648631be251bc065637d1616ca24eed71a48f58d816bc4d05ec0d755053fff1a

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bd52be4b8661461aa98ba1805869238.html
Size

23KB
MD5

4bd52be4b8661461aa98ba1805869238
SHA1

f20069aaac7d43bd32864504d14314ebf588751f
SHA256

648631be251bc065637d1616ca24eed71a48f58d816bc4d05ec0d755053fff1a
SHA512

ecfcfe1b649262480249e20d2e5714bb9988e114a301bc5a5761ae3631110df8e6608e77200d8e82a7b6a06ec48112e67847e1f34549a4429b2494035191ead4
SSDEEP

384:811bnSgdvqbgrRD+1B9R9OIhOi42MTpbp/sSk:8Pbn9hqgRSlR9OIhOirMTpbp/sSk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410359021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02dbe1b743dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000074304c7b692d83dfdcb96fbecdc68579d4a2fae5fcc52c1cbe705a71724364a1000000000e80000000020000200000009ea1d9841f36e1e85934b22e83efe9cbfedcd6cb0339ea22ec4ceb38670070ef20000000df17f6695b2cf87554ab117f67f195bca33febf384726ceddc8859745466ad4d400000000f95ce2eb532fa50065fa5a55746519d99259597b8fcb62ffa4ace403b83cf7555e8f9507dd0f55cecfed24061f95b5b7aa3f1428df124d02e0d16538de2390c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000bbd22c2550dc773d86d86844111e3ea94438c97215ef54165b94e5bade855dd0000000000e800000000200002000000025cb2b11c47f600af0d3a5057e2aafc3eeb0245398963021b017a78622ce906d90000000e7fab372e392216fa4abcf6672705a839485b03b52b21937dd40e83fcf4e4996806e876065d5760a412e76ed3338b1a85b58c47445fb73e7997c13c55ad0598f771946250fd1baf8daa04d945fbaa3931b5515b57499b8e8ed9f9f910acec74195c6fd619cc6b4ecf61651a87a8ecf3e8b5f8d7fbfd27c0ea4e6fa1e92b7f464e79d77f82cb1b5aeb96cbeec63459e634000000044bba06739b02537fe96e8244b8dede267a72b506bd9c1d14a4cd64c1b59e42b7032f3e7f39db58b5db215013cfa6752ff2dad622e8b559a5a3cdc2744d9cb9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{450B5401-A967-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1428	2276	iexplore.exe	28
PID 2276 wrote to memory of 1428	2276	iexplore.exe	28
PID 2276 wrote to memory of 1428	2276	iexplore.exe	28
PID 2276 wrote to memory of 1428	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bd52be4b8661461aa98ba1805869238.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aba3cc262e5e257c235bde4d326663d

SHA1
27cc2ef875f7c532f25b16dc9eb0b3facd809ff8

SHA256
ecf78985f801d97cfe6aec1552eeb09e86574f0aaf2bb69d3c585da22731a13c

SHA512
45d98d947c1ccab8452a12b227d08c145c9d801efbcb7d2b603031463863c028a6eba47b0b26d7650e738ec787e907015aced23bd24d512be30b53ceb386797d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ce99326732eececdde012233e663532

SHA1
11145a66ccc0b8f3b183a9c893cf352736406e7b

SHA256
aabd249df893881d4c4cecf3beb68a1dbc75bb70c5b111c137b85c795b4cdc56

SHA512
736c5c7e49d0f78289e0662c0a108160b4f93b8af959e09f04e604c36794f4702998317b1fe40460c469282ac555ade3f1cc1eaf99265b07fc86a0f02fe817a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e80364c1621e40c45257d6aa49676af

SHA1
07fe84860cc350e1b719d36ad46989b40890b8bb

SHA256
c510a584b571fb64d7eafbc05ae2d84f92cc9e77042cdb03c6ad7c0dd20e8003

SHA512
d89773ea195b05978cf2fa31ec412090fc48db2f7a2ac4a7a806cde9db10e5f8048c8fd346dd5234b5cfe0d4f678497d2a2c1af4d45a7f1d06bc88ff8f50adde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08dcdde858a0bfe99e23b199fd63f4c

SHA1
ce23120dd3d9cac411ccdbff1889f53cfee28cf8

SHA256
ed1f4e1b198d968a806cb63e9cbbd4b1bbd765feeb50d8b33ee8c32302c143ff

SHA512
cb5e201309a8c0dd33ecb243b67af6603eaf7cbf49f353f3ad5ecd6ec01a313faef10eb7c06e014a512ba57e48f64d0fe2a821c303ef4a800e3c6a909385228c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00963a0e5eb0a42a8fc589b97753b3cb

SHA1
1498b58c0c96dfc6a51babb352c09d86a1b692e7

SHA256
02645fa84969f658d6dbd67fd45493cba2af7be71b31d140e4f25ef9d2e79f36

SHA512
ad1005f458cd5b07c7b313c8f9f9b4c8b03560b61433a6956cb57e40e8f3ba2cc27411612b7b5aaf8cffc1530749df5680aa24309d6e5a6bb4da71d470433d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31ad66df41fbebe1dd90cc1f97398f6f

SHA1
2bea778d9cf13ff905f578ac56832961377608e6

SHA256
ad87165bb68d361f6cb73a2b01e0102fcb2e4a7717eab85e85e86150f4372d6d

SHA512
e13007bda4e14359371eb97b1e2a9cd4a14566ae19bf684594fa7f2df6e918d7d390ed6bc167984fa6bcb323e9c84860e4e9b2fa7671a79a26506b48c49cc195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09c41be3dfb3d72626262179e13ee46b

SHA1
7bf7e3f2e958cf181d21dec4587d0567c8e2913d

SHA256
0dfb10e25b1e01b6f5c8b967c7f6ea0fff13c6e481bdc8259660922cde98cdcd

SHA512
0e2985c4b5ea76f8ec4b7647f2c835dcc6a328516cc0589f8b3b189eb6b7e6d876544f6ba762d944d3131b8b16aa5985c75800805cfd4e5b127af4dac05c0529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fb25b0876a7c1915203d0bbadc4b5c1

SHA1
57f7fecc410c3c3349c2f785ca04b37818b92691

SHA256
f89e34de1531edc50e364dc6872ea9e9703cf52b001e5e48cb546854cf3b3744

SHA512
c717d37496318b636d8ca78c1c14d91f4c7b9e812d6356c59fc3253d6cdd87613241685b059376c9337393c818db8ea7a4836edac8251f05d19ce03b5c6a3cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e0595d4fb69a69fb8f711e521e1d75

SHA1
226725203a43ae9b3afd53f0606771069e62a090

SHA256
b60bd959f4b91c443b5605a8e28eabb44762a2422f6f2c11e3a3f1ae04a6536a

SHA512
a41650eecd210868abe580b5c60b9dfa084103768f5536e04af858a29c6ece02b5ac874bcd0eef4639231b270660fe65740b5588c3c4926b63757c3d14e7e67d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d6ae2e9abaad886ee159d6eeebe719

SHA1
d94b9a960fe9848f37cf2974c301b971d9a0bb08

SHA256
ae121904b4ec7bad1acd6d8631d9497c9adc1c462026d1ca1874ee0a5ab09f99

SHA512
0fd62d1dd964929cbb375fd8520c0cc3a2700150ad5e7f9645dee04beb459c38cc8596126959d121c5f0d66326efb80ad6c45bf15a5d371d798f69ecb1871738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be26d2cc611116136a982218742eb16

SHA1
3fdf8e9f1fd7db57afaf2ce46e74de21ea1f50b6

SHA256
4ceb8a9524b80c0c1ff8140d1ed1b49fa55bb38a7099241aba1ce51cafba2ee6

SHA512
1457d9fa1c378b30b29f04d64f965e8c442da854377c4cd6a331422b536064df8215e88a2951dd7f7413bcb9d6fc7d4c0147d763b20c5ee3ba0d373189fad9bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dcea5fd400bdfd7e6cfa1c3de2fa1f6

SHA1
f307bdb620dd9d430f5c04eb0eb6e0dfc2b14522

SHA256
f94cbd9527acd66b4a3f00da99f85a33c6f1d09fd5edc4eadadb156e97a8a13b

SHA512
8f3a4b0984eeb7b22be7a530ea33cd5032202980478c0ca147172395804531b89c2cc27bbc6df87d0db7baea3b58568261e276846ee8b42e2dc724630d12c760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24fcca1123f8265df65030412c4c6b0d

SHA1
82d6bacadf84c86a2c7ff0019fb6761f70b298c9

SHA256
284d50791bac843e2a360f64641adc40bb02fe3a760b21ca4c7838f956c28bb1

SHA512
335019e3c842a4db9184ca220a4d9d23de66d00755e84cbb5b85ced6486e96acdcfb19db5eba1df1064ee08f142f5c28d3f1c9ff44e49a9a120491b3e38e5ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7b47bb5f6baa774e94717bf048fbb8

SHA1
b86f09862b2ca55a5d0cad635da4049180541f68

SHA256
52c4d511d5e0b5049174c775047d7fe4d8cf8fc1d1997f0926db6fd0fdf86ad0

SHA512
80984504504204732ac3541f311c8cf01392f4a59384a0c1b7b001ebdae44e7144b37c4cf51b238a9d220273372b98ef4ac210e8a5ea7b596849a47af92b9c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD70.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADA1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit