c28fcf2c07ce35f3c0d41d4f8bf0f7935118dc5b1e0b054fb5ad0980b8ffe0ce

Analysis

max time kernel
128s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

080f805990e575bd788d881fc1ed6e5c.html
Size

28KB
MD5

080f805990e575bd788d881fc1ed6e5c
SHA1

ec05951a3d278cb3a941e0738c3adc22ba0fa500
SHA256

c28fcf2c07ce35f3c0d41d4f8bf0f7935118dc5b1e0b054fb5ad0980b8ffe0ce
SHA512

1f25cd5a183d8514423e5e0612cadae3f382c2d4aa8264974c6b547d761185b6d770f96e44e6664f5d48225bf4df32308e1c469083a42c902568b33e08ab3bd7
SSDEEP

768:SIPNspkw7xyeh/Wksc8mFZoP0/axYzKN2i2K1:SIPNspP7xyekkscTVGYzKN2i2K1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0acc893df36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008c7719777bcd44d134f85d0bf5393cc4cdbf8d7df81172909ecadc9e12eac0c0000000000e80000000020000200000003c99c45e9cdedab4f4de0390d6a339aea1b05c1b1c9b46104a0001185c12742f9000000050d76cf3d4a7299e7360f04bb25b06a6b5213062ba83c5ad46cacd4e0f97fedd456caba7687cd10c54ab1d478e04bd3afad8d3acd990d1713527b939b92eaa776c21887c459664368811dd421a039682f50a35877bce3e1cee3a6013a99cefc031062fff94cc0dafb0b4291e998e4d64d8a9a06254d8dde15b4f7634b458d0cbdc74081d199763e3d1e6f0aec79659014000000003e23523bce18d50c5d639aa1e5f0288ec0ef87d377c8ce3ffcb485234140b77a765d7596b74289d4143e72a654b2d353603064bf40909ea66df2da8f5471e38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000073c86172cd51e257e6084e0ad4d7da69229c6ec94b0421edb96d6408ed1fca9a000000000e80000000020000200000002e78e53273e2f26a3d4563015ce95fced7756c7a5ca459fabb39451a5ef8dcff20000000884b3375513b18f5cc281048ff1cbb622f9686163ff91f3d5d0c6d902b988c34400000003a8a184e1f65c1ed889a0f5a27669b4fd46e1868d858b3c4b19ab18306c447cbf46ea19784f86ad2e1152220490e4e0e80af2c77f41e211b9a35e5dfb89b4174	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9497901-A2D2-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409635514"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2456	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
812	iexplore.exe
812	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\080f805990e575bd788d881fc1ed6e5c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4459996733773f7f0f1805c659aefb4

SHA1
efd2907891bd8e70349604acfb84bafe59c9b7ca

SHA256
0bf24809081c9b7171da935d61529a8a78786671506cc69ebf2d975d3af4b0ca

SHA512
fe5d5048f6c3cda0f1551a3dba81f7f627c1dc064d54d6d65dc6363f1b19a7a90505209959e06f6d27ba546d3289e68ed3f26b58091fb2ef9493124760d44d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b44c1072f6ab453d96d1029f8cdae08

SHA1
d8802853b56eb50565d85b2f11c0da7955d27760

SHA256
c543a9b5e2b579b45d329201a812ae6d9f41ac3701003652db1125acb7961890

SHA512
6b8e1179ef129303cd220c85f016490ac20d97084d160104c156b310e46e6a06008d5c164206e11461db6401d2172d438cbdf6a47cf5b72ada29d3a81a52f04b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40971419d8c067f362830445824cae90

SHA1
dcd4e39057d93031ed6f8fc9976f81ad6ab848b4

SHA256
3f3900cb7ad506bc02c0339f2af386a32431cc68a42dc8cc49bb5b2ba06a4667

SHA512
8256fc2358b8612f1fdd9214941fa637cd9ebce264c012f0a327a46e9569dd6f95639182fc30ce89ff7cf89f21ae8f58e9a0bec5026a5fb1e2b782543a47c6e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee9f17449563670056cb293421561a9c

SHA1
f9eeeb80269aa9ae5e127e8e4c5bf931a9480538

SHA256
1b23bcd12496e784937950334ced8cc3276cff2daacc79fd984cc5bcb8b10d01

SHA512
50fc377cd29ce9ddfb42a1770d1105086cbd327143702dcae579fd2927fdbce7dfc8c54fa004f712fc888ad3063d58352562885c28598a4b0b40d7f35474a8bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aed113a53d11029f8ab0e0e8e2474516

SHA1
40ae22af3229b805f2c26d6d0ed7d3271067d0cd

SHA256
dadd6056d824a6b39c3e3e78b0192e9875e1133b6918d97ce2b4a304270a49fa

SHA512
15085cc4d15ab5ba788e5a5f717b84cdaacc97b95cc9ef0d22b7f1e39d60fd6aa059d34391a073486852488a1cde685bdb69a5be02a3930b2a85f7af28f171ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61174daffc8289b24e8d4b4d455e5940

SHA1
07a9bd96e9b788e7f75e31d92389c19730ac3951

SHA256
35e1a71569d2dfe015f01ea51b682bc010ce244d255f79cce786f78a034b7d40

SHA512
b7964aa05dcdb83fbd29c0113199dbd7198ef690ed8444ab302026c9817565817f411859959be4e0be0ce1c6b5dfb78a171c7db0a0383e27e3cbeb5f6201884d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
660b86fc8ba490fb1ec624d1443ea190

SHA1
a2ad1f6c282e26f0917b2760dabb96c0a102d106

SHA256
c82e4384029b3c73180216643cfc240bb88fffd0722276b154490df75cb719d8

SHA512
60fa32332ee5e427c221b59c3c5f694ea0027b69c03ef8770013a22d561565a186375423362e0018a2f189bade38631fe81a2dbb6bb38d461c6cd6c94a613d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfded85c292a29f58898f2025adbb648

SHA1
eb3c6763b6dd9ac7a3649f525dd81239e56ff952

SHA256
23891f7523e454cb7c64b0d82315c8dcf00f6ed16c57a1e0f21d9e07fb3bfaaf

SHA512
9f270581d8ee9829fa152815fc8235d9baf259be3845741170d5929ea841f68a5133be37a3267547f656bed78ba881336046da80a2480a892345a42f85b9fe6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
000942d48bd176d3b13df611703d7b8d

SHA1
ae961b73a38af1de5094a3fc25065bb7d20be2f1

SHA256
d57d87e9b640b819bdf48225e86cd8e2dfaf3e70d9f7527949b3830eba1fb23a

SHA512
4436143fd8c238a0d79aad103234c53a0d6daabf3487894c82d245b85d564380c4e10bfb7e5837fe8c97742e7ac327191aab22186e90a77e4aa666bd138aec92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2875aad804786de01c13b74efadf481d

SHA1
48ca44b85a713bcad76d6a47268b6613af6e1d7e

SHA256
e413cc98a838850bea1fcd42e74f449fc0cd1019aea5c2ce714c4fb3b2e5fc5c

SHA512
b2f16211ed1ff605f99c62963be5793752cee8853dc1a5e240966781fcbf562c6c2ed5c604ab695c5688d0d62212961d617302a3e307b0e08f924ed2de9c1ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c2d6456cf520ac8ea040626dbd00fc6

SHA1
61f47b4f64cdbedb560fadab9a0ce9eaf3f7b32d

SHA256
06a64730bfe5c41bea41e8c17f9f0017c558d6e0f6c041e6790a75253d4e720e

SHA512
ea8b30532649286cae22cb946452bc6bc13817713f7a2362d9965859266e3c81a5aabf824bd6ef16324a71660ee3c4951c17849a1b22f4d1d67e8bbd46f0b606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b4a373f898bd7735334dca1757e8e69

SHA1
9d333ccbfd8327676895d6d449c880616e5018ec

SHA256
099d42211597fa8c0ae26d6285441b7480ad3cb743409571d5e7ec645f62f789

SHA512
e18c9cfe1f43311aaf2be243270503e2473bca52e156f4b37e541e9f63f055baddff61d11715aebb675bc0e0d47d3a232d3335e9abdef0bf36f5c8ed1a836c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01f99edbde5618f3767031e12533031a

SHA1
933a489a556c5425929e8eae297ee5e9e0f65a0e

SHA256
520d2445f4e449e52ae1e73a3cf9798ab627b5a089a876ac7d8298ca419481ad

SHA512
7fbf8e35855910561855701138490a86aee3f4c17f0e963beffe2a4b1cdc9504e91af0b2ad537364bf81241b7377cf197e962b7d7b5b9c00f2d51774b1f822e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\cb=gapi[1].js

Filesize
64KB

MD5
ee01651d160cfc55249d6011a3c45916

SHA1
79d6121df6575974ad21dafce33ec98e3f2f0a7f

SHA256
639d75299973c7d3794eb7eb129e3b5a6139f9f521e1f14383abd0fd501219c9

SHA512
8a39dfc1ff2c58ac106225976aafdaf7befc0a28903a0c65e2c272e1967c3336af2b477ec12604400bb8e16aecee6567c9cb9d157e3d54649e28b9b2f920432f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\rpc_shindig_random[1].js

Filesize
17KB

MD5
f019fdda31635d2a31b151ad8ad56c7a

SHA1
6adcbec55f66ffaef83d9a134423aa98eb2a2189

SHA256
c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831

SHA512
fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\478691279-postmessagerelay[1].js

Filesize
12KB

MD5
92169c8a0fbf6e404267d0705cdbdf42

SHA1
a5cd88b74ca5ced239cdbfb458fe25540d671f46

SHA256
dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384

SHA512
8c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E4D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E52.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit