f4711e6a9920eb8603dd2bdd3768a5a43e1fec8216c719a01d0014189e0c107c

Analysis

max time kernel
67s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0abf38335fe67c34eb53cf953e2d6639.html
Size

3.5MB
MD5

0abf38335fe67c34eb53cf953e2d6639
SHA1

fdc577f93eca631bfefe213dea52d33b92fe0f0f
SHA256

f4711e6a9920eb8603dd2bdd3768a5a43e1fec8216c719a01d0014189e0c107c
SHA512

45007d2cb366513c3418ce1015eb7c245f64f6471c085b7ed474bc0dd329db790ac8d43a013d4cbe23aeed796e429cbd314cda28c1a20631147d98a6936fb35d
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfn:ovpjte4tT6Nn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000012638820b598ba6214bf5f4ecd6b021e3f6e04a5bc2efc331c5872766af081c5000000000e800000000200002000000012468bc721c88641637da6fb4efc2032d0672d3959edb6e637b6cce9f0b295092000000044212a2b36f429f99191f7d8e1a0e4b280ff073073b959886b31d38aa681c7534000000076fd488c7502b5cb87d5d6adfbec9644897101fdcdf117fe61d246efc05b07fa7756c538492e0dec425e6bfbb9dabb7712d6ffeb35f363c6bbf502953864f235	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09c849c5737da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000083753c0bf16f7bfb356aabc81f442ad58460c724a0f6edd348ebca87ab36030b000000000e80000000020000200000006f58afdf401cdfef83c8b32b1009c37ba5f1033466ab011317f6098d86259d07900000006351c35e8cc8edf0d1cde98caa23d879a2c0abf41aaa7b4890ab6edd9a03a1fa1c520511566a3f1264bc1d73f0ca8c41ef3aa294ad11f5c43ee4875ddbaab11d6f73e5534c677364bbee2af1e83951b7000e213d9faf103cd6c0ad0276014325c1eefb935872903f8ceb3ca99f0adffead041387f0f592ddb088bf0adb25bc211aba5f1a4e27d682f564b4b3de80fee94000000095a385dd2a82a2761d801ee88d6f14ea4e510eb19eb195269f67d623355b55c17023126aedb98e0e5fc6a3f274e07cf7f5e9081a4d17759f904203945d2688c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCA2C7A1-A34A-11EE-96AC-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2800	2916	iexplore.exe	28
PID 2916 wrote to memory of 2800	2916	iexplore.exe	28
PID 2916 wrote to memory of 2800	2916	iexplore.exe	28
PID 2916 wrote to memory of 2800	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0abf38335fe67c34eb53cf953e2d6639.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef9862780775b07112b4f3ca84f2a37c

SHA1
c323ead78277e9cf92f1bfe8ba9de60ed3f03c90

SHA256
351e9b93b4f95d3c07befd74c2ca752bef4247c11be8034b67b7af177661ae2f

SHA512
c19cee85bdc8c16d1c12bbb16b3cc97b44e80d0268917e3776e42b9f8818045303245f523dc3a487844665bac6d9ab7acc7eae304293e305c1bbf0df590ba8fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8411c7245db7a7cd7bb7a4b8accded23

SHA1
27945d70f35566d814dce84c93089c4dc5003f30

SHA256
7ac842e6644934b44b68c5248483d6102b791a854cf76664170baa85fdddb819

SHA512
25dae9e74c530ca28cfd51df39fbcded4ca78e406c863b64a7d52af49a5fa06975cc05a071ea9f3cb7033267f78d97b07187331c943732969f4b37c0a7bb6db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ffaa4fa69b90e2163cc0481184dd126

SHA1
999417702847dfc3b51502d23193238637840aa1

SHA256
20b46887a4b5e59a90dccb15b4bf5095e13d74113cc6c910622a7c0a9b092c88

SHA512
1a0a3d0d81dcb76216a6fea367d819b0cc7a2acd7e4b0c31384e371808f3ca2ce034793a7fbdad8e14f5b321a4a3c9bc9fb8275b222b7600c25ed300348de780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f96da57c5cbacb1bbe97db5401d5eda

SHA1
3899642d515d8919d15ffb95a5807511b08f63b7

SHA256
ce9bebb002627a20e99f515ff1d90fde948a0f08f5edd25d5853203487d7f1f9

SHA512
1ccf473f9c5589426c7c80306bdab7d578b2192fb349d1c52425c903459947f2ec64523a876693fbc82b84d11c5d6535984fb44e04c85371394ec905cd18dfc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90d1ef168212c277db898e96308b8a5e

SHA1
9fd2040fed36b28cc73d5a02d3269a32488d8bd1

SHA256
16c3f5e68ffe0cbefcb216f3d872593474bea50e649c8c47d9bb540257e0b5da

SHA512
8d6fb4d1556c1decc9be22b26150e11f9563226e87142121c3a806e89b9212de15f2946079afd01294deb1b69f65d314f039d12458c0508f9317d40c08be0271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4ab6fcf161399f8cce77dc22424c798

SHA1
6fbd110e525fce5fb2bd0b2d7262f0f140d325c1

SHA256
a796d6a6e8624b7a2c6d50024d41ca7e4fbd295f55ce61c90e53f911773baf5b

SHA512
8e938984607277cf96d5741d9a45e4908f3f30419c8f173d510c425c10bd99611be8b8321010a125f8d43965d673dc7fd650fdd480c23349a4203a5d12e8dd94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944ff1b4f66525fc3216fbd35dff2b57

SHA1
51ab71ac0f83af80027d84c78a0ddedade84d984

SHA256
96a1ec86dadd5175031838c726b938f6728ec84c8de6a0a42827dbf5f70750a9

SHA512
3be154b13523f80a8b0f28cea594d96706e6d591b1b9485539b257ab9a293103797d024a76cd6143d919ac614c00e20714d3dae67704d6ea9a2c6def49e55c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26d6383ac8a1c5d05b986792d7a899fd

SHA1
18cd250aecfd88c8da9e697479e1627c44f64c8b

SHA256
e7515fcac630d85b4d13820d33440b186e9488de9682549fc3828ca732fe8e90

SHA512
3a0285f4208057c21bbc6183ca233c4bec0c1f9d93c37b2fe056ddc857ce236a57ccb39f02107fee3eac760b56242b9ddb87830ced93c7752b83821d390313da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4466e64d3a9c30afd3713c5e27890cfc

SHA1
2f280370b9a1d5a3e02a06564983fa8f9af90972

SHA256
76168661f94733ef93598ba3e16c79527de3f4ba1cda44878834ce8a64ded603

SHA512
915caedb1f799609723258f6018ba28998148f5412b11c4823bb83a67d99a7b0240658f5b7be37edf0cd20b198dcc87f9d3f304c984fcec8b999505a042f511b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c1c938088d8c6ce1f19b0de1faf274

SHA1
25767e7479fe3753229bdd6e9615eb308f788a5e

SHA256
8c31d296c4c4e4297d18286a87d2c456bfdbf00952ab70b34dc6963bde2c2539

SHA512
142f6c75e651eb8b22bae9a4e081f303136e45623a84a368baff04fccbe553616035fe7368018c939b2b57609722d7640924b491bb399af60dbb94b60092cc84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a3a1ed1288c9746cd33a45eba2359b

SHA1
c705e99f17c0e48b4aa2209294e02348df51d563

SHA256
07c054f71cce94056a66a731d008fd1cd197c1838c460fbf0359e0e93f8a77f8

SHA512
bc9d3a7bd4f0876c6dcd4d45ade64e58c60b72753ebbaa0404acc5efe1a682c096284e874392ad77ec0c9385770d991a1a8614716d0fa098c8ce66bfe975ddaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6IJYZ6B5\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17E6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar197F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit