df3c1599380390e3546b539ee5a8445f63516c69bfe8503d1f0d061ac418916b

Analysis

max time kernel
135s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

page3.html
Size

2KB
MD5

cbc4e35f9bf460e0c3fa896fe7d596cc
SHA1

3cf056e0c6fd6b05530a75eef7115b92b1fc754c
SHA256

1e536feb1cfa03c6a05681e54b03dfb05b9ea1f0a33e367dfca84d4c31ef5a57
SHA512

03b87395ffca7a1cc54575e876f2f63f3bd80a5bdc86bf53f5983815d1b875d319de035c34d9c576a465365eae8bc5bbe97184f8ca1d2d923d0bb8c732cc913e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005803dcd641c4344d920aa6c0f8a64a8100000000020000000000106600000001000020000000db3b82bf305a10ca201cfe034e70ce64660775bdd003771543fe3ac2132294d3000000000e80000000020000200000009e8052e7634807860a019364ae10558c5d1f0a3b8ec0809d7edeec7b1f98c95b200000007ca6efb29769a8aaf8c73512375a2ee960ebd5e3e0224f4e41b69541d58e2b55400000006ad8d74f4fa794181fcc4c90138110988599055cf8264b3f5646a6d64ad5d766864eacf35269dba728f6a59f0c240df65d7b5e1703da770b15688ba3b3e12a60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a069811a3b75da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005803dcd641c4344d920aa6c0f8a64a81000000000200000000001066000000010000200000005b137d83249c6b18de862a77a0f581a971b9e060f871fabce2ae2a8bcf650237000000000e80000000020000200000003879840a21a5c498a2d239202a0e9d943c0738cd7c88ddf57dbd8ccb80189ea690000000c6401aa75fcd02ac05a5ee2549d70bcf1d515a32d0d19b26e846f6e9d66b87cc470ed1c04d3936f93be5b8a32dad6905f3aace0482984a59865761373c41a9c106fbb5a704216f824e71044d149c2f8dda2496aa2436bea388f5433cae1403f59d6d3860d25c3e12d5d8598e504eb9d2c15d6e1deaa45a5b9348b394e80e4475cf23618ecba3600dded524dbad031aa54000000047bf716a49c15159d5e3e510e3e837670ecf3b5c4954cea09a877f8e2c3325492badf583a73416b4f0499fd5b78c3ea0181140bea27cf0b58ca47d9afffb1b6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45F9AD41-E12E-11EE-AC1E-72D103486AAB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416491804"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1712	2264	iexplore.exe	28
PID 2264 wrote to memory of 1712	2264	iexplore.exe	28
PID 2264 wrote to memory of 1712	2264	iexplore.exe	28
PID 2264 wrote to memory of 1712	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\page3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1cf8d9cc01b52f05cdfb9bc69169da5c

SHA1
55e70f7c45356ede1216f1727f0a3fbd3d21e707

SHA256
3ebc898153b04c2b660aedf137a09d22fc66f86e3c43816a4bbf8bdbc50cdce6

SHA512
e961dd4d6115ddb4971b1d780225fd7d8c94b7527a143a683603b653f1f3bd08d392e34c21431047377ea8ab6b8ee32d82817d3fd764bf9c8d31497b3dbd8cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25e7120427c19ba00b87b1cfb53a6bab

SHA1
2479adf68de098e94129cfa0d1f0b4e205f31b40

SHA256
2c7dd6a0d426983cb601d766de99dd1d6853f2dc85b6b8d45996543ad2bb0742

SHA512
269e4a298549b81d3e96e98ab799841d34c4e79049e13908a956701e0a27862d9a0bc332f874b669c7fc94ae1d7d67a06469ed61ed86d073b360527db0d3a32e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be09b76c3d3e5e51a953e7825f3370a

SHA1
0b051dae48d9c2c33e1f284df9f33a22d30e1344

SHA256
caa38566d831c3f705444f5fa14cfc858089c76927da43de7c95bf93d35a931f

SHA512
080714091e4d25555df02ffb8cb20ffdccffca34cb289bed0dc3a52bfdda421b12ec1076ab3d511b0a9797d05b7611031b893724e94ab133f7e8ab4e9651d26f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3163216844aca0b98f009f0e53cdaa8d

SHA1
1c36ef1c28a40c42672f9cdd4480f005880f2c56

SHA256
99f652b88c857092d87fe43393073f3372472662c8a6a00654f5ab7e1076fd20

SHA512
a147b0d39d4b0fc371ba5278046135f28329be57546e81c9b99c216296013dd50cc5c2fa0ea529ceafa4773172d9c53e02d48e1939a47382f5b6bd3beae7f28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
117366406e0d945c30bcbf6382a5f604

SHA1
3c34353bdd6c3d9364b49eb23b508a8ccfc9419e

SHA256
4260fd09cbf5daeecf5255cf387fbaa064e8a36849b557aed774bdb905f56bc5

SHA512
f2a4abcaeab3edea36bde5ebe1933a5094768ddc3dece2783c31dc8036114774137d04799cbe6dac7d348c9047b6230d605b07fcb7e48d396ce39a473327d076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46a486d5b30cfa39aa57211d485dea5b

SHA1
117e16c76d95a779803f6ea7302f790f70a6c797

SHA256
653628863984c1415a88ac242b7ff4549974a130b3c18724ba0ea0e3e94358e7

SHA512
880a9604bd8e1c0d1fd2d82767af9d774612f60d551139213e32e73e67314066c7e65ce59b14402e49ec1b7392f968a50d24781bf6ada9342ebcd1c3728e9a1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d9bced590c37583588ccbc4aad2a46

SHA1
adbdf09250125743968e1acb7ba617c83be5fa54

SHA256
31ab136aae5a4d1225431fd8406fd54a133d3c2bdb695a94c22a9f864c809924

SHA512
58748b183c6a75a2e8e26ede9d02eb6a75bed69f4019e9fa5e1c37da7ee32ed571bee98405425edfdaee730173895afb9a6739e84e450fb3dd155edf2aeddacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc78199b326bc31ed6764441f3db1db1

SHA1
eafa80360af403a520144cd7aaa35e23f822cdb5

SHA256
a7be56d818476a4a2f0b87500f66083ea3aa0bf654a9cce2922be94ff4a9cccf

SHA512
03dc1204190a04c8d8df846c836cfc7de2aa5914764978d09449affefb43ca13f3df3f0d71e58388e1376787e7e6dd70e38c9ec9e078fc2c9d89338b4465675c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d2a37da231abdb665d365ef477e092

SHA1
284c8f1ead2a4d1e2b871a9e0c013da9746c701d

SHA256
bf486ae3dcdf7693f8af1f227db2bb4707fca10e74d4d2eea572834a3324353c

SHA512
a3f704ae1d7146c7f3821a33376172f3fb58b842fd12273a63e4e2f5c95d2d7cf2ce08587dc86075d2e4f4a0a9a1f899c113c083858e79f40083514676317df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a16a2497079f6f08ea00741e7a5544c3

SHA1
75eb8dbf4987d6afe1407399bb0840c2eec4f3c9

SHA256
be2eed01bf186140b1c505336caceee120bc295888cfcdcbc2e4dfb4cab735db

SHA512
03dece74f13ac12a3d319c48727c117f0ad0cf9c820e1f3abebab69563addf30202b8c9568473bc8ebfaf8a089a25e0726fe206a811d1527dc57402496503fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
483d60dfc68af8836ac0d6aacfbf5a64

SHA1
17afc0c46b417b0dc9adc136913000130fa5dcf3

SHA256
8e724c0836093ea87a941604cd7cd76ed7cd7dfa38199b382068c315728fca36

SHA512
7dae16d7f811fc6a3fefa2340153b2a9ffd45b93bb722e5fa1f331ac29d02613dc47926a7191ad8d3c9f6073a6deb9745689fe26c5b234315e031d4cb211dbf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
439494c5307906b53c9da27730b06f70

SHA1
4938af14a9bac86ddcb4ca229f4ae61bf9e6b2e9

SHA256
202adc13fa08f7f895ea62b711d0ee11a760df881e96b2359d77adba96986665

SHA512
1fc8c865f1957a8db617c9a5a7e499061b5da7a7044843c782bc987158f0fc93c717603ca9056e00c68c6f87cdc0ef667305e3cd5a031dec8049184b44158e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
298abd994cb41780d6a62c723c52f943

SHA1
6810bfa80cde9b2804a89acb2c6d1b626ee51d1d

SHA256
c3de424f893991d30e53b07ab492515271343215575e5c33de6fe4465019a84a

SHA512
212f8463b58cce9f86541f07c15d51f84c27f2d38ff17556cc3bb5a3db014aad082b261e545b4d7bfbe49921d1b661b47f17b55577e33a1fcc0d1be75d61be2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19CE.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit