829aa00364f452891c169d790451765e86bd94467229a170bfe336e26528b4f6

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3f9138296891dda5071e49b5eefd9ca.html
Size

414KB
MD5

b3f9138296891dda5071e49b5eefd9ca
SHA1

e67f31e3530275e1c21c9b629861670f0047fbdc
SHA256

829aa00364f452891c169d790451765e86bd94467229a170bfe336e26528b4f6
SHA512

44a3ea35995bf8bc5eeefcac6a346311a20ab799ff0c9b4258bb63cff0ec9a8ff470453e4233e0fd85e6602c9a493dde2b88a8a1c47e301aed13dbcc737ffef5
SSDEEP

6144:aEv8p3qoOkVmhulehW/s0nsvk7qpdEU4sgDvpJakBCBukhj2:Hk7OkVmhulegLnCNposaJXABL2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000a9652023dec7a98c9e59ba043a0924716e268ce81f18c7e392d310df5b2e62a2000000000e80000000020000200000000b2c249e32507d698026a50507fd97d8c42dcbf376bf69ce69c2e03493fd569090000000e059ec9e58a0e28cb53cb0fa2a8c9915d6e4757aed655aaa98312d9a1844912eb3f9c1e5d7b12ac71ebaaaff8de204259329bbe19f8bdc141bffc7347a22c07525ce4132ad9870cc6763444642ca842d4dc30dddc51942fddfd61123f1dd21812be7a66a7710ba8f1d8416eaa796b9c7a4069c540e94bf5bc92213e53b6ca7658df7c94ff6ec7587dc14e5bd7ae928d5400000007db39d0939fb30a70d29fb43f8610050be45d2624e6e842908f1e387fc962ecfebc6ecf1dc0dc06e7037131de941d94c6309c297c86f837caeae43defd6af2ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8046364ac36eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415780636"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{749A7271-DAB6-11EE-9587-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000df99badf30ad8824090f296650be875c1e0b739180984322249190dd4a178e1f000000000e80000000020000200000008eee2a427012c01ba6c6881e3e591adaee777b0979ac11eedda14096f8d0b29820000000e44b4288bb4f81c3c988e3446b0facc3390edb76e1eaf47b577aba059a1d556f40000000101a3d605577ca21c87b6190e0733e172338b35364671b73f7e33b5b4ee55b445bf9dc323cf65ab7790b23471111fd68567a110d6a6b25f08eca83c3ff975608	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2188	2020	iexplore.exe	28
PID 2020 wrote to memory of 2188	2020	iexplore.exe	28
PID 2020 wrote to memory of 2188	2020	iexplore.exe	28
PID 2020 wrote to memory of 2188	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3f9138296891dda5071e49b5eefd9ca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6700787b1cafaf80318fb961fbed499

SHA1
ca3e64c19f94e5b8dabfb2f277eba9c96070354a

SHA256
fd4ab5fc6560be87845a34123b7a6dc27e9b74ecd178dff4f6064788b1ad9813

SHA512
5003ea845973c40b73cf473398e60b18235026c552be2387086820b51639ebb26ce4ac007b1aae3f3e676e2d14bb84e7d2a0bada4050825f0ae3f3b4d1dc93f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b272681d6c52ea47133f115a768b85

SHA1
c4a1c289c9c2164fde9aabc0c5939d3d685f8f15

SHA256
f21bb81c9bb64af614c671cfb8a9ff05d7d5d3b2090c212544f7e20d665b813a

SHA512
17e5648cc3fb271770d7b5250cee6ff64b442236398532a4d117a39ed8360c091a46a327166c7ac53b80b17d57d55a0206ab2ae544f14473389166f878b29c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2cba406d3e63fc19d6ba7afddd3b4d

SHA1
600c0bf63b05fd20207f0a79da741393a21d1754

SHA256
d37507afed9fbd3f8aa62d53db68b3f60af98c94e8b3c997f42af24196809e62

SHA512
b68680243b784c2cf66eb37770ac6cb326a1326f16cd51f489cf6e66a4347d59a27d04ffac47a21368a35c1fa69f27a80ac03775daa079efdd88b76b8412cb27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
334a7039d07ad887efd1057ca733b476

SHA1
fdfa6bc8a203bda35bbb843d93e2e5a2287db1e7

SHA256
c893ba92c2dacb57b4f2c8e36bfc8be651ef1c02ed63889137f07022ce8c37a9

SHA512
301d46aead21b16d8504f05eecf64ccf30c05604aec32cc43adada78cea9dfd82308595c839a5bc3164967250f97bb6d0347822e1eafb4a988f09021c04914d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8240a8043f55db14333fa70421fb6cc4

SHA1
551e1a7a8bc32e0d2870a30608179fb4fdc9b115

SHA256
455d05ee6fee9e3d2cfd3a6bfda1a66a5806f26b2b49a8bcf2ff40a25b670887

SHA512
8ab253df9d56dd18e43eaafe0791b396c9e116de3167b78f4d24d16720992ae428019fba98fb10786074c0a88e0942828ee269fb9e008f6a905adfaaa9463864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8102669117f2463837dd1c3ed92ad8fe

SHA1
331410c1e441ec1dd9e1c4ec19334482d2e0d56f

SHA256
bd142b8e3bb597b015f896508626137f7c79ede6897412ef84d83100c303f8d9

SHA512
ec1d8c6bd1c0d59e83771441509260b89b2af1c80f620cd06af1e41b1bed2497157cfa6a2fdb69c1583a380a4e498d4291f46efcc2973f231b36005c1810f932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c85235ad20233811510052455a8697

SHA1
22d149aaff43a27fc2ad54fb8d8ea52ffa2ee457

SHA256
20cda67cb3aeeff59dc6f352ef77e8a01e62402aef64881423eed4ad4fa3a3e0

SHA512
273e60c8d0983f506f7cee94521fc5d0704813f70e87f0e61bdf6703f75ba779ed8e7337f8559338b9735f04b0f187b11534e3ba299ef23f878924d738611e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b390cd820b31e5734c4e0a1e057ef7

SHA1
737c8a42008940eb4cffa02eb838500a8fdac90d

SHA256
e05f132d8f8089aa9530c5988a9d1f4fb56dd279ffe1891b2364aebd54297137

SHA512
190d07a7ba1826221c2256095ddcb5ca1db9542aaf5d99993d64c2484318a7f59a6e54ba4849dcf68539136e8acc9a7ce2c776bf6d849d010de149d8439c0392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe279baf21bf0fdc93f36e49d703b4d8

SHA1
4ddda127bebffa19cae83d9ba65e77a05096ddf8

SHA256
15d64d502b93ece3dc75f46946c568c9e8b63d4e8ef42a9e34efd55f6bca7aa4

SHA512
1736ace4d0829cd01dd1dc010ec82ce2fb2db00ea8f8ba2cf72b2616ae3418b0f576e026ef205f28e81c0cf362c7cdca238a40caad810e8ab447d84e2f1a4f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4374703816f3074be21861b3b648fe55

SHA1
72fddf6330927d81fb7068483a59755b9befed7b

SHA256
7089dfac96990bb48910ad1b47f7090277f60cf15ecf741c65fd99062efd838f

SHA512
322cc035c55f75faffc5d1d0087963d98358f5435688220cbc0b7b20d482180c1be95142ec5b4540786780d965d8d53fa9aac5dc6a3969d0379d8e2c30cd974c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d03317f7b1f18262fe6ab978b0cdcbbc

SHA1
e7fd1678c827c57a8f85466f0c8f6bde7d70945d

SHA256
f2b53e20dce07a4e728509733ffec32e6245ab0267bc48ac412dcc5bbf91e885

SHA512
734039b75e8dd9c345f5591cb691184d725c50211c4aee99f66b9a1aa3deacbe1c77a7a916dff50cbfd6fa8e4e8692bf1e873dfd4b1c37e34bd1bd9757996a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AF4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6B73.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6B87.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit