e3e9fe1487d97e9e435ff6dc2538550ffc771d56f4427e14c706fdbe43d18ddf

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3566cd72d32c993ceecba12dee11e0b.html
Size

53KB
MD5

d3566cd72d32c993ceecba12dee11e0b
SHA1

aa1fee68893dc4ccb618eb4f88ea991bf031ddc1
SHA256

e3e9fe1487d97e9e435ff6dc2538550ffc771d56f4427e14c706fdbe43d18ddf
SHA512

7448353dda17ee61dbe436a3c3eb8b94e19f64071b8a7294e58bf3689d3aae1214b971a5ea709605c974cfd56d2602d1e9bdd81519f31a30e5670671bc9d939a
SSDEEP

1536:CkgUiIakTqGivi+PyU8runlYm63Nj+q5VyvR0w2AzTICbb6oL/t9M/dNwIUTDmDE:CkgUiIakTqGivi+PyU8runlYm63Nj+qQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e006e06f2379da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416921429"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E42E531-E516-11EE-825B-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000aa2b445ea559d713dede85b7c159547750051d1618f33fbd5c69693283d16176000000000e8000000002000020000000c7b9a836cab54b1ede896f3711a9d833269cb0ce206dcbb55ec89413579d62d620000000a4ecfef017b91e201280321622cd4b11f725f641ac4e23f0c8339bc7a031ecc0400000005b5d4bde9e267bdd793e232b65b944729b4befde218e85381a6a90a2f4d179a8abb58c18baa7e06d92a8299fc9399ebc0b0ae38b9df795ac1e0598f20f1f5002	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000119bf74b88e729e28be59aeee30dd124f852860af09b01984f0ee06922eaa5e6000000000e80000000020000200000003ab0c723cc9b9bce5b8287f74431caef78e17f8effb4ce952ec074d1a23d2eec9000000001965fab7a8c396a89a9deb1c9a958eafe5e969b5718ad36a1af47d326cbe553b6b11d7ec5bf832ca0f40868fdc1c882a46dacf591e61935889521fa961b6017643cd05d775b576c792d5ec0489be5b534c37a034746340d8910de89f920bc97e7515657cf21f6b45c4c5f85e80fb97394bee30d8a5d3e9fea9eb513b02309af4592c50b43a11a2e2f7f8e67de430b3b400000003deca1562fa7015590fe9afd37ae9860087c13c0c5f8d14f50370d5d9994322c27be170e12cbfb4f5f7ae5718a7f261872d65088d5e97b71b5c170dbd4c2f490	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2092	2192	iexplore.exe	28
PID 2192 wrote to memory of 2092	2192	iexplore.exe	28
PID 2192 wrote to memory of 2092	2192	iexplore.exe	28
PID 2192 wrote to memory of 2092	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3566cd72d32c993ceecba12dee11e0b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96311cc002304eefd375088ed175e0ac

SHA1
9a0d202d2224a80d1d2e87715bc29cab43b4fbca

SHA256
2b270274952beefec7b93c6bfcffad09002a9e2ffa0d98d234c882eb313b2e2c

SHA512
46c11e705e9578058d231d7213a9ab111bdf606469f39dfe588a49f78ba2dce3ded7d29b0ccc65283c01114c333639fad6593cbc6e91b0923f0e45621c1c0cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62b7780e4c94282379b81a67c70e8854

SHA1
16d3dbe96307dc607aa4d173cc1e40443a0e3e1c

SHA256
f92bbc58c885dc12b1032ddb5b24e65d438edc3a4814990a1132474870f35153

SHA512
3fb3a8c7a0ff80db3cca07ba30e31e9269adf93602d752a22f47cb6311eafabc8eeda6eb0da2e3ae73e261291d7f2f01478d2056cd72627f57fb3f243740f367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73903db7dfa9f4e4e4106ae4351d1b22

SHA1
06efca058812373e5bdf5664ace630a6dfadd9f9

SHA256
3b474fac19ef76ab7161ace50d1bcb18cc3b9a362f7ce48740371a5697215d0f

SHA512
ae4830861b962353db757024196c0470e28253e78b20d4dfef5de643fbc39b89cb10b624974de10821d9092e5e47096f51ba0d19c560b483694ef06950a6a813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d88874b069ac3e1e322e4bbb70badcd5

SHA1
42232b9a936c53f4490c74f43bc28a7cb76a8aa0

SHA256
e3e7cf5fd47a854fcaa048c9ba7b1c03d8edb0fa5fff33717368f51adbb7e3c1

SHA512
a75a3830efc0a8164d6a2411a881a31a27bdc1434fad9b39c2ba74c1344ff6c85c24a501c9afbbcfdb4f79ed44173bbaa8e666886965321284a144815bbf4298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49bb4e4fe17a748e6ba831f86794a619

SHA1
343210074aa70220e4778c82ce3fbd16f3ef0987

SHA256
7ad14b851b0e747f6d5e43e9afa316afca853f95f8a7b3a039b64545b4c405fb

SHA512
6f0cc864b7efe1db94e1c09e505e35907891c8c3ff16e6669c2a05416418e83b19e1e0dc60801238189950513a9977f767ec38c43868aabcf81f82068277bcdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c98b8afe8aa5371f0425d184ba1aa2

SHA1
e1d8e0f15aea610388df848beb010b8cbb97ee8a

SHA256
ca22d2d5e7176c724a36fa31ff21882f62213834f95ba5be14d1b4459f42a8f6

SHA512
c1ecbb01317e472a111b13ff8765120c49d20fb08ce238f40f49031f0b4fcc80c9d0b4db1c7cbd95aecd1dbb4530614f49e8edd1ae4ea8b8ac726488fd0d90be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba563bab15c4bb145b87f06729915a8e

SHA1
bd44712acef67b5b0882add950adfa736e253550

SHA256
5d766fa42f63da1a0763b739165f993a7ce0f6253f66fca34ddcdef4ecbfbcf0

SHA512
416211b2378ea616bae355e966db12841b9f270a5be9b73a86d66156039857e52d37acd42744692442b461f696ec8afbcfb9e5728c415f43ad2afce1d335f3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c3ae27d10e5c0ede0d4376e0a61541b

SHA1
d316458a790e6501bf4299e4d5180b504c51c52b

SHA256
7943f3f5734ea4d718fbfbec7c0af1f00fcd4125a5c627f3c9ec5954abf2ad49

SHA512
d089a862a0e93acf346ba9379c6b4093fdf5959001d1cc58706b4cb4499b0016ecd33d0fd0dc191c4f9dcce59fb66f48960c7724397c28426af1cbd87de06fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efa4a4e911166b38c8431cf293fc119b

SHA1
60693539da0bbb1a29b75b916a8d8e115f92aeeb

SHA256
96f2a5b6c97fd8e17c9033621d7dbf259f08dd7ef67797338490239d6fd5d0cb

SHA512
157ca624d7583108f4ec651af03dafc556a8738a82da907a6400e851ac20d0f7b0e4ee5f4e695b3105e977e488d3fff8ee07c2bfb0fd8dea6c0457355ad86f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f91d0a7b70aa982dc8bb8a636030ca4

SHA1
9002a10e5021fbab3ad325b278b844fd769857d0

SHA256
06cd5ae38d09020f7cfaf98b7a17f04b894ad319e7032582b84d33bfc6e06bf4

SHA512
2f28aaea5dd8bc257a23e5aa7df89776a2d787470fe1b84bfb966814a2bc144ff3d8342bb0762b29ff6ad1ed1e0088b814f164316a079da4d0d7b6847e6b58cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53baa2a1b72649957f40a0b167aa1637

SHA1
a80d0082d770a540d5259d0b62f32d66f0e69320

SHA256
3d16e755d648b25c47a6a6755b77c88450c4c1829bd01fc25d0981adc74d8931

SHA512
146e8fca7457ff555d5ae8ad7010fb93804188290e3a7925f1973d511f2d6525ac0a60ad7bbc0e8162a4dcc5a48a16fa9be1ff3652e6cbe8e2df5463406e7036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ADCJI8Z\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA48C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5CB.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit