6647386b944e3f3b0ca4846e25ecff49d6a02d500e41f8ae0707f7a7e8b84a0d

Analysis

max time kernel
119s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d388de199117719940037a02c26c878.html
Size

3.5MB
MD5

3d388de199117719940037a02c26c878
SHA1

d6ee159e589001002f8debc1797ad02f36fd2cc0
SHA256

6647386b944e3f3b0ca4846e25ecff49d6a02d500e41f8ae0707f7a7e8b84a0d
SHA512

8de4ac7a1f3faa2267206d7fc1a8e9702244f2a5d19d951eee9c2754daa9016404a196bdf17a688fe3e75777dc93a39dcafbaf54975a06c1c3a7e72ef203cace
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfu:ovpjte4tT6Nu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007cb54c0612d7cf01debeae2bfc7eb07dfdbb85824938300fd69402363540864e000000000e8000000002000020000000313a8f2acefe966850191210d23e39f621179ea02c56612745004363a9b9fbbd2000000028cccc50b16b2a4fc1082b156a862ff2f090059c5d10d5e15057a61e4221fc9f400000005c56b34027c2c6b9e3ba810c2140430fdb61019c4251302311944acd99515db9871935b0b2c5fb1b268688f17bab0a6f1e23c7521c02b6b23da37e6c7613a06a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25B47651-A42F-11EE-AB4A-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409785164"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509935183c38da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006504a875472dc03028ab6064a6c4ca306108871051a1f6442ad2fc6b87250a35000000000e80000000020000200000009f4507fb2bc69be9df453384fc9304564e597c590c91cbf485f57db882d549cb90000000e59cb0d69f8f624d5b90a2b3e0497261bd6e636b49b8c81af6182bce3f20c08c1cb515cb16b7dde892f5296fc48461a7d77129db4074326c4d731b3b2e2f50b8a07cb7265d183d9dd79bacc83a5626258dade5c0345e7d26893604d15e26b92a3efa76292499d8bda32b9b1380b35d4edfa6920b94f1df488155d5bb268b2ddf22c84c9a3179511c34a46bd898b8b7734000000024a5cecaa8bdc7db1ecb8d74fa53966cfce9acc78478cc779463e14dd346546a233528c29dfd60a961342f9eb2a7c345097a2082ec00b2cba2d912fa0fa8d6c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1352	iexplore.exe
1352	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2660	1352	iexplore.exe	16
PID 1352 wrote to memory of 2660	1352	iexplore.exe	16
PID 1352 wrote to memory of 2660	1352	iexplore.exe	16
PID 1352 wrote to memory of 2660	1352	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d388de199117719940037a02c26c878.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dc1d7b89ee019e988e58d495a8f6bd2

SHA1
f6435b382ce0ab12ed196cf6209d00d32acb4ba1

SHA256
b7b666c9c690104315e40a398dba2fe78bfced88b3ead2a0b628e68864664dbb

SHA512
9d6f32d354acd5854b4967d6dddf344aeba539e4ff0cf2e3a06fe833051f2ce98a39d6f7e2580f1df50830a0a5215fefadf304e481e855b314832de7405ea0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41a76a56ba517a9912f3dabc864e3f42

SHA1
8b2c63c133b8603c0218abfcd4cd79971f0049db

SHA256
646347ada8aca2c48c60bef0457f1df1e0b3bf62036251d5ddd33930e826ad65

SHA512
cd3f0279b6a6538f195119e6585f2974cbc97c46c408da9a8243a71b86473ea9de1e118d738acedef421ddc73bd6c32773666945dc8286eb76d8a15e05d835ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37f1ded3d7f0fecdc94d6e9cb548adf1

SHA1
dff090926b98c1b3e04c80e121b52267a6cd0f26

SHA256
ec70d88c18c3a730fefd5885ccbe50141fc1e90c1e5c8e637e0831331b6500eb

SHA512
9305c8b9460b39786e61d4eb2cc6811c3dbe7a3500ec830a8c77ccdb0ccdb072ce7b02f9960294f33e42d90729836682392cef84735172744f927523a6299d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0026bc3b9a39bf9c8a4b93da5a5e7912

SHA1
e00f9a97ff11ab79f5cb0aac2c1bc7991fb0569d

SHA256
1e47a29728739e3cf00ba36d700ed925ebd77e967f648c5b59b553011fda5030

SHA512
7382f082b0d7549c10f418748c263a14768cc7ea0c3693f40b1bc5c4385f7f28945e8e87c3cc880c7296f4b2259be3559991b6f6b4887cd47476cf2a6fa0879e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d62002b21ac035bb8e8f4a53cb7656a

SHA1
067de684566cbf408196f184a0f7bc7e7966e398

SHA256
d751a14ca416cfd8243621f2485fbe7c8168f961c510094bb2e1c70137ee4678

SHA512
39cc55acf04ff5075fbe8abbe0d8fe9053764b4b4b3a55a2f486f171997ed096fd34426e3fe42196ed34774935acc1470de51cf49cd290db42f5f53c66464ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
697c7baab113e34f1c867f6c60c8648e

SHA1
2e1fc8f5695bad58faa7f2d26ef854f7c1c49a1c

SHA256
689216aceb54af3c2750976a39a975766288458d5794ed3e621af2fddb9d4093

SHA512
b00f5f6b476d53a53a0468b87291487b9d7cbf79fe849abea4d37a58c0f2b6d2f02f8924e6baaec17fb77bd68595989dc5b82f814f917eb65d12357d6661419e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4136786124854200765cff198b555ff

SHA1
3a4cfb28f88b0bd13c698fc0a55b532147177374

SHA256
6dda91f94c4a35e73e45dc98283809cbf177ffdf26bc1fdf49dc184d4c6ef747

SHA512
88e360fd9e5f25a31e4f02039f4503e09dd90d6ae503e22961422c763f5a28e9f59b92d9ae69e73edb2b5cd10a1b2f431cf065f72b2d35fd6daf539174b0ccf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74320d19399a588a1ba011531d236095

SHA1
175b80b3e859092345d29049f9b671a41c75a51c

SHA256
893c9ae5a123697b57cd776f78e7dab8ab9306b1bd7e2e0250c3dca9747f44ba

SHA512
92c231afa82ef5fd2ce42df27026fb6095f3b6ffca0fcd393c42b124f87d8ba91aac7f36f4c370664e2724b606fd1e95b947fad713648a6785e1739457a04f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc15b5eb7fdc2a234a548237646f3e6

SHA1
17b90066a7e8638c8efc37e18018ac4a19bec962

SHA256
fcfc1e6ca137eeabd70f4b2ba93c8ed3f9cbbe46b00ddecf8554c85844d11699

SHA512
df0f6308b5e62a09e389f876d90f0a9dc25276d6aa2f00726758c7c6b49806030fb0ce57173a69bbd7be3e7c08a5d5b0821b498890d2622c67ccaf7423865afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51bc0f727b7ad8ad0b5cb5246f42b5d4

SHA1
ee44ab34e0040bdf056c42c348a4ec2af1cf4db9

SHA256
b41c9c63015c3ebfadc57b320e43fa50115f9866549df835d3db9e604adeeefe

SHA512
73c7ccaba432d005e02fc6583fe27f4fe44e0f47d37d68a10beff4c4e269ae6340ad607b639aab659f90a680ba53a3565048e6e2650637a06a90b929830515cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e0d3ed5c8f93630ca3477d0487bc438

SHA1
947b400b704a94b32478129eb8c3400834e93bb3

SHA256
c161af573bafaec63c12e8d6ce88446321aaa17c797eedf69834f1eaab68aa28

SHA512
6d69620edb08a6cb95a45a9ce9273ec62ec9d52a593886d28ea181d5c12002bff88fd596d21021e5d404e9ee7876d5a8c59588e1071acde35e6ac1e877b2cda0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96843bcb61bf508f8773a8a1d4a7f470

SHA1
fa4692436e0f85e89aad142322610b7a3322c84d

SHA256
d7eb1d024335d81ed87798c8052d5ed5a3e9e0413821a039c5dc12a25d01d0bb

SHA512
3232f26f583afd36b1080fca228fb77e176f971332a7790de5b40c5858d3cb86e1185634588fd68170ce870c90e9d1162afb5af123b8da1ba44ed8a680669564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit