f05efbaa926b896dcb036da4c5627a19319314ab3e777360f3b84f5d15696ad5

Analysis

max time kernel
145s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1748c33944ad2b88acb124526ac83ccd.html
Size

3.5MB
MD5

1748c33944ad2b88acb124526ac83ccd
SHA1

e1816c8180730259d98b53305aab684211cd35ce
SHA256

f05efbaa926b896dcb036da4c5627a19319314ab3e777360f3b84f5d15696ad5
SHA512

030a502f6ce7cb80b77030f3a71037dfb4ba6f3abad3886a61772331af2f5536c42d111abb342544e14de34126d844965afa4bd78c65f58e3562d8887d0d60e5
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAt:jvQjte4tT62t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005972be1d0b9cfaa22ca4292942e259394c64d167b7e6ec4837065d3576cb10de000000000e80000000020000200000007990cfe4ba3016002cec3ac25d91204cc7ed8ff798f84882c024f8594449175a900000001fd1607b2b9964e6cf53efbb2a6f30f9ec8ae83a49bdfa1c5b983410064729749771284fdf34cd61900e36198de766f15b0d9bfa31505cd6edf5755ce834418c354467632c070097bd35354d359e684a047a9b3d9c8e4180bf3aa1efd437d50b951269f9112d0c0ed9c0aacb11be8ba7c03e2357b0b46caed37d864377a26e3b7e1e992bda5883ba4f69a31032f0ec9c400000003607d8f3254431294987fadbe9fa33c84c0379437b10a273dad944553cff98bdc93f4bc817f52a14a4b81bb6ac681e5b6c44e3b238c0ed810f0d144e61011ec7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50C721B1-A512-11EE-BD99-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a0d2eab817002750774580f0572b7e5a1ae2df543735a275c0adaba5d40cacc4000000000e8000000002000020000000f362ca90e76df2fcd66216e51027d5974829c5f036d9563a506d52e384b2bfc120000000c4fd5203ea7b716584373a6fdaa2c3ddbf1af7fd84377cf195b2a346f95dd330400000009674a82187cfb7154de31946f40059b603205593ccf5db55fa34cb7491ceab842fa89b37d7184feaab324acb90cfea44c22bc7190eabe8f9331ad914b8dcdd59	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205e0d311f39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409882730"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1748c33944ad2b88acb124526ac83ccd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac6e2e1e0cb8ef4f74fd81c9850ab4ec

SHA1
76b17bd95142b99f5b0ddaa20df5745bf327eba8

SHA256
2b4744aa05946ed0861125ccef3f1d7aa1e174df90a5b9e47b61d9472c577722

SHA512
d54ffa9f09f182a9965385ac6b94f1e5a1fb1f1cbf4a9e6165ab14c47c327bbf3ad99b3a3f9b95acf0c16599e4f3619d6e5508e45a6dc992952e0f5873aad407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f69324a77b386262afe5c6e5b0d0db84

SHA1
a430152ec16a58b8c3e86c6513eca849c999dcdc

SHA256
4eb76842c99d7901d90b8a0613cfb100c21692a34d454a664a0ba4ef4399e661

SHA512
b1eff90b1b7308b04b3cdb33287feb5beae8b5cc2975b7a9f4f1226a983085f722e0a4d08cacefcf8d380dface355ac15d7d889c647b259ae3e1b0e2237a7c6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1817929d525c7888b2219d936fa65a5

SHA1
2eb757e4ef2f3285972e9f0c9e836a334660cbe5

SHA256
f64842ef55b6626ba7cf5e9ec8dd99e33ae036768757697acc3e652719e505c1

SHA512
310a2d3723f4aa1da083e7d521c18752dbbd5a0cca39f3b8c00e2965186931dc35b00180234c40a1cfabcb8250013980c74260270368b1b08f64d9d366205db8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afc1bd5628bbbef9a702f154f18ac646

SHA1
a5b1d2d6d3ba6916ebf86520d2f554074303923e

SHA256
d627fec4058ce78d74526a8197e4700f03e103c36e065a7bf99dae00199f5f38

SHA512
01d9cb8b0549d654fadaa38acfd2a916beca23fbd00f75e7ed7f7c2ec280f2a061d209177deed05d920bc12e64c20659111a58cdaba13d9bc30c264218ab10d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deb751d44cd59518d6e2fbb4ee2b4f5c

SHA1
21e71905b6cc7edc7276c18be071d439592acc6b

SHA256
22794ba26a796809ee325175f57c4e4a786251936061850168be8eecd554406d

SHA512
5b8c408cc73344c78b89248906bb9a71c0f45cd874b6e2d5d9e25d9a5ca8ee3279190fcc5b02e229f32657cd29992e208fce67040b3183cb4cd8fcab860afe6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd69230f1a7d96716dfb28edd4ba10a0

SHA1
524cc540532db3160bd043a3a04436ceddf8f432

SHA256
c1f08c1ae6668868dc0c80bff4cbf79298689c471ba707e449b610f9e1783f05

SHA512
71ba78a9564be4d8da788ecb0e15d43aca3bfc722ea6f94641dc17a1fcaf12e5a5366ca380eef1034107c25bb3db660525db798a1ced6d181abd7510c4e402be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c8fcc94c69bf0f2131a245dbb7e4d5

SHA1
ce69ce664a656837addd460b8e2c1e3dcab68ab1

SHA256
21957d115c739812f1eee7922eae790be493c4ab94cec8054178dd8c704a22c8

SHA512
0202965b2aab8e93bf1b27c80ecde8f9ab49ec7c8a9957b4ce072b3a0365cc884a08c98b218d0e1d88f89daac6ce1c09ea4942e2706578837e8241ee02cc9fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d693d7050d4defad8a228e2df7ce08cc

SHA1
af1b5598f8b837e89edcb7230f5f359a768c0989

SHA256
59f4934de0f0b9a2a17d369e0a29171d0572529b1f8e46e09f69d1b58ccb9a07

SHA512
fa0d4caa3594ff61d2041405f73cf5d19e2fe3b061b32357321d7b6a6ba24d0a471feb1f8a315c7e16b62852c20ed7b78a9a476076fd886571a9cfb293f7e096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd3b63cfad8788c6d0da47535eff6db8

SHA1
99cf68d85126e751ab7c66dcfed9b246f293732d

SHA256
e2a695f1290823ca9eaf71ce1e6135d043142310df4d0df31beb9f26e9fde3cf

SHA512
bc838a33d1a0a63109054d8c273b49b4cf95c03dff15afae439aaf00d0c4969a9aa81e038f91f5f8a1f478549d64dc62604a297c6561c8ebd697fe1803c14225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56955f266ab6648b79c0487537e70f14

SHA1
c95db44fd2bf079aa0b8c98d82953589f71fb6f2

SHA256
50a628c0e42300a1adf5d4d9cb725ae6f91514280ac339f975b31af23c1225ee

SHA512
f000f43fc3bb94814c033a5a6816714131599c6658b01fb2d81ea8782f1b606f5544d3ea4e3b0d11cb92aabbc8c6452381370f3f02dd94c61259f98cee40832b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA47B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA662.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit