51667230ff3e68c3b0fbe9dfb7a5b64ecb2da8fbe59f1d18387f992bf168dac6

Analysis

max time kernel
147s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04216f5b1c3ac7321cf307e06b4eee8c.html
Size

51KB
MD5

04216f5b1c3ac7321cf307e06b4eee8c
SHA1

61999546d5351ee8b6adb95ae3f4bc81dccdb5f3
SHA256

51667230ff3e68c3b0fbe9dfb7a5b64ecb2da8fbe59f1d18387f992bf168dac6
SHA512

489ab9049eab081783687fd84c9ee8039f9311117721d70241779ac8654c8e06002edba7aaaafc39915ce15138cdf546bc29e991eb9bdedb9b33b0f3c18909af
SSDEEP

1536:SfG5MTG+HSeDVLj6AfXC41ESv42HYSLJQart:SO5MeAfXC4SSv4vart

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000001235be90c071661fd097d64415e06c9990a069526e89c832d9671c645cc3c957000000000e8000000002000020000000c0842db8261437dadcbb2583583bbc9c1c5ef31b19a3d48a8c3afe1a9a049d4720000000fe228cfda4ff622f576b80d4264ddd92c4e495dc050721fe8590d2bda25c9f9140000000e5ad78328e138f3974ec7e47c1016905ec15fd25422ec7d140080ce8294f2cbf8ebc5acf3f5ff1f24e35d1134148ff17f34a43e9979ef50067f05f6d225e9136	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409616163"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000001e548631129c79c1ebe77d9f40525a4d969a5234b8314b61a45d0eb8bc541eb0000000000e80000000020000200000009401c4b4366e89401d59be6dafce8cdc27d0da7d8ac2398649816d86a1fe9e4a90000000bdd199e038ef6db54a9311395b5f83e297d792fc0526ef638308c25cb86bb808fbd815c903bb7364054832bb2b09abbdd1ee469427d8e69d6e6bf348af552db26e575d5152fa0bfcdde16bd5c3cce09d7e8f134a2ff75519c0ecb73a3b933138ac765afdfa6d0b41be842eb731e0ebbaccf8abffce208c58ac90239b23d0b7f4c96b62326bdbcbc29f26dbb16a66095740000000119054669fafd4138b7c492458fb8535d55282533b59e31142f7d0212ab845940aa5f75851b23ea39f645cac8f9a49b84e6e390f32d815dda103ec56c3c9e7e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAA47441-A2A5-11EE-B696-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05d8a84b236da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2720	2036	iexplore.exe	28
PID 2036 wrote to memory of 2720	2036	iexplore.exe	28
PID 2036 wrote to memory of 2720	2036	iexplore.exe	28
PID 2036 wrote to memory of 2720	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04216f5b1c3ac7321cf307e06b4eee8c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0161375806650898497ef528be553e5b

SHA1
569ab15e5c035dcba32a966a7dde6f55fc9df1ae

SHA256
d90f0590e06cd22073e3e20e514835aba8bc4c0fd31254c35795e8a364d9c297

SHA512
09147be2a2f8fed8249da5596fbddb5d7f05acc1d859c1c6598f170da759028d3a07e3354dc0effc0dffde4ef5ef86f54f68f734f0b6909b9b9f647f8424ab2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db17ef0df5ecc79c72c59c0553a0b7c4

SHA1
f5aed859f610578050a895ba94de2554649f76a8

SHA256
94764cb980a0458fbe0066012ecdc72577fd9866c4aba4c0f92828d343407b4e

SHA512
9d6d5fa9e33b3486d57a06f38941ad49dce9c19318f03bdc1223a73412835810b4f93b126eaba4a1b5bb33f004619e33a22c94b66b29b5cbf6f49f92c5aa2b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2843f4de05d611c49095195832e5346

SHA1
67310df03e111f71472a4bcc1ee55578a86a3d7b

SHA256
2710690df1979fc9b63cf66319114f124838fcd881c8dd16f48efc588db94c84

SHA512
c6742ea0ac758ea3e506c3e126cd7300146f210c4556c0bf9009e2ec3073ea7f1c7ce29e70c69a02ce6a0c5213810a5dd18c34215a8b8f81416e406db9b161db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0cff057e09a1753bc2f028c94b3a1f9

SHA1
8112e926e128c11399bee2818ce8e730a1dfa498

SHA256
4f83e44414ba9c0281ea06052c394e50a784499d1bda70be6bfdc8004cb2136e

SHA512
44d17a244bca00812d475e10e0d65d2656b9dd897506d2016cd5dbcef2ea11e3ee83a8b76bfa560fcfb52ad02e908a215922ddcc2ef61dfb59cd4b651fbf065a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69aa006aeb3fe606cd56f1f62a1cdf65

SHA1
64aef6648e0983c6fc7245f547512ef8783b03fc

SHA256
13ec417f8990ed82d4bcd2f8d5d7f310f08e07c565e7c3d61cad8e2814c99f12

SHA512
6b8799e3749ed1d00e4da28e11e82f791d7469915a67320efc2abeb1a51c6a8eb6eb1a3b53bd9bc0a62d226512afe442559f4a06b644ec203bb8a6384717c28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e4e15e5fbee9b5081a2f3cbab712fea

SHA1
e1cd42adbc9e5889fd69a6a63695cac655a28457

SHA256
0b6d1fdff324a11694002f1c57da94b891a46afab1dde23376f3cf963dad5056

SHA512
075706fe03f40f71d21fca13eafb2cfc014e43d59930d60b618166896f53b77243bbc4db5e04ccb2e70652dde08efdbf897ebe18e963012f935ba6fdab1be98b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d20e831b68a5afb71f5f88eb645fde28

SHA1
0e6f0c3ea0f721d8a63b2913b1405c08c869c093

SHA256
a008e698552020c3633fc84cbdad99aeae366540a93d6b3921cd15a0af94dbc7

SHA512
2cc1fcb8fbefec323643f7c1b6421815164e8121fecef4e08b2b6ea6dc5fa330c7fc95aae94f4bade245b547128629f226f79c1fb90a0856f4f0fcc23e412086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
027349740ea1410e41d01fbaffc20cd5

SHA1
ef7a67e9f8ccd05d1b6461539c70d376f6fee9db

SHA256
62f50b4d1a0a07a0491428c68480edc2f3e17bb67dca581d192577b51020a18e

SHA512
391a3cda36afa10be9322cc9f7d46eb6e2aeea17be2f1affffe0bff4a7bb2e913564d9fc9a06626aa9a04896c213f756324d3f653e9ddf7c403379178cd4ddd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b7de5516e90ab64838ee71a73753286

SHA1
4faee084f24575471189dc9266ec5ba10dd46c8f

SHA256
529afa8221dfe7fe5940d48d2ccf10c0e293b984370a5d5c37844667963169c2

SHA512
c9caa08065d8285c4ce2b44a82add25732d9017de544fc0fae6822b5c70ba08730ee04175e7c2a29b9d4845137aeed435b91c5d70c66bd986af7bbf4d7b8b214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
709ace24b02f3b98c4d3efbac3154c08

SHA1
8e888387767fef941189f46adb7be95d64c1ba03

SHA256
c14da3777819a839dc03b0bb5f2ac8920d89873dbd9b3403b631dd14102895e4

SHA512
bf3c71c034ed1402a81cd0a4377c72e297980127cb21e24393ed3b37e7d9d16e6d499b5b0976fefb7854cb27396a649bb083681ad09020ed1bef3a86a6e7bffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9775cd164c24979af952572e8a9e2fcf

SHA1
48a1efad239c652958cf71eca3596462b0f8f099

SHA256
d5a0612a34e1a51565db1ba1af2d80f312ead4477003c37a091506e1d6f12146

SHA512
12b2e00cde791fa2aa3efca9c28d3a051cb4dbf75d05d5ab423ccc89da92d44b29d19537a3e9f5003439f5af28935871a8c8036417a9bf494e20caabd9e4b60a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
939d5524ef529e0d0ca1522c1747a380

SHA1
7d577abc67176a0295bd532fd0d700d01d6efd90

SHA256
805df03e37085f3d615917927aa0836ee86c20cf0522aaa42b24ba2ac6014c1e

SHA512
eb54a4e65d436704341216eef547c0f6fc43516375f520e94700c2dd33e7cea2d309b14958cd2b7ddffbe3d0d1a502d1d3778db85f41da7c402849d5a137a150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6596874b7b73f5408a767ab0e5c36fe2

SHA1
bce2bd8db274db97f2022127e815893e35744753

SHA256
c64fb1b058a15700a1534aa1f06a7b1a9f086bf7e1edcac39d4314fb378cb3a5

SHA512
3f77634f2b7a596b2dad2e0748c95505de3e6b4211f1f728500eb2f5447cf0f8fe32373475b37e76fef58a8fcadbf4ba1ee5865a45a0f7288ca62b5d01beaf68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e69456f33d664719c0c2c0328d6fd254

SHA1
271a16a52ef212019c06f989c6a0a5b9a9813bdd

SHA256
c58ae9aeff0555e1af5d9f09b221d5e88590ad14b1928a1d1bf299a780f40b87

SHA512
f81162f87085c1b8902a25aba5456c79e294ce534cbbf2616a568698f452581eb0028abb3c3a1d9abb96a44b7ea0ba6050518665d16a65ee4004f4194c9a6b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\jquery-migrate.min[1].js

Filesize
31KB

MD5
136bc91b923c115f678c13f3740bf8fa

SHA1
d8044de6e6a8b05f087f9fb73545d5b2e9666d61

SHA256
46e2c2af87720b7ae5a86434547bd9bef9ff21fab2956b64bc48f17dc73c63a7

SHA512
2ff613aa8dc2887a5c2f9d8d40e618ef82b8ffc46392affd32a9fa2225360f1db5244a51f82d5eba8fcf3c200f179da20433761a3ebb6fce0e4ede99d129a3cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar86D1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit