c38f1fcf1a2d5b1cea2d24d47afdc38ca6b27e12436b94d038e0859fa07fd2b0

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/Contents3d.htm
Size

1KB
MD5

886737c6f3ba51ea560dcea8389acbf9
SHA1

308f59cf4af6381b3f92fae582a961a88ae80934
SHA256

97f3d6858cdace0e9c469236a0375fee14e6946f70254bf9b94497c81a7fc0eb
SHA512

cc89f3179d71a4285541e2a4c92c1c46c772effecbf1de2e1cd27de0f1a7dc78d4f19dd86f5d47fbc891f4d16fa275d3bc5f1320cfea4800b66b9343730871b5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c678ef6155e34d62e8b821706fa9769769c6a00554e080426947ca6834da8c62000000000e8000000002000020000000711c3cf52070baeee1baa3638f711d9e9ab1ba61dc140816880917a350035f7f9000000005988eb2d87f963d5cd2292bc13222df632c73ef08d20ea159db3e7274a822ec2e8f69ff19ff82b5650b5407c26d70ca55e208c83d7ca2dee8fd57256e1b1a24e335606cf5bf6b9d5089f64c0089954691642e76553ef04fc4591b7e74b10d09a5e02f1ff21e6e3f5361e82efbec7c49b36fbcee70ee3dbc9fbc1b248c952bd8d242c5fc9ebde91ba8ed7854da53149b400000001c2cfffcab4fcbfab92af7d608eb0e51c3ca6d479c7a0aa31099fcc07111b921969f3efa21efc024acad2fb264aea4a1052bf4f39da4ba8f7dca2e0c478b53a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9080c66b045fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414049390"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96B74C81-CAF7-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000307e9ed8b45c75015f4d866afc30695f79cdf751389c2466c40989836fe8dcb7000000000e8000000002000020000000bb156982dc79aff20fe8895954e9927dcf6b0cd40c51f3bef85e3490410bac312000000080538da98e0abf8cad030602bdf07bcb48f2f6c14d6219ca64c60e635c43da3640000000a960536855b10bc34fcf40b13c3d07a021b8f5237b575facbd4a06d3289a0eadc5568889db1d05bf27a50495013766dc35b2e76b0a0aa809c3766b81c77b6308	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Docs\Contents3d.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af30d7f9f0b865d6a3394f7bac576981

SHA1
db202b9a4ab50b499967fa3ba9e662db7026993b

SHA256
5b2c6a11b805ec37fbf2469fd716dee97ebf770b26a1f49958e536f647ce44f7

SHA512
a48fbac7673da767dd333c9d108df948fb0a2e9fe87de1854eda33f0546ca622bbf96c89db61d5b7257544bbff8ad665fb62c7f243f4acb113c3d5afa4a0ad3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cac02ca2e3e5b067a571856b99a4b2f

SHA1
f582006cf519fe6e44c225cbd04ca0cd2b33ed90

SHA256
9557054d997ea81ac6d6faef888cce1d5859f83d647966fa982f55c336adbe6f

SHA512
7e42264b0dc95eed7a24130b2f82a5132639281aeba399c4e7b03e1c6d314c832569fa9865442a1749e7a41b62dc36339512244a128198a7294608e7475c8457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed5a35b65b4cef1e98cb114a59c91249

SHA1
b17beee574773fb698a56d6a2a0c276c38b562aa

SHA256
774b32b2bb53d6dffca42cfcb589a2703ec73e08542c9ec8b1570f7f7a6cbd70

SHA512
f306d9a1bd3bbe050f630628d142f2ea7f8417e2ec375e8ff8135d49610b445ca398f66e81016d6e021d06a6df65b11bef8cffb0bbe94c278ef8ef378a72fbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df38a5a247eeb10ca9f0b9870d510776

SHA1
7b5ec81a5c4acaa07dfbebc978f55cf4df207f0a

SHA256
400ce70dff1ea85d922cc929040ef77a5486a127157bd9d2119fe98f44f43913

SHA512
479e7865eab7550713d14d39fac04e6a7475c5fc6b9ce5e1dcf7be641677535f5bedcf50ab719b75ae5b872bb0c9b482f0a5f53edd86fa15f17624d5b7606f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6200add39a5e15d8e66a59e4a41e68df

SHA1
cb5c34b72df82ae0372f2d31518703209fdece47

SHA256
97500d9b1147330c269d85ec86f8f3b3e4bd4bd0ad4aa035d0f8f52ddc2f2626

SHA512
21352eb72cba2153352002740a7a4053f9dd3009ad41d80b268c15f88bfdc3586e6675b7ce6d842c662b3bf71ee2262220ce5f5a8d29c914b326354e27d1c4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6208aceea26571e75cc2273d10e1bf5

SHA1
ddeb62df343db76c17f5977969d16c490aa33b73

SHA256
b6e4be39ffd0040883a7fbf29a743ddd617997da625e7a1d5e8af53460001f54

SHA512
60fd0fbbfe0974ba331a8ec4ad63bfc61b7645748cae7b6f90339db3ccf75cd8f72ed706ab95b0cfb58c57049ba25ac97c28d6f90f5ebd5e41e348f6dec6aff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1f38d5f4ae5fabdc2bf1b6d8922a7a0

SHA1
6acd83fe5dc805ce91b326c5aff69e5f3e442873

SHA256
75ae7d629c69961ca608f6b7679505b64cb0f7cc3104b881551a8cf99b73e39d

SHA512
b4382c2686d5cc21d5912c2e82a96c08b556ee81ec243cfbe6734a00915ff2110dc688e2f7455aa3810fb6e201f96c1fbf406ac9f9a3c733046087ec90f7bdd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a0a3c312ddd8b90a88e2b88111e47ea

SHA1
b5c824247080c2c945b8ca844349cd4ddc088e0c

SHA256
d23e448c4336788824e602fde5be6811899628814d4eca22ccbb54e1e7e1c649

SHA512
8e29c5508949356fd615bc91666c41dc49e0b3e5b76ccb76daa20542dfc8863f12769422563d9a894bb0c45804661161a15ce7b923df630375e66c6c6b44ce20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e7620e616792c986cf003cf0c31a21d

SHA1
1bc95e4dbe05281014ac055c75672b0438f46fe9

SHA256
ca08984fd1369befb3713f27326ef4e844ea79478cd15120e508f1370cbc87c3

SHA512
7463a8622d07e874605eca91e65b3c4e35503b7bd511acb5bfa9f65b8c45e71561590fa1e9b7dc6cb1333941e8f0055f3ee37118e33216b785e5f4f40bef081d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1fe4bd310958e75f85ac9a242183b2a

SHA1
d6cfbd82b47a209d7ea50361b69a5036949e04e0

SHA256
987e787a00ef0eb6785de5e85e538b0cdeb7a9ed8e6ed896b0c25219d457e046

SHA512
4c651df1896433999515b96c82aec345ebbce2f28756384770c108e18c3eb4f1b9c7f07e24725dfab892fa404dabec9c1753d2f9747bf9d22d49c285f454d6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b18eebba1cff263b126a7c61d6f7c4

SHA1
e349d75be74296ec503808d7e1e99b52b3189b11

SHA256
af37723a44d1a2c4ad9f39991b8e00ebaae1e2f02ff075706a7eb95274c855fb

SHA512
d8dd7029001ca94c19eebc2d73ff9a37221eca8ba3da4645feb64709abc8a089999de728cb843730c427e5a5bf195eccec64e4f891824c9cab5c13f64270a9aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cfafaa46a6cb9bdcead700d7b2fc98d

SHA1
78961f31d2aee0e043f249185ac76c2ff96ce13b

SHA256
f3a8f52bf1b2de4ab3c10492d0b90034d5157b3c78de4cab146f2755041fe5ab

SHA512
41c5df1b0e4d7b2bedffa1e3f2bc3b904c709facd16a75a5c4b406acd8781fd10bfb7591cc571d3b6487d04ef45ed4c201e39bab8f0b592b3c8247663f01968f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8caf54d815e2a71c1f671cba4ad5b4f3

SHA1
9a6866c128775070bf622258799763fcd4833ee3

SHA256
1a3a1938c8682998ff2867f2a8e26094afe3bee17fcb984406ae6878929c018e

SHA512
bf3b5b3486d1ccf7ac36d8d98345cdc8531e9d9bcce1ebcc2dbbb415ceb0ee2fa1fe7de94e9f956325794d542415142e37c9e7c5519bbc01523e38a62bd4b6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e59fa8873fcf959923c7c4a532af16fe

SHA1
4b0cbc2d179b71ddb1c9ce03121f323baead509f

SHA256
2b646c70ef7e12099f48b09bec9557145cbe4690223fd3f253c87b1cf45e4e7e

SHA512
21d2e06405c738d62024f0b01ba3a64de3fbaebfe1c527149b11933851bcc4314f50171d95adf86a62c204b1226370aed999ae214260ebe6281375e2c54cdedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0265c660b3fff8800f39f9631e9961de

SHA1
946fb839df2c51b67cc9e74f1ccd6022dcf4d201

SHA256
8fcf2a619e84560f498b6f8c562c03cc11b0b17d10177327463c171b5466c5ba

SHA512
cd41a6516370f61d69032f71b3e30da3331660b4708adc4b62953e5a99e272fc10e0302f857bf26e162212c20443dcdfeb07816892c64d1ca3ff66b16c9eb821

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab736E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73DF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit