d2ad6ae20e32152b1e93e808f4e3ecf51793273d7ca6b6a0e9caf5a0bb3e137e

Analysis

max time kernel
157s
max time network
170s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1334c0c70ef76698e56177c15672fed6.html
Size

195KB
MD5

1334c0c70ef76698e56177c15672fed6
SHA1

5f76ae80aef0e92202ebcfb613a0a7968e8110f4
SHA256

d2ad6ae20e32152b1e93e808f4e3ecf51793273d7ca6b6a0e9caf5a0bb3e137e
SHA512

56735bcd226a0584d105d450fee2e454d27a3a5e072299a73032530246a1cae60832574d1ee73c7d17fddfdcc1d11d339b066ae9d3ed6b9013399802588b04a3
SSDEEP

1536:I5szrHoEoIVtSieTTG1s4kAD0bUwHmE4UEActqk:I5v2tSieTTGPkAD0bUwHmE4UEActqk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000068639e4b49a11e5ac4e9acd24141a6bc1dea07e075b0826b39fcd8b6bc8d5c93000000000e800000000200002000000055368ad2e28437fd1d538baa6a1e9ab43e9dde48640dc5e85ca43fa9515c72e79000000091889d04805e720fde70765700567ac2d47a79bec5027219402532a7eb2924b57f933d13897b0f665c62ec7b819b5c8cf44a0a2f0d379abce1a88e136c21510ff218cf7b74e85e00948defeb8985685edfc283811a42d900e6cf36564d59d41478005adc9dbd9a6f998a5f1db3c16c987f2aa1334a4dd21ab635d1df50981c101b7c072c4d5b7719b03cae6ae6abfd59400000006ee8d059802161984b7f255bbbd012675b9aa687c596e7f533bd3caf41c8643d59fb6b799df96a25ed1fec2c977dd19fd01db1667ebbb77ac6d84b194b1a5bc1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ae9658e6ca8def2c98477af2a2212c90eaa78e492bed34cc364dda250e628846000000000e8000000002000020000000ded97096d9267ea50d02ddfcfe50a237074561249f1ea96c90683be1117178e720000000cd8f9bd3ce517fd7812855dcba63e16b1f95fadd68a2625ea71b342dd55efcd4400000004cb1287e1e3bfe21d56faea511a03c82ce0aee0632fb5fa034ed99a63f078053bf3f567883ef443c295ed70cbe68313afd2bbdce2aa4870b3ba37f9c9cd3a668	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA512CE1-A356-11EE-8B00-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409692278"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0db89c46337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2824	2308	iexplore.exe	28
PID 2308 wrote to memory of 2824	2308	iexplore.exe	28
PID 2308 wrote to memory of 2824	2308	iexplore.exe	28
PID 2308 wrote to memory of 2824	2308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1334c0c70ef76698e56177c15672fed6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c9628277d1aa701f3905d15bb23c858

SHA1
65672c60088742ebca69a098ed88e6cda3c9ac32

SHA256
5d6ab8e70d51d6886b633a8f8bd6c5e2dfc5bb79571d7dc7906cd05b37a17632

SHA512
f4bc0d2c4163a49185abe03c306d2ef1624086b8c45fedbde74b52a4e07e9402138a4fe12276be090fb66fda4d833c67fea37dbc42fc83c154c7042f601932bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
009caf000d288ccde0beec91b646542e

SHA1
945bbcd4821a83a1dc96c5748a7b6c9a531bccb5

SHA256
904f9528f0833c157978fb7e045ba465a268b3ebbe7fe3de239d75ecc56d5063

SHA512
c06ea60937f1979b17db7cb75486e352e2e75372b1e10d3b75894eedb9dac4b19d7325401d5af646e81840f647d2c120ea2602c6f96016416119cab802f735b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39bf8be9e37ebc847e7b21f9d37262a7

SHA1
0bb5204f791ec8c3d3a2295001f7f9f0a8e05a33

SHA256
e906f74d4bb0bd7dd8bca0329f4e4adf76cdabd80b43f5146d38e7b39b057b4b

SHA512
cdd392cf809ae9e58f945e36bad73e7a92d8c7fa9773ea1dfe426180ee342dfff7045cafdc4ff7d61192932e73e9a21ce000d48d2128a5af7f2726c50a1dac42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0168efbcb08bdae47e2b35f091a59c6c

SHA1
518662a7a96447f9f26a10a146ac252d6d746a78

SHA256
99b3e69ac8f774301f493c93bf92c998ad3266b839af0755332934d662bcd90d

SHA512
c7890d654e17a532767d80d610382b482cd6c4f785ef223dc3a7f81037cbcac2b30b209a9ea861eaf8aa217c6b137ce647da84a675ec86e64cebefe51ca77117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2f6396bc7d1ea076c0e75b2f25597ed

SHA1
56227a68cf4300476bc3bc3f34e4d75b31dfa162

SHA256
fb0994f04afa765d379e479adfbb0f047edaaa2a3297d90690a10c6d744cb007

SHA512
bfedb9ec6bc572a9b88f31bb6f018b5279c6d14f5b975d67e847893afeda2879aae6b6577036ea9e204cce7019c74451adb9390c6ac2bfa5aa8462b7f80dc1b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e83d527a51e41d57237aeb2136a95e8e

SHA1
ebdef2d46bc3963f68814e43533a9b52dec8b6da

SHA256
446d4da544e50047d4b900b4bdbdfa415bd21ae8e7f371f267bbd581673571f2

SHA512
8586ff6eca3c09b01a1ea7711330493090d2f82664127bca031e48d2afd1b75fb9f3a3c623587828e8e4c29cf4bb34b922b1b6d2f5ea1402667b0bbbf68cc536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
846804e302afb356504c72a969d64dfb

SHA1
46333a3dcaf0d963708536b44c70346a202349cb

SHA256
d14bd592d892c3eefe69634f7e2af8544b79d33c23053f766197694e6c66339e

SHA512
ac73e6de5d7de6c780d51cae792671cc74ed8aa7ba17adcd2d53790798e99b1a8e9466de8182b08d979813a068cc9e50d5fd5881a06874f9caef2b9e93f82f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59638bcf4cc5f7a286d198218fd293aa

SHA1
c131f104c5906e73d11e8c2754d96681ce43889a

SHA256
ef97a3df148922405c53d71328027e9aaffc0c2e65db82b5fc2e103a47dc44bb

SHA512
b387f0b05e761879cdfffec6b7d152c228dbbac92510d1b9aa9091cc2dd7b347a9aba7a5506766f4510fd791d5f494ae59a6060c863b76c0010753870dc60c98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a5a66ac5756a571608c457e249f85bf

SHA1
861275e956eb38da57627d67ead6d51f1ad7d702

SHA256
7a4a0c0f5170e1b09fe01a29298ed681af31307eb5375fca47009744a2c7d51f

SHA512
984ca37c8f804ff16d75c2531eee3dd28d46e40e2272e97ce9de515c0c2dd467d4d966fc9e4333b79bf126b9610f1f8e394f9e83f535970190651c8186e52496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb592e48a12e40baa640da34bf97499

SHA1
dc2cee6489a227334a4689c8a7d61c52dde5c984

SHA256
40742e2b6bf9103ecb724eb3caece7474cd4d0e0d2e190b9270b8a834afb3bdf

SHA512
f7cccdf08e9601ad4de60e8f7497355eb40ef4e084776ef9e413296f26c093a002e3847ce6d5ddd2d387b8879d04e7ccf58a8c2f208a0365f5dfc9b3a97d3684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83671544cba7842f6d1cf8f1523f274c

SHA1
e48d0c003106e77995ede99b1c2bbf1a8da13f2c

SHA256
fb45b1ed2f0243f640952738d74c6e0d7b65b33ed577884871a18be707f81928

SHA512
42269b86b6c0630410a81a18cc1f06a3cfd5923cf98c0b0d2d2faa4f871db1cb8b1c3a873b43ee9c3eea614aa84f9ae0a4ec1053cc9e2b7f5a1182abd590edbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd862c1d6e80cb0c05a2448f53c79ffc

SHA1
c6379f10ded95435392b3956711b4743622e42bf

SHA256
aa887d5a17dd413307e8398c515a00ea5a74ffd0fe2f89871c518a58836479af

SHA512
bdd24504d87298549efae1203c79a8a5e44642ba9b167df536c7d8e8bb318a987fb8d8b040bc120556aac5d426f99bf70bf6a655d2e52a766261701841a3f55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a553509041a0b8ce5bd8043852db13c

SHA1
eca88a7a2f720800e6fec348f383072671daa79b

SHA256
c3c1b877033d0706e0cf05d09999dfc41bf52f100ac34d6c4154041d7b3e9209

SHA512
913d6d30d07c84b666016056f6bc3c7bbf3f819adc3f1ad4f97519592718db79a72f578d2eb868be69fa933a8a154605849aeee6bf700ff21a279677aa458b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a49691af8d14937bceffa1515d94ae00

SHA1
e314617e7ccf09498d9f493b8b1d38a935b2ebba

SHA256
cecf89fac3c5675bab70f7081d5f1bd3a6fac63b7de061f610adae06e3047574

SHA512
f157ef1518e2c30b73101ce9a31a47e44ad8f2c94f6bad45fdf7d1c33c03f6e991521212dd3a7c2e028df0a5e275277032e27f94d218eac194ce9c963ccc5332

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
240a73804f1e9891ed40e4b1bbbee5d8

SHA1
1c0a867e2203d358ece8d2318ae80fe918a061b1

SHA256
76d60b9d40fde97449030586cfa083f5d7be44b1880236565b08aaf1012e017e

SHA512
9043955de0e2e0036532553eb6ecbae32d3c061ee39fe9f3475477532c9f5e9a728e88f7fe926254d1ecc40262006fb47c5a9e7e025f2d6b84206c9a0c1556d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB962.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB9A4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit