10945084bffb2d21ba859f41fcf5c53a640a4c4e4f0b0fa93fd69248985614fc

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3b046e1c5165ea23623ab2b2031c29b.html
Size

2KB
MD5

d3b046e1c5165ea23623ab2b2031c29b
SHA1

2bed58d41c2c3e12f4ee3ac76af82c2308139802
SHA256

10945084bffb2d21ba859f41fcf5c53a640a4c4e4f0b0fa93fd69248985614fc
SHA512

739742ccd82dbb6a8ac11d537c806fc9f6a1d1891dc9ce83f79b0c32ec10b68e485be31668031822b9eacf80ffd5d117879f7f50eb3900c1e83e00b077ca8f54

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad153c126d684145bc51489cbbad6aee00000000020000000000106600000001000020000000a1ff6b9fdfbd390705c610daafaa8f4364efea8ea2d7fcf8c3f40ba0a8145dbe000000000e800000000200002000000026156050a2197b8836b576971aed2e1b177867f778448def0e949017028baa3c2000000032fe216c9715f3a6aa0c0d235b842073d96fa45810d0ebcf781b4184f87455a44000000062c5a9f0558ffacfe038ef25a0e5f2dd98cac5acaf3025677b5f9ed8cd45798710e758b4b5323ef6d4d61258395c03617556b70160cb31ba1f0786e70eeac5ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3E39CE1-E52F-11EE-A140-5ABF6C2465D5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad153c126d684145bc51489cbbad6aee000000000200000000001066000000010000200000004b91b5194c38b0b66dd1c5ad98a03f5ecc1d423c18463fc42715a532bacb29f1000000000e80000000020000200000009a9db6f0fe0e5f0256a45d518cfd07d91d68b5bb41740beb6d7c263126e92da49000000094c436ed3387df704ea4c32f5f83cd66dcc2ff906d815fbee3c78f3c74656f8568e290eaa6d77be432eb325a740a972c5d921e6030d624d7b6c1d7f5ebda72fa5f4e771207c6a8e62655dfc66c18c43b9a4b2339f403b94481c1f6c3ca667bddb8970ac0ba9fe2c030fd43c44ecb5022391f22b88e4936037cbd7b99da4ab4b29ffc9424cda3f5ec4da981562de90881400000009780706b5dd926065e31ec9ab083d33536d026cf556fb801816bc322c333bda0ff02e71126032267562ad73f7672e6877c6ff8e71e59fed8553791bb3b26ec97	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50575dc83c79da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416932334"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3b046e1c5165ea23623ab2b2031c29b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
943396b2b899b5e5f228c9c333e2417d

SHA1
73212c947e397c8afda522f8082d9adb89f62834

SHA256
5c6d04b81ebb93dd6e6180b7ee5e369fe3b55603fd1a25b20670a1f4b1bba2e4

SHA512
d55a1e6f81b9493f76a08f6e460e20ef70863ec705bc92307f13766fb13a420c76b6b4fdc513e57b9dd20c181eb646e2c52b80ab463a5c68c9a687202b1197b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea7aaf087dd162f5d87618328b1a8e2f

SHA1
0e68f50d112fd3b5d74a91d42cd4a2347ef58aa6

SHA256
652d4729b97f7205663d958c38828f460326e5d6828e82770d016e83a8d7384d

SHA512
d863ef3bf17007f3bbf3538bef0fd2ff86b9d1d16aaf60abeda220c7b24a0aa3cd47fcad45bbff6642d365e335a55d19ae04f448632b455604d0f57b10d58ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db636e09ea0cb79250af73cefc9e5160

SHA1
607b8df360a494d870dd801fbb7694a14ff6cc42

SHA256
af00f8886290e951418e8bb3553cb582eed8eaa580c0dcb17901cd9b663cecee

SHA512
d371d849bd3353eab855f314fb51d8d87c9928650b6b3075a4660a329b02cdc2e3a4687649730a136aaf21e945800fcb83e4e5500555afaefb47b93f48d949d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36dd1afa570ad2b391cc353a351d93bb

SHA1
49b0279b4bf16310dc28d42759501852f9d7381f

SHA256
3c47b2f2646b223c62878e73ccf15db96ed42422336a079698c0e3e304847f3c

SHA512
8532b0e3a205a2c9891d10883c61bb3ea410a1f24654b6be23080951beab9cc83b7d5e9dd9b06aaac69d17ae416ebac98a46497e5e04dfe92833a8357098df21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21bfcbfbb8e5543f194cfa28a8c15717

SHA1
9555e0fb45be5fab8af6adf903d47054cbff2be5

SHA256
53d457cfebe6eeea76776ae92e9be6ae800ae5590b6aa9a1b4cd9c2c37ce8d82

SHA512
f4a54d9b3406a9a3247605bee9c106b1039ffa02536305057a5be52ac068203392ee6db106cd03f4c6bf9230d5a172e95da3b5cf03c0e4d91104e3727eeeebf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7dc5c38c2f94d10c5f6973bbbc075b2

SHA1
ab74736022dc2f74e9ff32cd4733860146dd02b1

SHA256
ff23a03806ad4866cd22f2fdca1d6afd2f866b115e7c1fb7376fb1558289a150

SHA512
3864a75df0dddf07ff55759a8ff764554ab18bf2b78ae54df54ef99e05934c5b36959018f73ce68a618a5632da7fe2604844e5353d2a2c251b32eaa498a99d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9407c661efc35acf07ea72ce1656a639

SHA1
64e9b6738cd24f84c903c973e338b595cb36435d

SHA256
6fb964e1451551a86b954556f5e0bd6f82feac18f91a60ba45c3a7ade11fcc5c

SHA512
250f2fd0553881f4348cb3371a84289812bc82b498f33358a590e5a54b9de684d8e84fd60c94242b0a82b26c80eef5a2501851d12c90c864e13152163b9f0766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef7de30267821104358124f609aeddc

SHA1
0c5242de38fab50cc822a2139252913899ba9398

SHA256
2d1d6f80cf3dc8e3331a5caa8e7bd799a4e50f95cac6f422706e9b487fe05c31

SHA512
19bf3e4d68cc2daf371038f7ab371d3169dd578dc5d6b4e6eda1b09e6f815f2613fce72f7f0646d8a7b82e11dfc94a478ed04a6719c050914ef88f2b6fabcd9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bafd8c048595f77e99a084fca39148a5

SHA1
721976ec52e30ecec722a01371155ad07cb58e69

SHA256
7f4a3bc4b1b5bcc2fb9f61203eda92335378b7d83bb0d0420a10f7abac933837

SHA512
93e9f195b99659408c2a92de1873a8140edcfdee9712e9df200be1c1fb79a175f3e1b612b8f631bb01cdfe51232d816af12d70368f792a7c77bb6cd1d1b8b389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db273e310e91a2e6c22bf2459476ac7

SHA1
dfdac14ae80fa71f44e71a1cdad4a4d299e98fed

SHA256
a14505f7d7cef3c9387b1b326d60dbfa712da07cda98d6116b1d79aacc37e41c

SHA512
1d39466a8acd9c0a9d9ba56534bf029b673e184bd507ee32d1f00af6f5a8f0854d58fa3044994eb0e5ee73440a5aca287ab701e5ac06bdf8c1a208ad6c22e808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a8de7aab96da2504c593a6af2859d7

SHA1
7bf3462e9cd3544549993cd45d010c4c418875c5

SHA256
8b895c16efd6c84f2ba44af4ce067b1a31d52f5dfca3d883ad0d12fb1a6a1183

SHA512
98c0c631ac2a5793c0335b17113035526576258b900340e550cdce1cf6f94c28276402564666e4f61c5854716c669a6f1499d11a1849c65dce926e8689dd7058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4830cac03c440ce2fe1f73675ebb60d7

SHA1
79242f9e679ce8150bf90b296070dcda71879bc4

SHA256
5e30e9527c6c3cdc942ed21d319ab1d6152e9193138b51295d801d9ebecf82fe

SHA512
06942513a02586c9248ebbe5b430ac6021c2962b5a0b2f3b59a71d4e31c6e3756f0775573afc5cb31205d84be38beb7960da7be8c129e1b3887d35f090310457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e085b017dd87964b785a158c7a897b2d

SHA1
25bdc726118ae43ab76d007bd74d3c249e59c854

SHA256
7498c827c992792014a32fe6864b06c0e33a5daf074eeaf47322ee49ec10da08

SHA512
215729a1d32711825bf6f0e62832a452ce1ba0e6c885f69ba4da22e8e6ddd257c715627680aeb66883cb7d75a39488f677e2bb3c2923056b1f1a6bec6770d83a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar489A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit