ddfd6b30c27b6f695a883aa2360c98679ae3339f86c870b228e0b9c828791b7b

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46ccb887249e78274b860ac2e78f9d5d.html
Size

53KB
MD5

46ccb887249e78274b860ac2e78f9d5d
SHA1

58f099d3b7e367c028d4999ecd15d945d23d0a0c
SHA256

ddfd6b30c27b6f695a883aa2360c98679ae3339f86c870b228e0b9c828791b7b
SHA512

26fd49eab57510f5d1ef8472d21bad62f539e6ecb6155c56d8fb16c33e87b1717410bd10ab304b984f1542511c5c759f8b17a650b32b9f91980d2919fe0b48e6
SSDEEP

1536:CkgUiIakTqGivi+PyU/runlYy63Nj+q5VyvR0w2AzTICbbioP/t9M/dNwIUTDmDb:CkgUiIakTqGivi+PyU/runlYy63Nj+q7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0203fca4a3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0D6C1F1-A93D-11EE-8AED-E6629DF8543F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410341247"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e25383ba5fa3c5f1f8288208b88145832930479e87e8dd027b5a6bedef8b27c1000000000e800000000200002000000014910551e614766f6f1ab81f2ba2e736c5a17393d9f77d406b53e40995562ac6900000005a2281541736b0d8a24775ad287ca3a89e079c077fe090fd975f61970e3579191fdf6f6b7d06089342772947d98d6bfc285c531837ec5890a823ed6c23e7c8c5c8e40cb226ce8aebbc161596b9814b76da609dc83d567fa645f0a08a7ed582c5e5bb703a611f0e27b89b3b5eb75a57dda65710a95cb033a3e8979af85e11e97cd3eaa2f002458f42d2e52eaa59aa2b14400000003b2803975cb7fab55ecee6c4214a596418f6fc8787b3ca9db76ec032cacf225c9f5885f3c3bf5c1d458b43f99f73740365769754cc0baabca3ec9b1229387466	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000041d7fd1e159d472f02a1fb411f026064f52bb706e334ccfd231c4a88d601c857000000000e8000000002000020000000460817ff54072aa397c333f497ec079fe78317d8b4522680c0d0fc21ef36c7a22000000089e2ab3d7a2f58e3d3c5b258acbcc06ddb366d13ac124180b840f4e2bfdabfcb4000000036a4a1d38e450a177be556517613aebaab5caa6f9693c9b2ba210885284fd184acf8194e17948f7b8e41aa950dbda5a87c00ee8f3363a72db933f33b9391e790	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1112	iexplore.exe
1112	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 2772	1112	iexplore.exe	28
PID 1112 wrote to memory of 2772	1112	iexplore.exe	28
PID 1112 wrote to memory of 2772	1112	iexplore.exe	28
PID 1112 wrote to memory of 2772	1112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46ccb887249e78274b860ac2e78f9d5d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc43318aef3a4866afb44b0011df8d60

SHA1
8fb4280d74f73a5ba4ee510a2b254307156bdbed

SHA256
8db69ccd6ae6e7a3325e7a2fa0b7c7cd17fe9ebdf248480dbb32abed248a9088

SHA512
5b292128be33f2795b0f8512bc77538d047cac607fa916f9df0bb368c05fc32d56c6768e1c74057a1d651e337a24ad59890ad01e033334cb618dbb876017d0de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bb47ee783ba2e52b37c0123204dc9b1

SHA1
37fe727381d02c4499bb79649294ec10c4031346

SHA256
431fe15c1175d11b709d12e2c243177b2ef6b11f2bb738b3ceef9ea3d40b0737

SHA512
bffc931e94631a381bdad90a1437faf9137569bc908dcaaf46a69ce5c3b4f8ac450d662f52d2063af0e0c5c12aa43c48fb5c3bee4937f9b471a973f1fa08a511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eeacdc36cb4964005c64e36fa09355a

SHA1
62f781a781d55653154f2635c9e970dca5e618ea

SHA256
476f72a50b7d5b6447d9f8f791f88bdd3c824087e8d1fdc9e4e85c5bb5b45a7c

SHA512
ad233397d26233737832b0faab5c04e2837ca41979610e1bc9bb4022cfe672a85ceb7e365ce12fe874e09bd2fdf2183fd5547cb055a701863025c92cb182bf65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053f74d3d6720f31b17e7e6702e4d72b

SHA1
5bbf7bdf10bd7a83fa8e5fc757fb57fa6ee1dcaf

SHA256
427dcb1ef658cc2ac09481d6b75090ddf929f5ca5ecfbce71230358811b5483a

SHA512
57989de43d71b0f985ca276b220f0e544d7fcc13c423ab1304a7b49e0cded97cd7e97f03ca6305797eba761bbc334e70b0acddbd188e0b3a25d62d39b6e561ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1452256adc436074fa0d3aaa6b6cb1db

SHA1
bd0b63d575fba4fe4b05975853113384b893ae70

SHA256
a866520840607adb8617ac29e38e7a489fe6e466ff22980ff396f5dc15d662f0

SHA512
592303e7b76e0be2a722d4b015af0b3b2f77313eb6ab4eebd94747479fbf6433bd7e4130b824fd2df60782af97fe180df5ac5ac0a90afde9331763ab047dd50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0430edcd332e0f8f0108f591109b619

SHA1
d000b5b3c3c666267bba68bac6992f03b31b0e03

SHA256
d0a5db5ef7b43afe6e6a7efb26a85d4893310cba94419c45b1529629b7ed9478

SHA512
925653b1454a8d8c0f77f35fcbb1b67c16099bb208aa20d006fead729d3ab1b96454ae363558127b649ce4981bda989b47141a05be4d47fd375ee0ddb364fae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aac2fc8a20a3d48e6ce1fdbd2e63713

SHA1
19a656d765810764c1c1091fe95de9c39dad2c71

SHA256
d70b6a811a05f486676e69841f776f816207ead2904f533fa1a4cc10beab03de

SHA512
098721b4fc6c4a5267d63dc6780cf111ade2019d0ee13050de395aea3054d5ea29906626f4ce3a47d986231b72615c068d644106debd48d436409f0fcc45ceea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
966a1f9ed4bfb1fbc1f240709e3c29a9

SHA1
5f7f07f1315317b80466defea66a106096ab9672

SHA256
4690c8d993481e15376b9baa5dca0b7068eb3243cd34452b8ed91879b7935c74

SHA512
8c8ffd14d4b0905a82e4dcb1e0e9065d20997d162ea6c632940f2b556123ae00638a403b6539a92bc6b8164cf693872b1d205924d54713c3e79e570b1309ed61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66345b5699dcf3b36281f230abe681c7

SHA1
3886e41fa2c7dfd27f3ca263f75b544d9f4dd83a

SHA256
4959b11936f8140536a4f946721e961b7a24715be46fdabe277fe5a3c9661654

SHA512
a47df6560dba6910df29b103e926ec22fb228bb0699004cca5b94679cbd3142216c2bd85725881ea88945dba8010418801760f004e95ce484f14cc477e68b33f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bee6c207a89847654e02714c3064005

SHA1
8a12a2f86e56a69ffb3a6dba1b23aeac8b15c896

SHA256
ccbcd254a19d58f472a9d2a9fa3409f799a93b6355444f1ad6d7869496df0c34

SHA512
68db3df688e69fcff65ceb8f5c1f7a65baca3bea0a52757b94e2d833480d6e0e4cbac51beae34aac7f69fc91bd215825d6e00c6ed16c65f5bbf728de3c0b43bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38a302c1e025c78add2a7383fb5c1ecc

SHA1
47be165ec1934edcdc20367e491f8e71e80197ba

SHA256
c2375fc7ccef65e7c494fb3dbb4672453cd5ca7c4627664d25c696f66e5d04ca

SHA512
cd4b5ca317b1077cef460801b76f5b5ac5a1f46f201d32e698b144e2c660627bcf52a951c99dd040973f24ba1cd339dab0d0357aaec793baf5fdf9aa44d9ca97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d52e9f069378050eb7fed3278b19caf6

SHA1
e01380394fdd2ef41a7ccd3c62fef7a6533efd7b

SHA256
54670962d3c7f7209517616072d8ab32db244274abceda8e77aed08beb5f4a83

SHA512
31254f49ec7c2acb81622e5d774131553820860f1448a97aaaeda6e5da9726c84673b9f9a78d46690c1109b647864b34e5f716eb8b41cf27ba867717902be633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09c4d8a4f6915bbbf48f82c8988866eb

SHA1
d4ec5395037f514c4eca127732ab41aadcd7f3a1

SHA256
b9d217453ab4dce6e8dbd90f5735966086e101e0e7394b95eb1e03c2899fd0e6

SHA512
118b39f16c45dd2e51e16cdb6a13938ee9124d067fa8fa367677acd3e713abbe0d3c3b1ef668ec4e520ffc64b509ec2350ed9e8ed57781a65751c9a041f31689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1830411b90945cb25c9eb2416498987f

SHA1
c94c40ce9a2bab1c2c1df28996952dc1ad5989dd

SHA256
284ce36d0d11c6ed6e913059fa40a7eb0ab0e0435ae32930d28bce403ee11d63

SHA512
0720fe406a2c9c208447210a3cf435a5b14462c2a665fcd9287b436e24c1c89d01251ee248c8fcffd37c3231e7b03ae0d3bf037865151e63d53b48853afd654c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d15da9846dbf9a197d919bf6e1e0899b

SHA1
18222d6ce38080340b4f247496311ca7747a80e4

SHA256
20c572702bae5621ce5f81d3d8e1b73fc0fec12f7cfacfba292e2a1220c7b5c2

SHA512
b2f57e8b5cfe98c271db77dfe1b7be00d21d275774d3c5016eee4b7be43a9489f35fe9fdb28077cc4d3b71f2e9fd02d4990ec3b52341ab5455510103e404d24a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab126B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar128D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit