31814e8fc1048b58ceaf8d0c79460339710e46896bb168da695bae29b33bc926

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3a99aed21373abf7f7d0a84bcaafca9.html
Size

16KB
MD5

c3a99aed21373abf7f7d0a84bcaafca9
SHA1

28f326cc84dbc867b6fd002526080628a42cf706
SHA256

31814e8fc1048b58ceaf8d0c79460339710e46896bb168da695bae29b33bc926
SHA512

fe556b8a2aebdccb48c6627b2b21777579926e231c5b787a9690325612905c07d4a8518ce5131ad40c0e3ed51c8be2dc66fd73d2e280046feb0a4032d95106cf
SSDEEP

384:R/3EdMm1QvOtOKRbZmrI6zzBnqmb886gOUPBXy:R/3EdXQvOtOK9OI0zBnz88jOUPBXy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008bee975a55d23059b2b546edca7d93e4bc8a914731aa4ab9c026c9b7b2ab1f53000000000e800000000200002000000024f3e63eeb69dbe60c5465ee2dd83df14f5ad8acebcc55e2f73e9e574f316d59200000006677cd8d18c7e54e3e1fabf8af4b2efe34a5df653a72dd0964095d64931f3b4d4000000046204554d6134162376ce5e7f2b9a9d4ec24d20dd3d01b9d74a055d63ab8460845d1ef73f5d4d81b692b738a345429265dd73249565d2ed2824c80e401239653	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000cc12575b377594cebcb5873608ac9b93a56c7296d9f1be4a136cc8aff61ae607000000000e800000000200002000000032adc6cf20e35537c1aa37d4c2b53d8793bbaa0243a9b40fda7ccb7b01858afa90000000412c2abc731ce7f5e523b80766f712b25075dec571231c51ddcfa713841c4feca75818432d331ea397f85e3265ddfd0b336fe6e25d46f5739eb732cb10458262c062a51fa885d6d3aae3f30ddcc9f4f3e9e3dda99018a8014d5c5194539167a303688a15eda9666ab8a9c78ed58857b3c887a10cdcb66f078882aff132007db420de68a4d99232ff821c2cc12f1ac79e40000000fd6301f6a1de587b76f62366563e34e6fc533942cb17bff308dc83a4c54de13d39c3a67d947a21784b4b285f5e96534c0bd1d0db5833d5d73e28b092a4f1c919	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABD6AD01-E081-11EE-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416417673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09119838e74da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c3a99aed21373abf7f7d0a84bcaafca9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6f8bccb8c9b6ef7bb72ff9c54094d97

SHA1
23158dd0c309c3ac69b572ca10372b90d94dcd6d

SHA256
08ddc6a770413997dcc014c3fd14bba920fdbe1c8e5b9768bf90b114398869bb

SHA512
e8cf2db4aa1e3436f1090345e69beb119f79f66058b0747222aa4b2b56bca26731ddd95907addda59aa2125eeb2af445126c2a7305caf7c56f610cd44a6127e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2307dfa0365a1d11a8030bad85e86c26

SHA1
164c78616ef53dbe769af7b6a1154cbafa8ab8cd

SHA256
ecf47d0a808505ae1df6bcf13ad8043b54a057753431ea75611c4d1fe7a9210f

SHA512
0b12ef93ebcb67996725d4dced1ee733f8933c4f0685cb686124722cf493ebc67be051cc7874fb71ca5d9f0babec39d8d94382e2b96ac6eedfb6a0cc58bf6688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6567b6c8be093773d9a2a9a9099c87a

SHA1
168dbc0d04515f221e7d69f8267104bb579bf6d1

SHA256
03d64a89ae4ab3fc433d905d816a7d204b9b0040a376104c6c8d9a5f3fb57bd7

SHA512
88ad1d0d9d33190c08fe9fd67977aa7ae66ed55a5bd2b1b3b9d3c093a58dd0e7c8b12f6f7b0c5233f8e9eb7aca1f475aa710afc2e70064373f95e56583c7af32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a97a5aa31fc8e01a98b8727092f9c0a6

SHA1
598668dfb7357193d50552a9095c2017ddf564ee

SHA256
4d47460f39dab3b508b12f7dad10ac021b95eefa75e0c3db340addd1ba5be84f

SHA512
73a5f4800889e33dce872ef000c61d8fbb7ba6cf2e1b1cad3508f6d3e2ccc185a17eb85521b2e5c0a759d6604b24e2bb9e89779f308255b73a897344c9820a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36db1d520ce04cb1c21f523a0ea33543

SHA1
eff5a6b6ab05780e035f4df383c6e0aca30cb44f

SHA256
792d2a82a1d83a055f7a61da124c94fec6d988bd1bbc036bb67507d2dea6ae54

SHA512
ec5bc928cfa64ea29956d264127689d39918e05d2e43be162cd2ca473bebaeabf2008a74766f675eeae576d39c2f4aa4642a7bbb3916a536857cf83b01cd5ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6792f0ab8936a378b043269503fcf060

SHA1
ce15f03816982cfa2cf0c9e6c17404dc98a5ba90

SHA256
32b28b21d095dc2c5a36347891fb74ae22aa8ee4debb668da95acb8bb7f1d0f4

SHA512
f4d6850d611694c1222a4ef24a354afcf9b42e1b1fc50366aa5b45949eea1872c861d3510cc3a1b6ba9cdc6c87630da0bbc62725337e320f6ce17f2fb8842bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b139c58a6adfe6b0265c64191a1a40b5

SHA1
2273c58e9b0dd78cd520b41d855aa39a671ab4e0

SHA256
0ed04de643a11fee08a3ac2b4f7256c89f8a23854cf7368f41fc1734f877bf7f

SHA512
a04523c8111cc148f8b890c26167ca5ef88ceccf4626369fc93ad1b1c4f240c7298e41a9f1f34d98fcc289daf276275da6ee54def673eaa9603b16ee5d816241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70316eb35d16f8e42f4c288ce5d42233

SHA1
90d8847f5256488c66c1f615d18ffb7392cccca0

SHA256
ba7990b3ecb70641d64f35f1aac4dc378a820cf44065ea4b1c952d28dd6df0f5

SHA512
b703219dfc139f0a8cbc29c1307ac5f5ae91b880d99021a01eb0864cdc0ebaf65b5d7b70005ba38c70d07bebafc022a8810ae2541023faf3a62226d3f9efd7c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0ad957b785510a2f58a46b50bf52a2c

SHA1
980481e27d544f58ec105efee2207cc55ea403f1

SHA256
e6e227d7f06ea9222ae1beb441a445c65327dd5c891b8a14d07c672eafbaa149

SHA512
4ff3bdd24c6397f8fe969249e29aa0e500cb2cedaa6d9eb6f86de436f46b819d6f0585c6688e5469bfd7049adc109a15ca2d4dfda0882bc0857d798cc805d119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35d44b3b6e8aa5e362391bc8d1eadc65

SHA1
b2ef7120919ea8c795f2eee694f914fdd2672b01

SHA256
1b8200fc9084105c586b06644c5f72f816b09c40657c242ea1bd5f8c32d3337a

SHA512
53383a0e3ceda2f6a0a9fc8f19e2baa717cd9ac7d49797cb02943bbf8e3f8c67127673706f9f47450260eba38817176afea8611a4e231925902eedf07d43a34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3c995e2cd11252c66bcd77143e5b97e

SHA1
cc2b5d4eb3415e1f36249053657835a60e9efee6

SHA256
b0490d27ff37103db35f21d4f0059ba92402e7bca0732908a1d25212edcc446a

SHA512
29d156d3f4978cf1bad9746d4c3e1f15828766c7f9f463e1540faa4dc9e3c400e2fdbaa632f76e76dc7feda1e84cda9585b1d796afeb753749c493630ec87b4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A7A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit