a54e7937a7d8601f0cd2315e38837b7195bdd1b29d35e616a50b4568161a7906

Analysis

max time kernel
123s
max time network
158s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/ga2v/Rain3D/index3.html
Size

2KB
MD5

83ac9584d1c673e705cdf4896bee21e6
SHA1

3a8a2461faea4f364d8cf93b1fd214be08a737b9
SHA256

2b247f51d247c8f05f0064000240dc135d8620c641fb0b760b7f3f842de12f4b
SHA512

6353cf621e5ed03379ca1e4979b8aabb1e41310ee71cad7b14e77c4455a5a289ea0f8fd5860f939e28e8a39af3c086c33f560f33e7173b6ab71311c9d04b0bba

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E3BE7E1-1614-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ee15e644f740f2eb9015b01bba42c0267cb0c80476f9e9b8022cd027ff9de023000000000e8000000002000020000000467fc53bdfb07affb224bfb70ec4690c9f6d219d5eab348ed52930489ac760d120000000bfb2b828eee91e3a63c5b67c56cec10ee8431f4f8ee5999435003c06b8f3c5ca40000000576bbaff9aede6f73db445f763d1abaadfd8fe80b414babcef59b6981c9dc943a5333973612af0260e3d3bc0bd7dd6db06b2504bc190eba1653be6181fb0807c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000083bf1484581cb553b8a4dc3afa0cc847870d40157b2eecce4635cc93f632ef85000000000e8000000002000020000000132b1ef4cea0003ccde9d524312dd516a22e2f4f6d06d1fd996c282bd68f2c0a90000000e32afbdca480cf703c28e09637b2fdf2ced6599c75a330211949c5b22aab84a4cd6c15602a8c3cff3fedcbde0fa349e5e5a47c28529d1508c3271a0bf23109695145ba9fd9aa1ff881aba9d00a5bb2fcd4ee688d8cf42086c518bc99daca914ed2bc8114ba3667e64dd261849e5e61c3de141836b0d2280682e030c7fdbf7425a944270698a7ae1c02eb8af47b229dd5400000001b9d9a106fb47745200a94a0befd6d823bbee8aa2a02c440dc763c8281267f228a5d88d55bb357b4d6b5c5af6615fcbf03651f31373525792fa15e1acc55a089	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a7713321aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422308093"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2748	2292	iexplore.exe	28
PID 2292 wrote to memory of 2748	2292	iexplore.exe	28
PID 2292 wrote to memory of 2748	2292	iexplore.exe	28
PID 2292 wrote to memory of 2748	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\assets\ga2v\Rain3D\index3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d4d45c3c73fdc221425cdcb415a7486

SHA1
fd2a33141a1ef9b46128638b70f08201d713c71f

SHA256
bc1f461ca0816f29c123c561c81dd7ad037549fc3a41bbbaf1afc2621beb37d2

SHA512
bf1fc8b7dabfd4335f66f0c01f152f861882584768ee3856ca1303e2679c6bfc905488164d0ac6970a53af6c9cdc3289fa81eec5b0ee795262180e699a6d1015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84cfc13369ab7f32adf0e4c5c96ddde2

SHA1
d9d991f57f73b6934682597f90604692ed379f39

SHA256
de5fd7975d3917899e4833dfc9a2ea62977c03d78e207cb345051f37ef95dd3a

SHA512
f4d196394573b6bb22fa54e87e0bd255b9c672336f3f8dcde81c8ecbe5b53d37b8bc728ce78175aea49af004cf2c4a23e12d582010d05ee97331b9884dd2d2aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e09a03478963f106e8ea9b2717736f9

SHA1
f865e27e974c13848bb680cdc78828d845eae576

SHA256
23921587c8c2419c1fe6702b1a5bc2def6630cbab3212f83a022ada87e3577b1

SHA512
9aa9448fc69f7fd34be17795de2bef7b156531482cd08bd1759a304cc96a003314641f5f112c55ded064c00108e592583be3c29ef7aa1dff87158dcf9cdc091d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810415742206c5b568e280c4c6c00f03

SHA1
6f4ec92c09d1af8f5517f4a2121d5c4923cbffee

SHA256
3844d9f7fef20db331f6731d3fe0bfd1c9d06cb987b036237986a697b233cd21

SHA512
e0e09a9db3591013e1a784b19dbfff5aa57a1e73ef222512bf75bb7ed1d3cdf23b226b3335b3dedb7897cee65bfa530b9090592f13191315644a207c4c36419d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc91129f2eea10b134f03d552470225a

