71cdf053adde43b4df9a9d94ae2066cc7090d3a5e6deda8c300e85b477cece03

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45fbfb6e233d2d8830c8429f0ba52bf0.html
Size

3.5MB
MD5

45fbfb6e233d2d8830c8429f0ba52bf0
SHA1

2c72376150c718035e8677e2488cfb7b46ec83fc
SHA256

71cdf053adde43b4df9a9d94ae2066cc7090d3a5e6deda8c300e85b477cece03
SHA512

222f6533593f7ddef1e3bb6a33c32ca385d74f5dc7bd087e1e426a7ab395cbb6c13dc3de966ecb49576f5833780f512cee6dea199a51bf254790e24d8e916176
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAc:jvQjte4tT62c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000771b6262bb75ed42572efac208547f7de3dec3037478735d4ecb298980354ef8000000000e80000000020000200000006923a90174b0e129a2f03c1ba2c592d264c142a0edd067dc980c7bb775d4db10900000009ad78ace9dbf8737ac66060738e257fe686cdb5bb0cd116632b7386f9151628352c6ad19fa3b491dcfc4374f9cb8032d6f4273334f18619c270760b9567885b6134bf384e743ae97afb5ae3b4b584d4fb1b5917722ee987b541d98b72dce4c85388baaf51fe3aba94bb409ace3d7b19a72826d83b39e3056f06929b9e631a2899b3b0dd6b02b8e3e43832ba87650667840000000ecb95ef2539e8b7b2ef71c2ccdea30687901037aad1bf088ff92f1cfcde065e7c4f0ac94ece96d11cf7f3f98c1f89acabf4ddeb4fd0684fcd93ec6214a82e6ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30CE4D11-A455-11EE-9479-523091137F1B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409801498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000563e851622bbcecc4c3db30c60e5ef1eee88bada7dd93fc0f87cafb1bdc42e81000000000e800000000200002000000091a9b3568ca74ca9144a1b355d462b32758f3a701d4b82b10860caef182e8a0d20000000dc36e10fc1658c15c4d98f5ee1b49b902a093319808fe06a48a87cd5c4318fb6400000000a7588ced1d92e7a1e29f8c2958e54c43a57bc9212d6742862d37ac94e440a1bc76eae2d8497d80888728c59d60fe98bf308d0ada9f8c77ab4ed957894656de3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08a5f136238da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 760	2040	iexplore.exe	18
PID 2040 wrote to memory of 760	2040	iexplore.exe	18
PID 2040 wrote to memory of 760	2040	iexplore.exe	18
PID 2040 wrote to memory of 760	2040	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45fbfb6e233d2d8830c8429f0ba52bf0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d5c0eaaed741c2dd29dc0ebd6baa6e

SHA1
8425cb50c87c2f7bdd01fa2778b047aff3c22f62

SHA256
e105136eb2869288a529c544903bee201c3a12c512d8268ce192e6e9f65a6a14

SHA512
7740e5ab32f592c6876da870b9377dc6cf8a4c12d9969dca0e690b8ef1a51b37f44891a329633c040a1e7d1044a3e5dd64fbb100458b43282b3a3661461bf6b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b8ed345b62a489fc77b3b971b39eae8

SHA1
d53b9a2506bb6f4696c383b51a0933046199e015

SHA256
9a6d72e3fc5ff00a837d8c41d00380ad136132de9adb994bd385c1fe84fe88c4

SHA512
99033752c1a81f5f9c5569ff26d58a1f9172a4ee79544aa01dba745be53cb0571265b3aa94cffeec7c94d367b269ed293d037b8a002f543feb2e63d6a0e8b1ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464606ffe2394181fe085208e025f8ed

SHA1
808e0bd7518483afdde8d128b6ccb3bcfeff9097

SHA256
df1df9e4da37765c3ab85b517b75f493b0e58f9a29c7d5bc61971c55bd032eea

SHA512
ff7e58092f914edf4995570fad73bf700da1d89249097c388150119fe233479ee47d5ac9ea03f0aa9c8fe057d2522fba6d12f6938d6e1021ae9746419ac704ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fff2c1c625303a095ca9e103acc206d6

SHA1
e89dd57c07f2b0e0e5aff706a2b53c711f5f7790

SHA256
9384dbb14b384d7ff21c240fe01af35c8226957d5205d5ecc1404bd7cf4a3afc

SHA512
33f24497e7ef2da4d248d56d15ae8d0c4f6bf93cd2afe2fb53e15a48cba46d459ec153f0996f037720e2e632fe5af1eb39228b66b48e96a31f97da7859a7519b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
222164d650f27caad4bdccc95ae4da14

SHA1
06d5b075e28b9979fc57a5b0657d61e9796f31b1

SHA256
725e8dff8294118af91bc746f1c26c721b622defec6fca908feb039d24ab4d1c

SHA512
93e819ebd7b9cd15fa35c054f6e60e374c2abda7938b463267d925cb9b4d71b52a89df3e51a1e99f1ec9918e06a819e7c7730dca69acdd4fcd9f1644162cf364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f669266737f7f81e285bbb9ca8555a85

SHA1
00cc2c73f36015bfad77aa0a39c501079f740e13

SHA256
008aa3961a131760813d5474ed8fcb94dd6a6a11c710c9774a43c85de9fd648f

SHA512
b7f51143898197b449f41847c419f2c1b803b7ac28e6e553ba06e51671ece07cc60d2e5dfd1c8b2bc993ec1055fef0aa03b4c4106c031b3a7ef499bd47bf6368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dc6645e3c5c823f190e1b90b0dc0d92

SHA1
fb3b36effa6b80425bc7701043f2eb4d8b6b27c9

SHA256
95853afcaaae57e774967903993ca76f4f80c5828fb0fdad349ce089261f4230

SHA512
c7eab6e72cf4385c9a01bf0f2a8e31546c3676bacdfc88d26501e230cca6168eb593e42442db8e41a86d9cd529cfefae2a01d200fb1b24931529112c4f44c26b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ef58d2604ee05c9651a42385f36f244

SHA1
814be7e068e35df5a7e56644aae46e0ad1dcb02d

SHA256
d788169a493ab4c0981fe452be56b6473013e3e4b3ee675bafc53ae3292b3721

SHA512
a4c9d01bc73a65146b7dc331e81fd61458736fbd189145f1e839a0264a2fd6353520fb45f689687ace7d961cdc390bab1c182630fda4a21f0ad2eb8f6e585fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cda43b84e8e7acc5bc0a13281b3b47e2

SHA1
bed30421365714caada0081cc294a7755a23adf9

SHA256
79db25a7b58a4574b307dd7d371ec1503f3033334623d316561bfe50dbb0f423

SHA512
e4b9bfbc6a1ffb4c4b3a69d544d07bf76bd670870b2b2366cf55c49c81b740f17a199c1fab742557171f3780d94f226985d1356d75fbf0927045aff7b837621e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cc76466d2642d1d3f106572539a5556

SHA1
e86a86b692972b680998c07458b11a0825cc93ab

SHA256
99806a89fb4f057e7feb519f10bc72f65566a7d1124dae1670cc5fdcb615a3c5

SHA512
c63fc8e36e0b23832d053226c0706e2738c07cb94bd04ce57644dff1033af214c8511266641fac343559f6735ddf80ae048e4bdc58814a36a5330f68b612d03c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcafe9bcf4251c6908d3ab30952c52dc

SHA1
b7d892191646e598b1d71a941bcb873e4db5fa0b

SHA256
85d4563dff3e449d16720659a0232296411bd0af768d028887426ade17539290

SHA512
8461e2806033e3c59d9d5fe0ba21bb8afa68161b8c6511deb143f7d4bd5e508ffc2b287d4e2f9cc13be7f10502c604c25fc4d8082b4a658f64aed1c31895c71f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
350ec2d5f2b36585d1c69521e7cfa1e1

SHA1
06a93cfca31e7d93e3aa30b958b23917d3eea8cc

SHA256
f301e6234bc7a24fb423be42012bf3027fe0718d4369ed99a26443eee5cd5097

SHA512
2e13ca1d67ce30ea22a2481017fbe4d21055c6cbee93ffb9100430eab086063ca85941b3b92d3c52ec559c1fafd5334e88d604ce68987c15507a61357c0b3ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y9ZL1F3Z\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2909.tmp

Filesize
96KB

MD5
325a9f52a337369bbb3667d454dc0a16

SHA1
a3c1a8a5717c8a4405f3445ff6cb5dfbb142b60f

SHA256
f37973712d0aaec9621964d877e7ccafdce6eb9c725d02fae5c43d40eb5a9c8b

SHA512
8eec509108c221ed9fda02ca0548e8a66b2f0f0dd35361cf17903930be52c6abeb1f9d86811f5817c2aa3abca1474e6e3212b51405a2cb4d6ee68e3539dfe8af

Download Submit