259cba327b410e7d981dd0262bceb67f4a0a255490121001b40c21834a11b396

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c3d307d501e00335657bea1d0d889ee2.html
Size

1KB
MD5

c3d307d501e00335657bea1d0d889ee2
SHA1

9caa540d6a742f69c2ac8165bf34fc0528935f78
SHA256

259cba327b410e7d981dd0262bceb67f4a0a255490121001b40c21834a11b396
SHA512

db7792dde538d48ee1ccb04436217ba58618d188505854643f54156aa06d0c2909871a9af66af25436745ad476b74fae32970827bf8093d58cbd4ea4bc340c05

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000007f0d0452e66ef1f77b3cbef95a7ee1616d6830b27ce244642ff01ee5fa992a69000000000e8000000002000020000000e928ca22a828f5493b21430f5b9ca145951861998f48c4a6432f757c7f5dab71200000008dacc7ee832dcdd4d9fefbf006fbe5696f7cac3de5e82ec9ec26dc8c31cb618640000000b76c8d77caa0026ee630a41b6c3dbf101c19909e105bf88d8bf5fa5be6597d7736affd4f774020b2eef4c73b386c7c867cce76599bd02941d38a1db3625933ff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8061389b9a74da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1499E71-E08D-11EE-8E71-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416422862"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003c5c5e39da2f8931ad6fe51dde4bf82f66132de0b24ebf57111d8150c8cfdede000000000e8000000002000020000000fdbe91ce1c44e6d74580b9e2d256120d6bfb8e81f28e94a90cd5150b56a0ef3a900000006d70432a93a4585c43e9e197581635fe4864fc786089e3e792d94fa53e3b98e82d944903f53135cf424ae9979df9c192c4252d295b1ee507145c52019439d5d6e2bfcb2aaa3d640761ad8ccee558a6ddbc971021f2c1c443f58cd50fbe33ec73e82cc635183fce420bfcdca846a63dca7ca8f84ad4c249afcc58038cd06d97b4a26b42e6aa1f9f0ed3f99749f6d4e1ea400000004246a0f56b401cf7cacf71ff9c9300f92d142f5bfcf8d454e9bff0a06ad526314b45158c3098855f7dfa8b48315e876460469b8385292a46afff17820cd30f0a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2004	2248	iexplore.exe	28
PID 2248 wrote to memory of 2004	2248	iexplore.exe	28
PID 2248 wrote to memory of 2004	2248	iexplore.exe	28
PID 2248 wrote to memory of 2004	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c3d307d501e00335657bea1d0d889ee2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d2f1f68aaa1458374434e3ea969c891

SHA1
dca210ecbe90ccb8dfa006b704001f4e80b98742

SHA256
5c4e40693dfeab04e0c727a13ff4b498dce44fc4a17ada963bcbfdba425c3ae9

SHA512
d25137413ddcbd0d1b10fd1328bf993c2f931ec91e086b0e7794d1a81b24eca35b2fc4e7ee215bed57309e53cc64014563ddb97cc4a96725f5a9f4a682be0801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7294024ee20d61a8d9e65d854b09fa95

SHA1
06704a2b835590a08c2f8d0c7e4b39e8edf521bf

SHA256
c067b398b7d9567e6b3de62b179501da4d870af4d1dfa25dbab4ca5016ffec2f

SHA512
8d099a1f139b10f063017d7f4d8c805f6a700bd6c9e0114c01e1520cd1a82f8aac3ea513e9991114415492f8cf036ead830187ab1a2ad94782dfb21b910d5912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1853b6c27bcb361d7390754d5c21c72

SHA1
f600d417c0ab4f91d330a4eca4ba1bff3f13d1f8

SHA256
b1cc940774d263fb38527914aff2e8dcb5709d75fe912b8d2a31a2d4f764a0b4

SHA512
9d2e839a455e1b83455be686996f041ef897cdd2b111f34dfe0449d36374fca6b7d8e3b262a6b46f09bf65d436e08546a35fd59c3768d8ca685154d9c349778f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24be035f45285326b1ed1bc8a05ad056

SHA1
9e0315a1ab2e59133182ab749960085c55f35b5b

SHA256
e49a24379d8e4eb3c3c0e151dcbccf6eed6cd2008f2d4721c97e6065d56fe1e1

SHA512
a89ade01c8592ad3aa0297d8ac26b1940df18bafeb751a2958a19d7bcab6ddd17b7b27b764b09c69bbfdf57ecaadf6513720cc6cfcf6f80c016ea1234553b54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a451548450852001e3d4193fe7551a

SHA1
0d7c556f8c7f40589e06bab50561cf8bcbbfaeb2

SHA256
d05705afdc23db679430801e01531166c5bde865a05340c31bcd31c6e1ec3244

SHA512
8abff3be47129dcea7c9622591ef4acd456493f8e2cbfd7fbb266455bbc2bf27df16f78c4cded1bf2c1bdb46a2d4693f19ee085f930f16e1f0b56857b986a4bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18c0c6fdffd45ef1abf8593669c22d07

SHA1
a896d50b8397de30c452bd4429b36e7ef2265d5b

SHA256
a045bb9ec6b505c96fa8470106b012208c9dd2de7b2bd31de2685dd4443e688b

SHA512
3ddff4abeb64eecc669b739a3328753382c430d8ab885c210dd4cdb343dae454b9a92ec95e78201ae7330e768710094cad3676d20df816a0fbd03ae28b6c04b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
266f002204ac3589f137cd948989b054

SHA1
762582befee8a42cf403e616fa3be3111cee799b

SHA256
16d5f0c2cb267a3b86e6d60025dd08e4e53cfebd204c6cd9d3a82241c3b286e5

SHA512
36d8740d3c54eb64b0a9de8cc21284e2a2b93f57ef08a2ac726223af979da8edce12653ecad7ba573dfa7311d81c12c3d939030d3f4a25c4d4ca36e17b51f24c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
647df5633163f4a15c2055a3759defe5

SHA1
a46b85af8a03af229b1e57ea637e301392033779

SHA256
0e2d3f920cd0ede034448362bfc8b7061a0322bb935a60ea60b6fb4afc25fbf5

SHA512
dca6aac1e5ce787e8a8494045a741b22cf752e1d91ab0ec103891c046ddc6974d71869d2942ceb1460762a3d19d7661cab7c33c93b0c67b4e869c5d0df0aac8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
885bf599bafd93643e140bb070623d16

SHA1
9cbf5dda0563546ca12534c372adb746683424b3

SHA256
3c8e4da5032ffa09bd02793332e38d1671b287f3c14b6733a96f97140a56f4d9

SHA512
e3845c03e4616bb8ed4cac052d9334b6dd5873f4a3692c6435ebff84737a8623d2c4c75e237ac156b1d5b90147083ed113cac23f9a2cd66091090b38b99c189e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f6d7404b75e6b55949dc258ec947489

SHA1
9ba067fb0d2692c98c506981583872faefd4cb42

SHA256
82f29c4d3f8275afcefb4ddc86d6130f5e7ba73ab529864be2fee839b83c175d

SHA512
d2577cea168545ac11ba5580b3863665250c1fc1f6295fbb1182ced8eb4aa0000319c40491c5516106b7b7df8ee38d39f65013972395edc304c1cf84cc966540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3468ecf640098e1c69bc78820dceebad

SHA1
778401bed9e7e916516ee2bae4f5f86c7cff3d70

SHA256
d1f6658af0d0d17b33c054923e3bf560481aaa66a903fa1c2af8959b0b465797

SHA512
41c7bfb89355be8389d444c3ba83ef39f588318f252f6f2996e8e6942bbaadce45c95bb7480c1429bd0a295fdb95149fa04d435e0e786775f680bff8b6f9e3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e70f71dd8dd50fb6b4fdba134f1aa58a

SHA1
3fb37706a174e32e058b71df31b2f2d60925ff55

SHA256
c2e11b698388488871c32d99999e225fd1880de493f41514dfecafa585060dd0

SHA512
8ecf26c0006d3da3745bfced5c75085d416790c247aa1d319c0dd3d8a9ece5e82c4a778049d1a5f5a0f0ca2af29adcbe2a312c3cf8977d12cb7ae7e5d8e36d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b273d7ba9525ffb57ba8a5ba171a21cf

SHA1
4580a86c7be4ba8932810e07049bde532ecdb1d7

SHA256
7bde82af1653cb4854cd20c88c543fc4712e0098322d401e802834609f1c67b5

SHA512
fe04e42893b9ab93a207b8f5d2e2d5e9166e19429519e6929855653039e611d1f5b1e499f9adfb491e7fba512f7acd8ce2c2fb0443dcea5538d13705d2f4be0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d04f6f986fde033c99bbc4a3e74720c3

SHA1
389fd2d28ea8f3bbab43c53a040412239dc28711

SHA256
32297e2d1154c2404c0eb49f2025ec9b70a4ad4bdd58aac6c2b9730118795e7a

SHA512
f2c71bb777a489f142ecf910178f4754d10cb68936dff88539bd6741f81a74e647c8c86207d2bdcc9105cbd98afa2bac747c4772d75b3a45e51e34ae686746d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85a8691c893f8b37e79c25fb93b52a9f

SHA1
366e2cfcf0fa3e7a49d45cb2df3e33fab88b423b

SHA256
ff4f6f6037b144c6ccd10efe42cd2a76d001273475f033664f93e45208af2409

SHA512
95ba66be1c9f0bc381e8e9980563b3a6cd7a21e0ef033ff8ee28715683b988844ac7849d4093ae073119bd4be0a48121bc0ef59b6eeaed825f2abc7a30c9df99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6273c14a88f92c7a44bc72a48067f26a

SHA1
95fa1cb1d8f2ebb36fb9c9e2278a5dcf43102f9a

SHA256
703c7a27bf350e5ad957fe7fa92e5daa3a7652d7059f11916c380cb2fee2361a

SHA512
6a06c4932c8ab5ba7ef2656a593f63679c07c29a50666036ead78b2bb43ef2308ca4a5f078081d1cf967727ce0b933b040f97f508e0e181c9b52524d4e311e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc8b7a8065d7ca315f98367d9bed96ad

SHA1
34c9ca4339e67abe4552bfc6d777cff00bb4a533

SHA256
1d5911a3e226d456df9a6c6204ff779678414ff43d2be8c4ad229e8159393980

SHA512
811de5eb481690bd16fe5e5523954fec14da77ad713319d4dca0e564126b33c468f1324b15b48f8d73a5256ed26977acd7c3abd2423518f6e3bea9b6612b7483

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4504.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit