1dddfe7640a3ee36b4d779f3fab434552417eef6134d0c0a7e56ae1a964e973a

Analysis

max time kernel
152s
max time network
175s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1102efc18073667d5f428ff830180aec.html
Size

92KB
MD5

1102efc18073667d5f428ff830180aec
SHA1

f23816b6b83b2e9903ca197f4c8228e97402ac5d
SHA256

1dddfe7640a3ee36b4d779f3fab434552417eef6134d0c0a7e56ae1a964e973a
SHA512

52a874a7d5013f3c5a56cd1bb9c8f2d606a1253c1ab98291d9861352ead6085a347e4e36644aafebd2e646006ee3ed5d625257b6ebf133a8e51fef76f7e57719
SSDEEP

1536:lDCHH5HLE1xL/fhmGrwodqhNN95RutBEd5:luHZrqhrwodqhXRutBEd5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000142f5392c2a7997138dc8b7cf9a813cb4dad3ea4662eb2e0a61da3ab0015475e000000000e800000000200002000000070f6720885d4f91648ebd49d92358041a102e418d1950f0e3678f11f08d2532090000000c2ce12824e18104872c7339b812f784ae28b6e52c275ab4484ca477374167b0e7d623f399886a7fdc072fcf4c72a2198a3ad3d351b56c3a89317496349911e3e09e396ae952f27118e52ee2baf3faa7dcc0771d2a3aa5ad4eec1ee7087a87bf860b8e915c0d22c091bfc776673aba75acac176cf1cc318e180bca0f6912cc8e1f4e197a456e7ac2f644dccb02d66374140000000f6ed4023871592f2175de1d7954f0a030ca17b2a6bb759abc4b799f3582bcf7608851545314defd6a5ff5df14f697fa87e785eef9ec951dcd7a642f5433b3558	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0eee638dc38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2478DBF1-A4CF-11EE-93E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409853883"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000067e3969c8992e6ac6b938c3446aef89b42a7d321a0d2fb12442ccb779a0418b6000000000e80000000020000200000005c34fc2a0a00eccc9f29a501f0d1cd95a66408cba555280145f872d154e5c3de20000000127a5f2abb65324cfea81cd772032b0fab200515f8964b1ec4f11e4a7073e0db40000000eaa42d11a2d26ab00916ae6f589b8ba4086f6e09cb5bf14dbb9cfe27a033e235a77e510b8d50b8aabf4c3b8f76ada17ba875a7ff267ae92c5cf50c61ed1c2308	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2700	2684	iexplore.exe	28
PID 2684 wrote to memory of 2700	2684	iexplore.exe	28
PID 2684 wrote to memory of 2700	2684	iexplore.exe	28
PID 2684 wrote to memory of 2700	2684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1102efc18073667d5f428ff830180aec.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37815fe4229f3c66c6fd83b8ca299197

SHA1
8d95f2242572cab959dad1dc9417306b3dcf92a3

SHA256
eb39e517a6d6aeb66baf64687d59c669b15c46295741ef84c43ee4f8ad037934

SHA512
bfb39fcf4f3ef05334047911f91f166f3707ac0165823c15220be835038cd2257ab3b21b3b141388965979231482660311865e3634572062e28c5ddca1443ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfefa3f2cd59c5739e4b0cc2ef00c66d

SHA1
a5aabf5fb36ad8b87a1b3c47a72fcea9efd23457

SHA256
91118c2cdf8e77f2866c6888e2b6adef089690dafaa7608a3b84c67fe19c4d53

SHA512
98e4b6a8f043d8768ee9aec5f6fc4d78653da35a30ba5617a142277419f8d3b45cb8ab4ba0e9b4f0bbcab64547761103698064d3fb832264db3d1a74a57ea3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08cabd0c135c768c6abcf154e74f447e

SHA1
de6ec368f3807147248ec788b1a459dc3b026ad8

SHA256
3dd8a2f9b1e923b1a996f164f40f9d2e58db008692c027142c9d246fe91f800c

SHA512
60ca63e8dc9e4747beb382f5eaced8c22882a300dc79ed7651a6a36ff4c3dfb74c580c7e00050edbc81e293cb0983e8c68cbb8eb8ce6fe944f6f22ca540da626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63db0389d8214734555bc6117c107eb7

SHA1
baa87eebeffb9088c6e4915db25a0741e0ec07cb

SHA256
beb9ea03fe7250a415dfee7700238927eb6c31c35f84a7c566cca95e384692e8

SHA512
db86e0dff7ec86f0a0a6e4d7399782ff9baf6b429bb5fda663e08aea4375fc1c9f2b97d2194f3397c313330194b3ab3f93cb707bd591db98fc351d510d8de451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b5af97748b473e573ac24e2b6f3767

SHA1
c31125383036f393a5d1f3fb5da0c58bd6c989cd

SHA256
fc193f7c048f59551c2118edf88e1f550e306ef277588f1f53a971541d8e83cd

SHA512
69b1ba7d3f9ed6c92b3e6b6d5e418299876750e9c1a9a1abcc756d850ab3fe39479b1b1360c7d2088082913f320a100ddff92cac5c304b4dba074adfab1a0af9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efc8bc01680d1667dd496a5a9f1e3a70

SHA1
674ceebd77a71d2388a60ab7d1618715ebccd82d

SHA256
693c5302e3fc11bfab783e7f9162e0f0da8b1c80b29889d3401384e83e1a071a

SHA512
5b57e8174a57b7a6210401f6c0639029e35981f086b028e87f721c3fdc40cfd9795ca2282b5dd7bd8381ba7cd7ac77cfbb32b003ad3722dd6d9e6270988b8663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2208b3daae7067ae9fe21008ae9a9e31

SHA1
f7769d37a69cbf57445dea660dbb157ba46d91e0

SHA256
017950967d5b00cb35e6011b31240beafd88b7d9cdad220dbd5066778817678f

SHA512
6a5adc684a8b6ae02974a50a2061d7a296b2844e646552cb38c99b664f7be18cebd15149c05bc6bfab2b4d60532740c96326f1fe7f556547c5c2e068cd85eb67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be4f3ebfa83f5952a4d215f3aaab4782

SHA1
a714b80526c875618f5f5d900fa5d51dd64d2225

SHA256
16f9d8f5f647cb972e070c1042dc242fe52587185c569579d438cc47c7a60d3d

SHA512
023ecdf905a6d38818881fb340d63466f11add7da34e6435335fabf0e709dd6a7e40e9015070229d04f0d0fd95ac84c5c2fb8082110cf622481458f54f7dc74f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1c1bcec9b84fb0b9aaa03c46771bb9

SHA1
ea848e1947cb551d61bf755c1fae64a57ed7215e

SHA256
ab3039580cf8efde989724cab36de70738a1f5d160c477e98f78a3beb7cef105

SHA512
832913778309482113a5afd522b7f05fd020e113dcfc0ac069f5b4411ff9cd6615b2bbd2a1e19fa2eaf0abecec1ceae056f68cd378e922400429cdf4728c012b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d401f54f5ef89587ae9c1de4e3f2b3de

SHA1
db02073a565b9936a4a641bbcc30d496c10ac097

SHA256
e33580ca031a7a164b6f9c4ed567eab69748d338a2306223b2ace365cc507453

SHA512
9a3b63d2364a4830f903427fa43ecf8289b6332d4000cade032379ebbdd272139dde1f98d778ba2f3e64d73b2f8a4d51e013050f8a4fa063f600fe9ebea35628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3f36a745d86560443ba81dbe9b3d50

SHA1
3f9d4bd121490a0463e545f31a1868589a4eadfa

SHA256
97cf621008853c4bac4bb8ff64d09b06f843a74a375ea4f6208259cf2c0cc82e

SHA512
2db19ff9f04f3c993677ed0081a418b39b46acdb1182cf61d7a7f7188179f1803097ae73a11586931ee449014e656a11b613bc1f834e82a0c3267bf394d120fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c8c4bf6c52f491785d7abd0070dca84

SHA1
9bacbc1e60dd5df00df0bb87625475720ea591a1

SHA256
2faf5967ffabc40e3951319ede279d49d53559c569ac4d65796b2cc19ece4f2e

SHA512
6358793df50fe060df2dfe59ad093aefa163d3143fff78af8b9e33e25dc1426cd73ab9bebe20b810fbf7a976b72cf71c52eaa9b7c65242af79b6a3c4c4999153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5073fe54d170fd91712148ebfca7eca

SHA1
0a81859f83e9746347280a0d614c55b4d9804d38

SHA256
635164d949a1bf9a82fec2a3f5a15627f1437dfa620f148e79850eb74c8d2aab

SHA512
c7f315e409b036a21b99d2e80665bbffe16089bb87db6965f82bc65c0eb9bc1fe316c7c3c5334abcf6b38ce1be6ca493bc08f97a14dd2b46675395929ce4a178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\478691279-postmessagerelay[1].js

Filesize
12KB

MD5
92169c8a0fbf6e404267d0705cdbdf42

SHA1
a5cd88b74ca5ced239cdbfb458fe25540d671f46

SHA256
dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384

SHA512
8c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\px[1].js

Filesize
346B

MD5
f84f931c0dd37448e03f0dabf4e4ca9f

SHA1
9c2c50edcf576453ccc07bf65668bd23c76e8663

SHA256
5c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584

SHA512
afc3089d932fb030e932bf6414ac05681771051dd51d164f09635ca09cbd8525a52879524b6aa24e972e7766ddf529484cc1ec416de8b61255435a89ba781f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\cb=gapi[1].js

Filesize
64KB

MD5
ee01651d160cfc55249d6011a3c45916

SHA1
79d6121df6575974ad21dafce33ec98e3f2f0a7f

SHA256
639d75299973c7d3794eb7eb129e3b5a6139f9f521e1f14383abd0fd501219c9

SHA512
8a39dfc1ff2c58ac106225976aafdaf7befc0a28903a0c65e2c272e1967c3336af2b477ec12604400bb8e16aecee6567c9cb9d157e3d54649e28b9b2f920432f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\rpc_shindig_random[1].js

Filesize
17KB

MD5
f019fdda31635d2a31b151ad8ad56c7a

SHA1
6adcbec55f66ffaef83d9a134423aa98eb2a2189

SHA256
c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831

SHA512
fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC802.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA18.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit