774bccebcc9e70aa6e2fcc6538801e11b05c04bf0164d29d25c8e08d155eb62f

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d14253a8f2a4d6690290f579368dfd2.html
Size

2.4MB
MD5

1d14253a8f2a4d6690290f579368dfd2
SHA1

7fe72201aa22c8520332a99435a3964df19b2bfa
SHA256

774bccebcc9e70aa6e2fcc6538801e11b05c04bf0164d29d25c8e08d155eb62f
SHA512

64b30ceb8715ce6c4c21a7a128a962196e8bca1478d93e3b3431d4668071f1a2f551a1458ac689c167f435737053f1c327515cf6a37a48d050777466b9785e0c
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nqq:jvpjte4tT64q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002f586e21bf74dff8a864467f656c26c649714667d079a557a717f901155085a1000000000e80000000020000200000000557a99aa6dcf6f16e1e15449a489df9f154cd6b55b102cf5beb4ad57832cc4c20000000f5695ce4ac20676c39fb93c507bacb5e22825a17c4799fa8eca2f11375d07b1b40000000e9b0a2b6dfe438e71ebfeb97c8ca52db6162e9d43e131b6234b7b662fb3fae6d3aa93b8609a444b2ac46616820e386a56fc4555f8b04e5047525b6bcf9c3fe85	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1019298dda37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2206FD1-A3CD-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b66fbae6b8476164ba79ce282968b5ebb50bcb9f27edcc433fe902a9871febcf000000000e80000000020000200000006aa858c492848159a5b652bd7c7deb48995be09ead9c57c9ed2a0e35cf763d0c900000007239140a0de999c6ba4fce23e6303d92c8f528741a95adef788ba81bea637128ec5016c1907d381b288d19a1ea8b7c6d0552226d7f1a38da90a00df27f7d2a8521bacc993c30d0668af51df06606aada2c44fbd7c1680ecc2d39e3df19e9647228f139c2f9a74c6a1fc54ac65d15f8b18a4538abe0256bc072fdba7652a26f740c5e5b0319e2e2546b032324f5cac5cf40000000053dbc7e4ae8cad46f806733141ce079f62380d974b2cf43f9cb2f46c9d7e13616c7c892d20ef2e41e5444b5c2752d3a4759e0d401e4188f1742fdb632604b95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409743280"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2176	2108	iexplore.exe	28
PID 2108 wrote to memory of 2176	2108	iexplore.exe	28
PID 2108 wrote to memory of 2176	2108	iexplore.exe	28
PID 2108 wrote to memory of 2176	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d14253a8f2a4d6690290f579368dfd2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6427d9669f2b5298fbf161455068240b

SHA1
f95aa9fbbf7bf31e12a0ad59427498061bcf1e9b

SHA256
86a98c3289753cc5b0d99596470d919acd30c9f08ef0e133ed0e6acae25ef994

SHA512
9a2166663dbcac7c4a6ea14a5827a9f6ead64f22e2552d6f571eb1dee688837ba3b73fed03c5d3430fd7ffed1e184f4abdec8aa5d68211d6d198be788c42227c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b8f42d032589317dc21db1626fc3a32

SHA1
ec507b57205ac310cbba3ec3bc5539a67ffdf14e

SHA256
16c6127b6fb47c3a7555db73383d58e3c2a463a07d3a3d991ef32268111eeb5e

SHA512
5ffba2588b7b0a64c23dd1abf92f14d753ff3141c308f10f492b24b523c1c2c82d0236989c7be1de75b4b34892b74b0457418bef0977cfdbb2001b1e903278fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c56665f2ca1cee2cde1dc09e3fcf76d

SHA1
2a9063306cd3a5f0b5d828cebece6c6e1f71bf39

SHA256
5a503dc84ded29776dd6e8fe3ecb80ee1519597cb6a8b292dd0e20a2fa6368db

SHA512
1a2606db356b40d341feb4f43f60299cd1c25f830408aee6128415031ef6142a9df030d6bd2f1e52bee5c368e07ef141c0321666b787f42f21a038d91c266b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4bc3223132239dc4d99d8238c3d10a

SHA1
49bb6598f447c22cd67394c2a63d472c7adb1a06

SHA256
2f53959de6c6382337bb3fdf9b2b39183f79ff4f3071049394a36c5417bc69f3

SHA512
5c424d901e40eda8e4b74ae8ae922f0ccec7fcb2b2a88b128fde1e95c6996c77605a42e5b536e6d9700da66220a997df0006812447bc9f3df965a78f7d2df555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a481d25a698bbff890c03de14ec0d3a

SHA1
ecd6fa0124cb0d39382593fc8edde96ea3da3ebe

SHA256
5c264f1dfc992b97f69d22018c97e4206efa861ebe58d914bc2dd44d6df666ef

SHA512
6d226e647bc2b8ae0b1d8dd8982de70806b0816232b252d5af645cdd8f26e078c0e2a01d4cc72c5649f4fab1c7c2fca9c8a0f7945a8fead1731ef9064aa133af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9729d79890a925c450b7c97d7709ed99

SHA1
e424b3537c43305848063d58f1153183d11e2904

SHA256
dcfa08482f52344fac7411cd8e0f5b705914959e66b2f5b793026228d32c4294

SHA512
18e24fadc6b9891d2a50790866209bf1f5b4a091410dafd574ea48e4d81788e1ed12ac0cd30e22d45aec57261938a8be715f74efb97a780104f69d53ea281667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2771182cf126277dce09a7d5f14d3fa

SHA1
26d63bd002961f92e34aa5444ccac82ed37ef2a0

SHA256
373ccd347d0a2e6666f644c81dbd9105258523ecb4b1222af2b5c5db71c505c2

SHA512
e488cb673233f19354b7beb64525c9e5d3a71aa8ac8442e0439b2f01403f7621a0567db1807a5e92adc5b59aa43a2c1ea456a1240654f390452f1922a267a92e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f22558c6b16c77993985b44ca0ac94

SHA1
5bdb0cb9029add240c31da7be5cecea60df2857e

SHA256
2e737556ad89d1b092ecf109b725cf5f59da3b76045c826428a0c175b59308d0

SHA512
f615fdebab1150ac6a69d3c086bf65a41429797810f1ddfc696e8fc2731a3a92c2343bd117d3e32679f031c1824e54e4451665769cf4939479eeab5e6cd7a010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f84771d61cc91087c8cf2c64e129cdd

SHA1
f619130ff5e969e62d180a2bd7f9683c9e6b7f84

SHA256
dc0cbaeaa269453593ef02ed69ef3820231d97acf433544e5f0583d4257197a9

SHA512
de212e91d70d0851a674c9b4d532ee5adb52491605ea612ea6b2f803216a209e50ed5155826c03a2c7db3ea880da15702907f1140bcb05b0628067bc19ea595b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b58094981f0e279d774f28509b11fba5

SHA1
88da4b7a3f083b003f2b815a4f1717eb7c9a271e

SHA256
4b4d2da3f70ee9eccb54f0b4ee787037602c8f6762daa70f90b49d414a9cd416

SHA512
b41e94a69026173169ab4e73ff9abaac8b004a991198e9aba2d698125cdc9ef76d29a146b4f96ae4dad7bc2f2259bc2d8d544076fcbdc6868769d5fb6f132020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bbcc3b7bf878a6781ad8fc8ae87e62a

SHA1
09060649d641c57e37d66d00f31c242e4cb1c5bc

SHA256
dcaaaec370cdd610cb2eeaf36ba10203bb007c335408c4cb433c5c96201c3fc5

SHA512
a91f3908b54cef5730f6fc0f3e7746174a15b07a362328600080bd05034d57c063311b1266a63156db6ce0ce2e641ad09c56889a2a8cb10e03bf513a78e07c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8597ab0849dcf5f7536190e9efb2176

SHA1
a6debed7921c1b2d8bbdc4e73281638e893da79d

SHA256
d023def641f7876769cbd98a8628c398fd1f23782c96817c5d2dd64ba9fa1fa0

SHA512
535c1c810760c6e50f9f937ef52ecd55ccee7b56844ffb0af103dc8f93c9660802a9a23256f0688848b1b248554abaf548a9a4232256163c08d6de000b218080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d450d2aadbca9206917451ceb36c090

SHA1
de0542d2e4ab16291a6efe1fcc040e58f06b8b1e

SHA256
ddc22184d7ffdab3325d9c32e1d597a1eb80e10ffe4d6446b2ba5eba6411d17d

SHA512
d1191ad111688aeb8f5f4a384dbf375da80cff2d2a8687d5e0272b968dbaff6f2c684ca7a6ecf134f3476e173fce26bf8036e51781addb4aded7a659f06dea97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aa7aae325d4ca88447f0a2bd0679bd6

SHA1
7a61cb3de5d2e5ae088339dc4edbccd0f39ce1af

SHA256
ba35cd2f6ca8d410a51454e56b7f65478ade4bb7a7916a0b818ae642ff0ed43b

SHA512
aeb6d0c7a2b0aad019df7a74057dcb649d4c79a2352c052cf00cd116ce9d8c307081371e7647bdbdfebbdce12839a42998bda73d1aac2931b5936345b16645db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffcfc8fcc2f19ce0559c1f537e4286c3

SHA1
8ec0c6fb4bd99ae4a865d77b59171491bf548260

SHA256
f48e5793a0a542c23a85349fb43d1ee1fd76626af628962cc6f2f3e91fc62070

SHA512
fae3aab605469abbc21fb3a82a9f8e0892ac1f5f6863fdbb04f5625742d991792072a5629588490f36984533707991e039d2cca16baa9198ccdf23f6e5739acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar91F8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit