a27f5362470f95a6403332267bf36b15ea2d9efaaf2ecc0549b78a09f07d5d91

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26379c13bb3c657b33758a17bb934176.html
Size

3.5MB
MD5

26379c13bb3c657b33758a17bb934176
SHA1

ef86cb42df1077a4d1019e100056e378feb65e5e
SHA256

a27f5362470f95a6403332267bf36b15ea2d9efaaf2ecc0549b78a09f07d5d91
SHA512

13950767e7c6f65b692218bfdc4235398f6a110e81d75884055d1e77c63df97f7d1a240640d14ee5e90b571d8087e8a8393611ebc3aad8d344755f6ed47c337e
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nf5:ovpjte4tT6N5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE15C2F1-A597-11EE-AB70-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000007c5ea124cff3dbeb4c3d72efd0624e70e11b9e3573eb2ca6fe5ef1ffba97aa4000000000e8000000002000020000000821775119db9939961a703e4c1b988967d55e2ad1faef8bf452e437d3cd09a0790000000c6803525fbe6227e05e7808827b8efad793cf59cbcb520055e987bea06fbc0b1b03e31b7e60e0160bc28be230e21dec7fb38f28bc47841029ddf265175677c835fa07535ce72e5a5fd112a24b2955acd925c10482f1349330cf039fb05831f02ec1694c4c4f1f8dcd42c50dffff625257f9b975ddcdd9864e2496cab7b28841f6f83221a7ec947a7cf725cb104bae4c740000000edbab546de2f2359be25887d04259a1ca11d6738f9cd0b2001f697d49e8266b188291528f8d084caca43f8380616cd58bc69d9bcea70268500f4795e8e7dce87	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409940043"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09851a1a439da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e29952dc61ab8ba3edaf4dd7b2df85725b733c82502a6b8adfbdb41914b84862000000000e80000000020000200000002a5772e32a5138ce005d3a655db0c9b8b35d200a74caddd4074c43efd80edfb5200000006b5d7848ba1a15ce34c5693ad60323d174248f4467a5229380e31b73dd4a89af400000003d4b270a4aa6440219deecc0e0c1bc144c1c50794c40c076ec6010bafff590350235a28c24bebaa9adb1d75f34750311e7b0501374ef3eff4804ab67530af5ca	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1428	iexplore.exe
1428	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2476	1428	iexplore.exe	17
PID 1428 wrote to memory of 2476	1428	iexplore.exe	17
PID 1428 wrote to memory of 2476	1428	iexplore.exe	17
PID 1428 wrote to memory of 2476	1428	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26379c13bb3c657b33758a17bb934176.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af636a33be7707dee63c52c72eee7d87

SHA1
d38c5e53405a96cf75445e36d85a251ad506909e

SHA256
6463973a39127d8ac7a35e533522fcbd8fcc7c3a95c532a0207564129f4d8d4b

SHA512
bec04ca65a0801033ccf74d2bd9e8b002cff64463c8a838263d1d9da2650db06b28764c8f933b9d0eddf1c216ac88929520535cf8e4a87a11e15f8a406ba4da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20ee138d0e72e50bb589e1aad03c87c8

SHA1
d9d7719da1b1504fc587f175f0e989a61e82b5aa

SHA256
548046a596ec857eaf2ad1184fda214444adeb07a7ffec5a82f2d7aa5afcdf3b

SHA512
291904a3512d39f1406df72b2ce16779f487804a58287dcb6e5a0d09d349bc6856906581a16435fde761ff9c552ac62fe00cfe8ebace2edcd7449bf4017fcdcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5ffebfe41d26da353bcbde10fac4867

SHA1
22d5f6cfa16fe6788579a3feee775dca74dc38e8

SHA256
989f87278e8c963c33a6c0205dd5af82b5f4274adc2288a2e041308eaaabb107

SHA512
b5520608db753b94a6bd5599e92410c5cffa7c117f1f89048c8af3dc3f49183012e7909ff446e6c3f0fe9b7f7986b50ff8aaf035c9683f595def4801a5791e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd27e84f5f9d3f13ab3f5a8bfb52315b

SHA1
4d7c14c5a98f73eecf3b4ecbcb866ada25d20a01

SHA256
14e85d63c28bd82a7debef3b7b6a3034507de8783d2614e0a4218ade916b6ea2

SHA512
17326ac9868db82aa7f26f24943ddc39cef23e6b9003cfa959a165faed55ad60775be13a49467037fbdfbcd797a31b44c1b73f05ef8c84e22056b655eb143a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7183b37014a1a1d03a55e8b87f6d3ad3

SHA1
3b67e024e1ce1c77711c5860e7b381abb2141d06

SHA256
696e286a8b15c6a7009c1c77eca47e4009b6d4001031f8fb75cbe741ecd60904

SHA512
909a659b1b15920a8554a14e77eae50356efb83b4a590833e8ac4260f02024b4e1246d954a37e8332f72c7d3796a61e8606a982ef6f0549401f2da45bb041d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87728a1546f4863c4825aad2052ae80c

SHA1
088c53414ecd507594dd0e2b70f92f764d00696b

SHA256
fcefdf8b2fbf6b5a1aff4e66cbc933a0139e94422228105cfbe677bbccdcc1a4

SHA512
2d8f5b13f7377610d0ae1598663f506e2dd0a017cef74bba4cdcfcc1a989e024ab396a6439b7bee30a7b4c2a44f85a68ddab46cb0ef1757c8699f0f080d66854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9425cc7cde25361c56573701b586895

SHA1
6dd6fc7492a48ccb7e12a4c245c2bf35f8db371b

SHA256
792791a4b15b692f7a2f2b4fdd57e95457e4cd436a9573fef17b934a9d54e281

SHA512
a4bd2c2eca09c36dbee86ee5313f06dfcadd70a87d1b550e89554b112f0c5d76b86d5289bf7e8f1079f698ee75a015fcee36e51fdd886238a564177b5040dd7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26a3811d672ddd20641fb79f7328b505

SHA1
aed11c958e98e06ed9a619b2d4883a933015579f

SHA256
52f5e34e88648cd070eb2697ff7f0e5bb48298618b614629e90c39518699801d

SHA512
fb7f8c07412b5a852040bf4c0c350485289a36fd5fe01209916142e30f9edd987a0c1dcced23a5e92132f0baf3f5c1d57e9bea040280c78f98263274d3d0b2b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d459183fe1a6454dac129d51ba2d663

SHA1
680e6b43962f06dc7b88d31739d984cc812e86db

SHA256
3e54c86850062a8b8fab0fa4885452d8fa67b99f9c5eb5ac763f1e877fb69095

SHA512
84b81a8e7d3e22af3bc110d776ab207c383f67593c50e57ade5b894896f204e3c431e4379efdce334c35be863a4540def01ee5ed49ba55686e37ad99b0781e82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc36c0e6bc9dd4fad2cc6a6aa3554df4

SHA1
bbf36da30417dbe5177dc78e91804800b88900da

SHA256
4bcd9d0595d2e8b17894d2a782727b23e0744f9778566cb7b25bd43b7991855d

SHA512
dc3dbf94a140a928f9061a35d116e1097d7930317289e5335a4eb59e443e2b47c69ea15bda18100154980c8b7e3b5b873055a3b8abf0ba68af9955a70c82f359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit