9eeb3ab2f2ce5dcb8d95c10342d37a607235984290dba33d978050a530ceb389

Analysis

max time kernel
140s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c8d304ab3b057c35836d94b2698620.html
Size

31KB
MD5

46c8d304ab3b057c35836d94b2698620
SHA1

789fbd2124103886f6aa860d89e3327b35826722
SHA256

9eeb3ab2f2ce5dcb8d95c10342d37a607235984290dba33d978050a530ceb389
SHA512

dae3b6e394edc7c023ccfb7c0d3f0d6c8f0985dff57a08e99f3a76700d8f125995e79b91747e29dfc73f4a465eebd880366c20e3b4cc2a45020715e743f6b0f5
SSDEEP

768:/7xT0EipBptIuA+YqzKwpfUG4zHVk3ketT2SCmR+T7:/FTupBp2uA+rf1dt6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE95D631-A93D-11EE-914A-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000086742019f04edaf729f9b273d7ec870812979f320fc44032e5e05c1f83ae71e8000000000e8000000002000020000000f7e0b1137d6343e54ee9e7c1051a189595327745149199ea25b0e9e00d725bbd20000000776441cebca134dc3d8f41e64f64cf37c3d02ffb072d3674ef6b7ed23c737fb84000000087455bf5a648eeb28c94590f637cb06b3f7a5dc1843242605295b7a113329cb5707af01814d2f6f6c437790b052a2654f0580aba620ea285bd8195c43774327d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20dd9b9e4a3dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000865fdc866a4ef9e99ce707e29f876b5402b02fc5573832cebbb4fc75ef5f5860000000000e800000000200002000000036d635ae41ca127144d969f45a2add2b71f668bf7f5202c18d8da02794c66b5690000000d8fb7444fd0fe2d0ed6a8d86ace28afca2d774c4078cbc8f07cfcc4b43f797cf3b018b66543b34e97fda110dd35df42ff26021f403d64f8fe5aa33da98b03a3d845f5cac58de80cc25d8f22caa0476a03866b5155d0ce5f6d256d8437e632e8f2528e60c7127390031d2bd5d7cdb396e123fbc2159a48d9ad57f4ae138f9f8b26cb12e8ac4a7f4c07a2bc381ef5c1d194000000079df5bf533709a934577ffcb403253a2672ca2846baf945390470c06f361a2f5f43c0b82efb69e4d3df71b8e91bcdada2fdb9e5bba448ba5309233ac89b04f3f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410341192"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2700	2648	iexplore.exe	16
PID 2648 wrote to memory of 2700	2648	iexplore.exe	16
PID 2648 wrote to memory of 2700	2648	iexplore.exe	16
PID 2648 wrote to memory of 2700	2648	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46c8d304ab3b057c35836d94b2698620.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
4427305210cc57bdca1710add3dc08d6

SHA1
64e9525f7d2b88d3ea433792a12595c68f081b11

SHA256
982c59857489523587650d804d50498feeeeef4cc30d595fc16924d41db17b1d

SHA512
916659e548917a018fb9c4d8c8d6e9acdab7d107d506e50d00ecc0f2bdd6668a76a1a033ac90ce8c44a45edc4e0166b2ce8a2e79a664de9961de14729f104ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aa546bc9a40720c46c28a3524500502

SHA1
a5adb0b05363fa5f63a891e6a043954def1f228c

SHA256
bde146f5d592cd3cfbfb04fb12b2929321d3300eb0ec5373f2728c6adf5fd595

SHA512
07bdd7b51ce76719ebe7fc28e66b9f78db26e709710e438e698341cbaff79c5c9a7788b487bcf8975cc0c63fb5317cd4d606ee18a165421d6521bd44615d3b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59af79a5f539511d26ad33bafc0f85d3

SHA1
47f68d417f9dff25e892380a1e7414571f5314f5

SHA256
622acc7b91e623a323a92e02bdc8704ce00f208bf64e23d2ec0af3e1636203c3

SHA512
e3522594757e43d86959bd68cf47d6f0d138e2829345a850fd502bf690224465795fac222ed0eff5827fe081eb9ecbc894f2027a7d26b00bfccda49b6fc90505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
282d38a0bfad9d24668c438efe8d335a

SHA1
873736a431840cb68ceb7596934e67cd60203941

SHA256
670ba53b6dd16b57e00317a68a7751e6b8058bca6fe49178a59a2078a45e2584

SHA512
1cf4615a3d98efb8e0b0f8535b454e98da5069abe2257b285dc9841e8d006133a93c407daa62dff8e578d98d6b6370bff9ffe6287bc168c494f941e5b338450c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d75ce7670d2b5b4c415c432c16c5e2b7

SHA1
524a48558392098531c75df41e58627dcea0a8d6

SHA256
d2405f830fd70066e889ba1504bbe2e049c84eb2c36bfd5fee536bb0322bc45f

SHA512
d846b21ca2b0b9bd449b34d3c952cd4fcd92cd1d78c484566e7742f715fa92beeec01a0d935a7eb0870772b1708c001181e8957e0bc426e4d0dc11895dca6158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0a46e614f04b446b90d682c7d99f2e

SHA1
c06f4dbcb73109e31fc3b617d00eaed82f85a10f

SHA256
c2cf7b151fe7059fde819769e908d9aca1676fc1f9aa8f54a0a30c2a2ec06eb9

SHA512
ea0467bfa8fb09a7728f6872065d7cdbaea822cdc56667e01f452e974858ce67d95beb35aabf2945946883cb79c0596a3648d63d3b933ed4afbeb243533ad95a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c20fdfba40364f6c3870d4f4926dffee

SHA1
c06cf6ade4f93bc854c43a40d641b7533122d98d

SHA256
6712f25b95b7e47029ee86b176215a5c7f975fce28b249e68374b615f70f3460

SHA512
cffd8d960177d34d9672e28762ef8e9c4cc8e2b098e01fc2482086294b9397063af95d31920b69a4565af2320938bcc0105de3a797c9bb8a768f9ad4bd7a5423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e62637d65ac5895a7696a0228d7f27e

SHA1
f9cb6ea247ad0c2fe5c157579e9d14aa25a65229

SHA256
4f13f3db912297df0da29397a1a0293638b7c8633b1d53a6e480f10bb7ca3bd3

SHA512
c38c5f6d8a28b77217c31588cf83e2d7262828c9daaebe1f79fdf38a1e928a6c0d593c3c6f88c327f518e61b9c0b172f6057b4e23226b8d72c2a82a2dd672df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb1c1442aaa3b7cd4bd4959819e5b524

SHA1
8642935b5521c6b78ce164cbb4ed7eab39681eb7

SHA256
aed9437b6a84c9d18b136b099c4073123983ea716f04cf6bb13f3e6e7fd99fd1

SHA512
e71d8f5cf6d76129b6db6f93d8c17db3168fdc165eb2aa5d5576e60b2848adacc0568d9be7eb21d2fbc79041ed007b2f13d84030c92c79c7474e992d271bdc0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a34004f6528a6ab5bec75f835a2a11e6

SHA1
07431c01959caca586ac66d07cd7229784e6a48e

SHA256
d983d5666093643966a6a91b529135e30abd37e069748bb7aa19ca07c8c92c17

SHA512
837002e4cd17f3530176b4dbda4c199ccd0785e04b9403f261c5a958692b35b3d6afaa8ca86f4ac1e301b1704435b4a19554c79358c4dba5b8056b0cb93a5d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2195e6d5b16552ec3ba844a7e2cc97ff

SHA1
36624ab11b798af16a56d0456b18f84fcaaf3f0b

SHA256
2f07d0fe63c5de9b102e4d14c9ae758ae86b6f3fe948842dbd53a52eaf38cbc7

SHA512
12134ab7468c9a3e4ceda07204bfc7df60a5cbbfa79fa5b409519f11538281983aa825e1970a7e56684a636401b87a2ab4e2a61da028a24a5f6ae1a717330dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB5CA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5CC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit