559de345e96dc844b9320b5f8ae4f39031ced3e416a678a2fbb4607fc83d43fd

Analysis

max time kernel
120s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09e9c89f6896d19b84a821526bb26feb.html
Size

3.5MB
MD5

09e9c89f6896d19b84a821526bb26feb
SHA1

9d1d219a2d655a880fd24141a956da2c8bc6ffb6
SHA256

559de345e96dc844b9320b5f8ae4f39031ced3e416a678a2fbb4607fc83d43fd
SHA512

4c1522858a317a9f08e0390867d908306c915332410d9e16cdefe61962c38f5727c213848b58369f864d76188a0b6ea79c8c7d4bf9886eea1de7a87c06b9a590
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NfV:ovpjte4tT6NV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409613307"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10184fe3ab36da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d7c2172cab4873208b162e21338c32009201f078891e7cb3f7a12e96ab5a664f000000000e80000000020000200000007f1a1083ed1950ae39fd965f4daafbdf012f89b2f2a1f83ad1b5e7e23531a4f9900000008f45b34606eae3ced7c8ff1844c042d1a39b9750de1bad518edd8eb30c069ec904a2a20f1db7ccd4819122195f961c27199d3b2f2db5f6b15df02e0a5898bee3bc4ef9f92368f0a52b700fb7e18310aefead359c4f8d46b14da3764f434bcac1227d348d6861b44d7fda291305eeb410018e3ffea884757bf306dfcd4ee86b72bfb47789ae79cf2ebe7d45ad39369b5d40000000ea25ea808dd7e87918ffa2ae11b6b367d691b7b65d8f93dddb7aadb3ff2be66cc0585590f7508afbdd81aae260362940e68d8484d4b8fe466af8720f0606b927	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF978A71-A29E-11EE-971F-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009e2ae8d055211bceb2b4e749aa58298306fe46d35764392854a0b47590d5484c000000000e80000000020000200000002c04f12380670e1c80577553fae4b94551e0069950a47015adac73ed10868415200000002073c27897fb5b03b7c78f2b362ba567a83954fba6083521d5781fc5a41ca6e5400000009922f1ce91eb895e5cb2afec88f061e5e7beec8b0cfdaed9d6b5bde9f49d74c09e00692c6894d041de97ba9144dc29e942dca2507cf15b05c6e118b904a847ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1836	iexplore.exe
1836	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2140	1836	iexplore.exe	28
PID 1836 wrote to memory of 2140	1836	iexplore.exe	28
PID 1836 wrote to memory of 2140	1836	iexplore.exe	28
PID 1836 wrote to memory of 2140	1836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09e9c89f6896d19b84a821526bb26feb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb0d3b21fb05b42b2fd52402638b230

SHA1
0c841fed440b15c1b184d3f808c00aaeff3d65a7

SHA256
6b903ed433fffc0d4d1a91d417b43e07ced48e39555c97b2cc3c0a8ff4da1eba

SHA512
2346b222a72b6c54f1aa71be2a6462fe7698c2553893030c71644c96be4c2ebbde83e2fd9be268da674e18c76688342ace078dca38211331c0c61ea8b6883db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0122f192efb2b6c192708547e8d5ff63

SHA1
aacdd5c3352ab83ecc8787325974fa886a4018fc

SHA256
d647478b1315c36b5a631fdeae5bc4171fd2062a95f4f3abe4182d0064d2039d

SHA512
e52a659c1e162be16f1f7be8924013432b2149b14a5b4eea719585983776f6e9f8f7a56b806929e237e51bc61eb63c5e47b54fe5755c4bebb81c1c6b5d407a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e48bd5c81c6cefc24bf6eb94e72d3e

SHA1
7a956fee97523d388b41982b7161ed9263ea6c6c

SHA256
d06b0cd38ab2b85fadea6ab9b35a0028cefe5d5e02724cc5059d227103cbe2d0

SHA512
6607fcfbe2fa96a1fc17848d687b2783b0dd20df12702374be96ee70704edcd9758f4def06547b935e3c8944cbf3943cac2ecab5a8531c628d3139186b007f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3ffea6bc4f207218ec351175acb97cb

SHA1
b7e5f918a456a7a63e9e40347d755f938c1eea9c

SHA256
727fe1f658c3b5948934b4f364deeb4ae8943fc9bef633c7a7923a7e2e8cb6a2

SHA512
02ec4b42972fec78ff2bb0ba11a26cd1ecfeac017269c44614e694ed4e9b67353e4701e180bbe423e556bb02f84b984669dcf951f90a1ccc90a53a74e19af581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814d4910678b025171da4200471d74c4

SHA1
80f0c4ab09f0665dc5e976e7e882193862d4d2ff

SHA256
1cc3a6074c4f4fa9f0565ee6e6bf322044bde1cb7514aa46c1638ec87a37f28c

SHA512
7c2054e41362e55b82316e49f3f91d9b1aae864dab8f996d01bcdd487f861a9528c3737f0439d04f002f253a5099304f2f161e3364a72b74adf579b9162f64d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a58f649ea4bf4d61cf28eb1bf1856d06

SHA1
5e499d34091023620ec879a734c2c5936d3b689b

SHA256
4c46e8c7b40f51dec239a08220ee27c6bfa97211f251705770fa94da94ca8dff

SHA512
2abcc589a7fa24ecc447167e4d0dfb033c4ff94f7407873c0ee1b26d2477d75e845ad5d2bedda8654c68c8753586ba1360b7e81b83b42cd5fe0132df38de5049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d107b8dd791bedd3cc7710ae13c00410

SHA1
d6f20bc86da2054c47cbd1593edfa23b510da01a

SHA256
c67bf92a3f6fcf0476295089247c3cc307153cf5dbf5bf516bedf5ca8d7530b4

SHA512
b331f1077b035e056ccdd2ad80663e499b5416258428e3ff218287e3052913aa44dc068456590c2355b8f07e0a05a1c1ad3e12694671230765afbf8741718902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c87bcd07d9f57abb942098dd5e1b69

SHA1
2d31eaa01de4f649528b81c9b509fd030a92c225

SHA256
661236c702ac57d011a73c37a593ad35f1a4ce1a7dd0c68602b93624f6f6a831

SHA512
ba7906b89d6edcf74363a90babd1e9092e743f49675358c0ee68cb8bbdc07aa7e54aaf684169df294bcc34cd0585ce00d02b54639c2646a7600dc98ade6a10fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
908148e6fc9263cd62dd27b2cf145ee2

SHA1
93c4c37912634cc97e7d74f059611c6c79a9a6aa

SHA256
66deb9d0a563b87f024e33a29764ec208b2114a24fc633a10ca5f6f0e182f33b

SHA512
ba6660bf07fd4933580869f2a6c8acbb54763481d995aeb48f2ffc87fb3a2ccf7db86a5719956f8b4fd4e90767791144a4a3cdb7b8290c1af57fcea2beae2f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b4562e444eea29857169e6558a1c7f1

SHA1
5d6af37030f85e9ce7e936acdba43c891f402981

SHA256
b94ba48426d334a0e376d623ba878f9530d25c8e1270f69a0a60a62740bcc560

SHA512
1f7d5ade7c3ca567d5c29b5edf334e74703d4358784bf70da803e3ac978adf9082359e9ff4711aac5d1e3b3c331ac7658ad95b53a2403ed6ed9c6ab99d72cc27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58a78753dbf5d5808bc16bb44fc2fae3

SHA1
d40260d1e17f5c1e98ade3183b67c826c376b808

SHA256
76f297bc5b15ff109e6019869e0e6bff4596256b11185fdefec4a3fd62a4aa5e

SHA512
9d519e65d60c152ee3095ac3f3d69a863e14e90fde5406af759ec89719c6b56a891d91fa8e845f2dac18f7621b46737680222d4d7773a5a37037dab0aa36fe02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afcba533b0365b14cf7b041973baab7d

SHA1
d4322d293b2e0fd087efae47f52795d79b6a687f

SHA256
eb6a36feff0dbec56a6768b7b2d54a423fa3ccb81b49decb5de50b843133683e

SHA512
606ac9477b92d58842fb3bafe6f58134652c25f8d67fe45eff72c63deb5186989e4899c70d055bbc7b783cf965a38178816800abe7138b57fcd2fc83f9060261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50142609d1a9fa59ab8f0aa8c4506b36

SHA1
22ee3f4ebb7e572560c5d93c95e739ff5e532920

SHA256
be456cc3ffd5f4e11513cd39adfa7c7c4175f4531d668f8b08536350c81f2df1

SHA512
68077864c9499d909f767be6f097c9f5c3d80eec9da112c05d0896d1f8cd300f14390b2c1b6da4cc922df90e8a5b470df2c09c890c7fa513b5d4f9d419728560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6CE8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar79A8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit