272ed08730235134a0f11e3b5b90acbc6c7a0f221eb5c1a18462401b873e1f2d

Analysis

max time kernel
0s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d4c4546763451870e5c8e84cd4747a9.html
Size

3.5MB
MD5

2d4c4546763451870e5c8e84cd4747a9
SHA1

405902a7200f6162abe6cc996c6a993479782aa4
SHA256

272ed08730235134a0f11e3b5b90acbc6c7a0f221eb5c1a18462401b873e1f2d
SHA512

4b5702a0af0c7178008f6db5b4e822aa0b7bcdb0c1d5dae6f01346980a3e9e9cf0cd165b64c46aaeae8d5d2a4630de0ef38e1c055abb72be8ba499c7ea5874c2
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAF:jvQjte4tT62F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6962A41-A3E7-11EE-B0EB-D691EE3F3902} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3040	2016	iexplore.exe	16
PID 2016 wrote to memory of 3040	2016	iexplore.exe	16
PID 2016 wrote to memory of 3040	2016	iexplore.exe	16
PID 2016 wrote to memory of 3040	2016	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d4c4546763451870e5c8e84cd4747a9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7798316a7b34b4b718c19317479b28ec

SHA1
f2040110e36dd710086b5a8cce76ec17e7aa056d

SHA256
f89b4f8490f1ded19e8d28308f24bc258e8de3336e713e4cb69d64dd6c505128

SHA512
58dae5eb703ed433ddf23c62a2e9c3201a02c64bc90308fc8f4af0f1417c8189fe1ae7a3ddfe35a1948387a8b6365c8f33e958a56efb4d6f0ac6c6a8c08b56d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a52b54f16debc9a2ae875bd4d1d1877a

SHA1
7adec00f9255c36d1e88b5abf7bb9a7b79aadb27

SHA256
76efd18d27a145a3d0045975f331bf085c2a59324d9462c633e42992db8e7bdb

SHA512
8eb0bb5575422530e9b1ad65deb54373238c0906c2d878418e35b595559341007538d6e5468df4b82e5bda39b1f2fdd48c1e07005a2d75ea72db94d45b60ef4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa094c9fb2002fe98b4742467a490f0

SHA1
f14a4f605785b63bf0e667378b66ee56217a133b

SHA256
07992ff3d35d60960b6e3b93402fcb60eea3aa4f61452d11a83e268fcf9f2feb

SHA512
ed3f37954d35f748386295168d592479389b310ea86fb77e2c4ef8537d1d4de21ff5a68f53f1fdb9f921c54188d28852ce150d2759aadbe489439c4567fa3009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f4d3f8ab5c5f579ba6a612526e0eb8c

SHA1
6268c4d278463a9c4d32c94baf2d9babfc222895

SHA256
fe426e2042319ecb26c40648ca35891b849974bc246331eac63b943cc570c5c8

SHA512
5466fe11a830246377a156f131cccd24d552aefcdaaec0ca95ef23c7c562f6f7ad044ac962539a2690f4c3b7699ebd8da03b27ed88b19583d0e833399f11633a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3683bc209c893e402dae6f5163c81d7a

SHA1
30c1daf304c32b73c49c084278b69ae293a42a09

SHA256
760562cc6af4ffdc059def3289b702a52aaeba911606314e5f9fafa23b607c18

SHA512
0e2c8a94786af4af6ac453d8ae5c5df1b6e027af79b0e40535e4b2ef412b74ef25ead2be26a1a35f00a5f3b8999bea3207db805288ebdd70ba01709cb6ba2e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96d39b683fd42cf7093c76626922a688

SHA1
852b9831f9e9ee9dbb9ca8adeebe1b218cd22694

SHA256
74afd21530f7bb5dcd64ff44f716559709cec2e74918adca690f514a4d511a82

SHA512
39d13fa9972bc144f88ba8d67211b690b35293632a373303bb18ab4314ca90e03027713a712cee9a4f07153b4d0c4cc06c02b8e7e37571b5ea45a5f743963c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f305caa84deb46684a1c613287b95ec8

SHA1
2332db5955e92b8f23daf38068b44fcd3b9f2bde

SHA256
c8b54791311f8f6dad75fb5de0c0f434d3c2c2bf9922f303c95071efa5802bbf

SHA512
ea33faf5fe4014da6240c947726efd8954105383fe0e60fa46d37ddd6e561ea080f133267330bea8ac0e1d1a137c3fe6fd2ea0a9a3d3fe5a38a37cf73da33104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcddbf22569b9960a38f1063f6274c11

SHA1
3e7ed06100860b3f6dce36e9cbd27c1901e50155

SHA256
2e58dbc993532367c74891cd2bbd68883c6d75a3feb68698a13846f89c4f3e8d

SHA512
99e0542a1a04e9c4dececc90aa34f3eabc5861d8585b1b1d05d5a61c954b58a8e75ee13d5b535cf675821f3920fe480cfd8fca2eb4fb81f88bce1eb4e07377d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8273baf5dd8103a0885edae0eda8e3

SHA1
b91c38483eee486a14463aac874aa398af857a99

SHA256
d3c62abf471519769ff235f86904bbee6fffd3e1fbd760d31866c08a6b019502

SHA512
6d8d6d5bc35f6535d51312d36093dc8bd99dc65290387ba9185958a0c139085111687bae1324b75b75a794ee0232157e23331cdfb3b61965f675fb63411538ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5e72d05be957ec26332bdf879e929c2e

SHA1
5e8878a920ad71dde6ed09e04ec659286a83f715

SHA256
c1217f77d0beaf5f6985e1ccde12443eb1385685d5e9d942063cba025d269fc3

SHA512
1e870c4b93a85b0599605b40035b0eefdc1b6988296a3b45397271f62905a38d896b284008531269be5fcba77a579c577ffe4e6171fa8b11309b1ef6278c0e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LRB7KRHA\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q1CRH0CF\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2081.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit