cfc8a38a8c67834f71c7b3916f6a200d034cb3751073d319080a68d4aa68e8167b9dcfa1fc3fef059e02bb442c11844e816f51710cc891780846053ea51861b7ab8a84e86b6a4000000031f918438b64915d1d6db51341b3e1b7fd6993b0904cd5bfd6dc8e897a382f766483553eeb93984019922b0cf6bfabce24eba9f7fb9c18a8791d193759ea88eb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000955e2f0d432faba74b44b136b2b48fc6e746b304610bd63b32f325fc150bf208000000000e80000000020000200000009d21b08e0e0b5df3f431489bed1c2dde09aee4121794caf38572df0b198131692000000021d43b495c60cf3e578aba6f4ad252a2bb32b2d1672ac4e2cb30725e875bd09240000000537c17474cd79e4a36542be5cff7693ccda974db3b45e53539a0d01314fc8c65e2b9bcd5373ffcbfd8df1cd8b9eb348a9dbca7aae2705a1cb37a7e81534d48c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00322cfe0756da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1872	3040	iexplore.exe	28
PID 3040 wrote to memory of 1872	3040	iexplore.exe	28
PID 3040 wrote to memory of 1872	3040	iexplore.exe	28
PID 3040 wrote to memory of 1872	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a429fc3d2613f84e7616a2871435e52.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8361ef71be023666117f331381bcd159

SHA1
eaec67208a269fa027afac1e834379c89938c658

SHA256
5ba2464eea57453fe0ddd46fd240cdf533a7ff92ad4b7be98bb08e94f6f48ddb

SHA512
a68d1c0241ac28733ffdb78f7a40964c5798493c9adcb8d50f513b294f860ac2e276646b1d64f9c8a4d33fa5062c1da1a93a0530517fcebafdcc41680badab6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de04e0e4ffd46c583bcbb05ed872a43d

SHA1
95d4ec51617d4367e273e05f5b7ef4966f8afe5d

SHA256
7adc327ba7877d4d775fc9a230071847e037168c9fe4c676b329b6c97c4862de

SHA512
6849ed7ba7c108d7e99d5e1cacfa32545b189304898f690368195712b9c0857fbf9933a72d9ba3a2501123fa9139fb56b5e9dc0bf7ca13b1cd704c4d8a9f5a63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c180b49947a5486296bc8109105ec1d8

SHA1
9a0f1b39410b7822e2f47ad326c2076e7573b227

SHA256
9cd7bb6b4febe201dfde35b943ab337aaa1be41652d4ad65c8f480ee7d35845c

SHA512
693cc781acdc0af878bc8ab0d084b2a721dbca7d7dfd1c289151d29f0339f266a40dca55bcdfb9c453c5d5ac878be84dbaaacd1d8e6b0929e4c09367ef9c957d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2189f7c0a8528a291db5db3fd00f8984

SHA1
ab4b2946b0c4e51c2d2784f82b4464c765c6b88c

SHA256
e19925f44c00c63be67a3eba1c65b7db148b55ac1923431f7edf1de89d7efb6f

SHA512
7dd8ea8f79a6e66955326b74eda28baf1abff586c246ad0b27569bd08c2417056231b81c5536e0deae551b867faa8aa1433246d68d631f462a24471fe33e2c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33701afca1f60c7ee89c40fc7910095c

SHA1
87afb170f50cf15db5cea74343b0541fba843a31

SHA256
06efb3b1e612c0aea459cbbc770cfb31c1e907beadb9c3c92d0da4794923a36a

SHA512
80bf3d5361c481372e48c03cdefc3cab26db65dc2a110e6dc937704c1a1c683dd9737a762cac10430096b873d30d35b41fb5621692e25ac6fb76d8430bd93015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bc7041c9b3992364ff60abfcf185f9b

SHA1
6212b42f1e5acc7c549262b59701cf5db68719a7

SHA256
5cd155c5bdbec9bc3b41e7b7bd28c845714fb79ee0c4b58d348e3f57543e293a

SHA512
febde5c3ba6d2daf2174b2748a357db9aa609fd5be6548b6512a3b40716161cae4c5e3f60ca9e97cd98dcfdb9f990a0f22d2a8d5c6843fd88417589e0d23dac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ac6347ad57e64329afde92364113d4e

SHA1
d934666125f78c5b17b92d7d825b63f6b256ffc2

SHA256
37607e7f2acd329bc11e78fae715114e7b5bb2baf5614cc5e5b7520c70a7c4e3

SHA512
ddd4baf049c3855c12e64109f19463b803b3d675f24703f8e40abf688715284253761c5cd6bf5f2a3ab2c3d091e27081aac96a48aa9f93a3cc35fcf630193e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d00ac4a872b3991d18537b22b91d4d2

SHA1
b9eb3b787628cba22a25baa578ca02e4b58468e0

SHA256
9a95e7a88c73130af25868ba30c15bae2298763e168926b67b4d33095cb68a62

SHA512
1bc79938da3a79badfb2837078a64ab5ba1075663ca743e25b9fe06ffc863e45a79d0d1b3c280859d064efffe824c24ec403b3c654abb5acd4ce9516527fb6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bbe23675530bf36cbe4ad491d6e49fa

SHA1
a501283e534afa7fb806d76e4ca281235eae733e

SHA256
f542feb181164e59a568713821d5229f84e5c800f1957ff312809ef5ee8ab744

SHA512
8e957899925037d76270bdd446727fe88dac8e9bb8bd7639eb7ae2c5bcc3e1bed44c98f5c504938f5c08e43c9f80a167916f5f0cdfe375f65365adb2c22d6807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637e7346b7a84ac3dc40ff999a9b3688

SHA1
23af60ef512c3a2d0a24500235737e3249681b48

SHA256
adb7655dab47de35dcd613c5cd023663d24e263fe48f58749f06b54ad82f6341

SHA512
501fa119c35628628c3d1533905fec8bffb0416f06cc5623ad88ccbd00ee0b7fc6e778999174a49296ffef49cb194e7e65d91bee21c5dc0c3276f99595955e99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e25359db060311d4adef132058db629

SHA1
8e5a46f82ecd20d537647acf647f688e2fcc2d5d

SHA256
7e7dbd706c771a6bc8332d765d9c17dad2f7ea36aac087169a57fbd4514b1064

SHA512
4de08c41de3b43888d9fe5c3629862983f40d64a293efa19972c61847cac4f6c52172b0f659ef9d220374929827d0ad190f72cfd396e0e23ef52655b231c0528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d8212cdef31796fdb34ddca951a2561

SHA1
17f0f9dd93430aca0df5cc9b7aca0c246a4ee21b

SHA256
a73eaf288586e9b20f7860c43fa2ebff7844915845f50923c7132575fc8c4659

SHA512
218435141d62a94daf8e914857ee5de3546850b7e7646069a03844c789a4abf4ea0b97d133807f2d81395b00a65638856ba459846cf7957af017e81cc62c00cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
06cedc89656bd2f617ac263eb2c89ea3

SHA1
eabf1482a12ce1204cc3ea81f1117c84fedb06ca

SHA256
30d569a8291fe875558c5c841ee687438c0a8f468e5d5f116aa5a8459a7cb747

SHA512
97c8c6e26e93933ef3a153c274f2309853f82a1d4da60171cb57808c0eb701c0cd39b20f64572b7b7f3f52f58524823f701b4079010032a46ab7d845e0b1a285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C83.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit