6c02eb9f605bc04f860704166ec526298c1a2d408b70ec30d034988d0cf7af8e

Analysis

max time kernel
59s
max time network
161s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11f2554f56796ae09f45f3638e428319.html
Size

3.5MB
MD5

11f2554f56796ae09f45f3638e428319
SHA1

e26cc7e5117acdbf594a59086003e8b3e4c5cafc
SHA256

6c02eb9f605bc04f860704166ec526298c1a2d408b70ec30d034988d0cf7af8e
SHA512

27efea1f6d04135359a527f641a50c467cbacfe0ae314de21a5098b7bff121b55376d1f56f461fe2592c07a87307976ab4bd9c5200fb10bf8f99e78595752d52
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAG:jvQjte4tT62G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8ABC8F01-A36D-11EE-B6E6-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2772	1636	iexplore.exe	28
PID 1636 wrote to memory of 2772	1636	iexplore.exe	28
PID 1636 wrote to memory of 2772	1636	iexplore.exe	28
PID 1636 wrote to memory of 2772	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11f2554f56796ae09f45f3638e428319.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
189a8fc1e882f3810e4e360f220e119a

SHA1
a81c6309e99c7c57423bf564089b6ea8de6ca63d

SHA256
58a262f1a273f1eff223d40b6a68dbc759e94c9654fc1264c2c14e16b7b6113f

SHA512
91572836408d649b38d304ab07bb834e37b590038badab75e819b0367d644370f60b8e80add918baa2eb28acee2e8232a03f2a4f86440506a0622cda3ab93ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26468e189e71384a11216a275269d652

SHA1
24ff2cc5fe3a2eebb09e9ed9d31ee636f75a2619

SHA256
207da36a41c5ba3cae6b7d740534bc17e37d75de24b91f1d4b2854de74236da5

SHA512
31e2ffd4feccd8a771b1556d6783ed141ba402a733f335b95352cebe4888483cc586c430b4c246977c8fad20c46f95288122d854a144020ddaae2edf29e32206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dc8b35d0e7eeb0d612c10f2391c424d

SHA1
b9d914fa8f00214314b12a831a1c942397a8b04e

SHA256
65b0395a0266488ecd01e23cdffcc852f1d9c7dd5e8c6066247d598bd7f497ca

SHA512
85480e8aa408b9b1cd1dcea32d2da134c08d95c69d4a022cdf668c4b57edbd2d2add96fdec187cea2731f0b0d57c11f0c472d27cdc361b481aad693e95c428e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
142a99548bf8085aedca15409c133997

SHA1
46f4b317c83a6a32a2139d6e7d80ef2cf89ce55c

SHA256
0b54881a192316e311ff9f4e9487c9cca127d4034388b1f54df5e1be12f42507

SHA512
f9a7f26c290fbff53294522d6c839c65dfe6be33b2bbc9df9e6a2d391ffc20b624453ea2bd2c5b46b7d7c912cbfa451ae69d35a8010f43ed0bb153d1cd643178

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b655a1d972b1b772796f777911f96e

SHA1
c02ee8e3482311ce0f4fae922308e08b62895a8e

SHA256
4db36b6f175cd186390494d8d734d7fd1be31825f8be7a37ec53c80aee04f7b8

SHA512
bbffc0b41fe6a5fa1c3a5d6bcdb615326c51be1b9ac832894cfba72339c7f7d8ecdea3587ac655e9f85f7da6a38048baa3d04d662363a3f719e62d53f1d9c211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b95ee92b20fbe4f2673e0bfad3ce0c

SHA1
64c8b908638bedc3440819b20ff0db1b1b1b1f9b

SHA256
d64327120f2adc27e884311363d5ed8d99b82d8782ee15bd648a67cd4dd26725

SHA512
cc91979e67a677c7399ad1d088f17514ffae1414a4d1bb894d646fadefac49fef465eb12e20437d4e2ab3230a76fa8172bcd7e11c7fb8077ce861f94f14d28b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c3a877c23c67d8639c9158205b5dff

SHA1
1eda47ad71510310213206d46f0a494a1f56b7fe

SHA256
823153602302658b6a19628248c074c3e900b3145f31e6f77447d3b52fa873c0

SHA512
57c7937cc0754d2ca6a063d1cd63e85ea305288f33d78af07468f0b9685e5bb31fa26ba3b4263c32615d033b799d75dbf9f5778c4d5261ca219657694e6c4b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5681cab11b2b1d3c023361b60956dba9

SHA1
84f1af195e1dd295ad97df9aca89a4bab6d07ab1

SHA256
2cd10b05254f9732b4665f5f80a550f4e9a68fc5d49c7875d7817cc25a464550

SHA512
f130563feace8ca65d2e44205ccdacc87f714e4247f15078f8eb3e90a5a406c6f9163be8be30b3fb1b093d46d4b88265b977ee3cfa59a89366682887d336c627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70e9c31edc225b3393e1aa64d489f91d

SHA1
b725bc374ec452481a42a1fdcf38c3ad49b91316

SHA256
df1fa6e31ed6ff44e2ae23790d92df545e331937de9aa6de3a1a04bf5dea6575

SHA512
6db18af813408269704a15914612c7cfaf58fb979ac791c9027cdc0ed7dddc9ee132278021ba28e5d6e0191793a56d562995a56f4bf5c73bac946b778d69da52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bc99961bdabfc0db0f07dcf856ea6c9

SHA1
3a302edc4d661dc127b5d96b58f7c44fdeac3f2c

SHA256
cf292956bf08a59a95baea0e46ad8f111d0b5165c962524672c6430d42c20698

SHA512
61cd9f34f386e2c7766afaea203b3caeeaeb9be6ea3a7d1b76f5f89e2b04229a060b367852cae5414ce4e364ce68656d4dc71c99bd98c59cccd60c0f510694b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab981D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9948.tmp

Filesize
99KB

MD5
fa178920e56586a7d673ef62ab4575c0

SHA1
cfd02c6a6b26f3407a1f9a91411f6f4467b1ee54

SHA256
777c3d087168f5f42bbd550047ecf607a3a375eb621d7e30a38e9c8803a861b9

SHA512
12b20ccc55780883d3b4c36366e335a8d07d9581a2684de3e1c05055b6fff4dd3e0124cc210e93f5f4306c37a163a92584047d5eb0ff5d71f04ee30c593a836f

Download Submit