SHA1
34efe0f0292557d4c3ddeb4c1a73e95880e3b927

SHA256
2cb4ec6f475cb1ce3175b0bb0badf4bf43a80bab023339d7bfdcf1303e04bf98

SHA512
d0ee43ea6e070ebb46689de048e06f51cb4ab0a155fd8a7ad9689ec05795ec4a0e0ec421b0c490441cb2670891e2023c70680325a25b7a5af5963a253bd46410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49db5b87cf72f9e03d5f711722ca12ca

SHA1
5f9cf9f4f14b64e49263232cf230230333297317

SHA256
34fa8f428ecc0cc6a7c25ab544902391bd1aae174f87f3ad2b18b2639381bcf2

SHA512
252a325a214333d8c117d42644e0776c0d4272e12806d33c5a27520adc385a4266a9cbfd43e3b82b6d9d90498d3f2e142bdeff59d5bb81011658e89b2d2b4580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce8555a35745727ca4c4a61e86073a13

SHA1
cf36a75beb6a8f8909a87e3e6445bed7b9d2e8c9

SHA256
1ea6193c0d2e7da332818235766d05adaf5b9306345d98bb7126b0723916aa27

SHA512
65397a5c4565875942367e28a95e8eae347becdf3ade6f4baf029708136ab4427ba158aaee62e3106a4ee4b827c2a8e5d288241cd91a6f2587845e42c5643003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1df9fe163c0931da7d4c6f8df5bb9a8

SHA1
148819971fbf41d32a6f4ef266e909f3d524d349

SHA256
a5f9cb8d96cacf5773163d914e30de0b15596d500a1f18d69eeb0bf0990d26f3

SHA512
11df48ce057407319eac1e4a64e98bcd7b4c1811447d66511f9e7cae4eed94dbb6bf66b259502469645dbdb757fbbb05c96b37711195d38671e83f96eb683728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eac669b481159d67a6b348757070b521

SHA1
ad23ea9f62f0a5a66579026e34cc2e1a65e72629

SHA256
b316625fb0bac863a39e15ee41e9f494555b274b5a06401ff0eb73d195b7e88b

SHA512
ffa09eacb4430efbf406f5836022ac64308906e9385548e05423e56de0293f151d301e783fb4aa19c96312d94358b33382be58d87757c3cf32e85ec824b1b279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b43b122cd009c6ea4f4605d4703f0c31

SHA1
08dd4b790f321099b0e0a908542f7571d73513cc

SHA256
680f30b6e4082ad3dbdfef6cd86716070b318ec2e9b9d7f9b1a83221f324ac17

SHA512
e67262018032317720b13846f3d3270b2956759fbb42cb275255c99ffbc12cb613b598646071fa1b844fbe306f2c8b053559871b638a9b643f552b9bc0ed3dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f80feb389b854881ef52ce9ec895de34

SHA1
b8cbbfbc526cf2711d7a3d699fd7ec20020a1abb

SHA256
eedceb3b4ca8c657752b4cdcf7e8906a32ff33910b180c8cd3c58469ce6e884b

SHA512
e569b9d0192e83d47f077ccc578054af7790f0efc5c9f6f37304c5dbf5c122a8e5f26dd4de5c25fac082f2ba1a0782ef43313a586e1196d1dc68a0d603bd1d32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
852f13d62d2be20a64aca010b58fe6ed

SHA1
603c48b71976c1995068a9057bdf95513403c72e

SHA256
fb2bd5533862074e37cf8611bc35dd367a5abd442734bffd3955b1f3e3bfaec4

SHA512
56dc9fc4bfe71b37fef08569836b1345f371b424232265ba33b505860d4594131332a647f4831c2614e7f9e2876445565ed055a38df35f94d0cb33ea364a81b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a55b8c8e15034a107f2fc092522eef6a

SHA1
f9e0bca503eee89b5a6ceb71c13f62c248ab4b24

SHA256
ce35e22481863467d6b25acc8d0a7105f2ba5656211885f90fd93e818e0f33f0

SHA512
5ef5b718eed8dd9213b58ad2ea2f9e0551acfaddf9f8b27344ef9ac4fd3f80f482c7922c7b99bfde31fe6567fd222606ba5e1cc12e7faf01262df97c3896e4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8509.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8685.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit