7a9b47dd1d8a94df858e5d4c65792db16779b1956e0f877a01fe3ee9f7f75e2e

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b34be34fb20fc73027027f22a54f45b.html
Size

3.5MB
MD5

1b34be34fb20fc73027027f22a54f45b
SHA1

82602a247afe928e0c0909f9b16687f3926e6c45
SHA256

7a9b47dd1d8a94df858e5d4c65792db16779b1956e0f877a01fe3ee9f7f75e2e
SHA512

ce5edcca9ae4128ef5e665489632db48689c1f0b94c0cf8d62a4c92da292092bee99dd4c4c27c7e0b8bfcc810c7140aeeb0c7d629a0ce182f7b5ae3ace7f0202
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nf8:ovpjte4tT6N8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000181f1cd97fa4351f814f5f71dd89cd5e235cfed50879eba5294d4f5cf0d515b0000000000e80000000020000200000009d3f15c9658cc01ea15b810913b96b91f45b25636f0006cb11c4f5b1feb66c12200000005f6b596239543d168f27ed42764e0d54da1e54c53215152b6405bf5d79697f9a40000000c5b5fa4b317b2dd2281d4b36008812346877732c2862ac17e82314a111c6fd186cc41515a1a173b7032bbb712ea8e7035d53f9cbf445a50b2c7049f1a55035b4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04204e64039da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01DDDE01-A534-11EE-94B6-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000038381ff6fe5fc4972a6bb7c663f4247d88d0a52778be77ba177627de05399546000000000e80000000020000200000002370dd4a797c67b12fd66d6e519c250df06fa151888020e570b0480c213e66bc900000004b20dd7d91eee51fe078d4ec8663eaba4365523de3a37b1308b51db3dcbe2c233d4fe1d34a823e3be3f70cf365afc6c7de27506d2e702a9509c4bd73950285253673dd75c78e236cd69e9c5ea69e7af21bce5915b331eb6bbd915d35058d148bd7faf1af4ea906258681b63bbde3d194a695fd8f0181684bf6a73861a603b3e54e1d03bf54f178bf381de0be09ac940c40000000ae84d0ce2ca2c464248c3c0e9ff33f5b6de1cd5b209450b19dfa6b3322c71a591b00e14e9249437e8c6bd14a181318be1a6a97ffafdefe10eb1f8abda33edfdf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409897197"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2668	1740	iexplore.exe	28
PID 1740 wrote to memory of 2668	1740	iexplore.exe	28
PID 1740 wrote to memory of 2668	1740	iexplore.exe	28
PID 1740 wrote to memory of 2668	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b34be34fb20fc73027027f22a54f45b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f79a665162e26b468eabf9940ecc0b

SHA1
b456e440a1499da060adc59f987c972e42795df2

SHA256
86d6a5210996f87b71f64f3b73f511d91764acc039f4454e9ccd45ca212b66cd

SHA512
ab409b15f16eb1e8b9d1dff71d45d8598ff7bd8b5f5beedcf90fcc4c1b574180cefabc5dca4b4f357fae2959eae8bbd8c543b425b7a5c81e73202f6afb266667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c7d3a6dfe5c90d77bfdd77ad74b5bf4

SHA1
9208d94c5f78f23db3084512d1e70084ae7dbd66

SHA256
4e2d47113d1c356bcd538010c1dd7192518f9576e962b09233c9e12599057150

SHA512
eee3bd269762cec43cd3b39c4e045c3fcade06744dd623d38727d567ba71e36eb9d3d33711433eac5af86ff1fc4c67128384f9138526b2398f05ca5989866a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
656c6de09cc11f839df1812260f40395

SHA1
b1337fdff3c863bef218ef113f0870cb36dca047

SHA256
f5476e444a6ea3b2e71b03e13a9fd333af284a0bc821712b5c7e6cf4e64e7fc2

SHA512
8c08d217308d3ed07bf43c75798c28c299431b695b4e03cb7b54086303495458b857def0d894191f72313ce1ed6f1f34c6d6ba972c7b77351ccaec4d2a8f40ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ca9101353840477c78fbbc9f5a5c8e6

SHA1
0d14dd69ca3f45077eeb1b34c2db07d04b93e516

SHA256
68d5a79ca701466d7871d9e5901a71c142a1206887a91430e2ecc23cfacc4862

SHA512
cf2216f44e28e9dc225478c42300e87713ea7f2c1ad69b43a2fba8dad39080c80a2a34c0b35ee1e95d6be191d5894508b5d2a9eb40593b217d234365f74a1a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5358760461daecee93415be618902d48

SHA1
17e39428a64d0effbce3e9a48fd53ac8dca67892

SHA256
336f2f31fcf2da30dbf64e84180a8fa465becf00b1588711c23d37a0f48ede0a

SHA512
4f08232dfb420ead07e622ae679c0886f59ebc58e5ef40c30f5282a712629578909fc5a7e43e0222b55c7a97ad6ac07ad38c4aaa54df3e988c608e785e3e45c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f82af56745324086041deb2bdda331ed

SHA1
79c3b55c1f1c3ddfbf2bd596bb5bf79b4fb5b881

SHA256
d662db51086db34740d0eaaaf9404126431df392598be2883649573305f9141b

SHA512
de26ff5180be40a300e7de285908206ae807a7059edb47ef74d49760b23326d5c6fd52150b2b9111bf75c3913ac21c719ef19ca0d8174d59777e2f5fc1de508e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d648a9fa43ca8abfc62722af31a764c8

SHA1
9ad888cbdc58610a7839eb46e59a01b45287a154

SHA256
f0c5a750c09a31ea6484e083f16f40483ae23bb79035f3522bb0346a2fffed80

SHA512
109f73890b96dee9f89f7070ef9d78e4a208ea4fcc5e5e8b36eab1d1ec932fc5b433c75669f576b710ccb470743a98ac6c3f61777e738ed363131f7cda60232b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f96639e6ed8c188dc848fa676181bb71

SHA1
905f77816c7761ebe135f93fd804386a9a855b9e

SHA256
d1c1e206c2e748785bb9c638b19872119093347b014da3aaa08d2417a7fc8ff5

SHA512
d237952241372360273a7d2c5c3300ceec5c908f25de86fe44f2c239a2fd9fd977fcdd7866242bdd6ebbda8e2e33cf853b9d3bae4787c2f1859f92a889a597f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe9506e65b311da602873cd3f1ff0da

SHA1
b2fdbcdf77370097bf3631cfdca686b82aedb897

SHA256
c39efd2ef9209a511f4c9161cbe822046e013117f6b256414bc309545a21f4e0

SHA512
fcd4209a5af89c3dc727a94cfbfd32f23ecd65589ac936b2c66a5ffe761835c0109f2671796fc5852ef5ec5ac4c372ae1521cf40fcd5a5daf48de28f6237560a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83f5d325ba0e9e82691471ccc787e98e

SHA1
0054a538902873da804424c390761837f12a8168

SHA256
0b9bbe574c4c8cb1e68019aecbd7e540fd0f295422c52abd256ba6f05db7acb8

SHA512
015045878be5afbf3864a8090c0674426f9b4c1b852b930cd1a5eb3b574de6d71bc463171c7adabc46f5972fb8937c160354d4a31c3230a3b7a6e8b0d823eeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9573208a0783d70630e2435ec5728281

SHA1
b7b84d0ec870987aa85706bb6ec0ab79e76fd112

SHA256
1db777e484d29e00f7e750a6b6a5f0c15ca3682dcf76bc47dfde166059c42c60

SHA512
74ee64bfa167daa81546617616b45e26483dee7f184f3966c3e5306c98de451dad1e245bcb4f6ab02176b3634fd666d8dddaa0ca45fd0092fbb616375c92942d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8af24c16060ab40606f4c77879fa7d0

SHA1
87172a951d94c5f598e4026ab4b82fad35d3ef64

SHA256
422db1cfb6195d740bc3892f925c7b86f82883990694cccc4449ddce0ff525c0

SHA512
2142e7f326db98606c69b8d68d73c5860b3a4d9474be028c0caf38829ae50327a94d094b4bc406599ef0c96dae73398a19fb5ec32d1e7a8a35a32d64848ed708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11ffb5e0fcd7d1b85f3698803981ea59

SHA1
f4a09d68d58593b5065d3f612fbc48860f98ccbd

SHA256
20008527455cd7c0dc9be6f034492a7ed67e729dd6d042f2f316c34f7903fdec

SHA512
628885437915712f1ecde324d04f581df86b10f52f074ec45955a12bc126d148f57c5db4c346181d19c4e1d6208346abc8825dacc301c7fcc5fbcb45a9e01bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fe0f271404a2a8fcaa31dc432618652

SHA1
e093c2da957090fc75e47d87c6f83e96a0836143

SHA256
76dac11cf9d373d3107e500c21d9e5db4e575ba14ab4137cb88cc5e1d45bef79

SHA512
1016b5f6d5a81297127b0a2ad510d5ffdbdb78cfb6dbf1f25d59a43198dc2c62574cfc154f5960a764d55b6855f5ec40dea833e6d3115423a9f580007d184615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2904.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29C4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit