52943239f5012fb4ab9ec7cc66096c95bb4262fcfb90e833b3cda234367fa8d0

Analysis

max time kernel
149s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5af1138a278e8dd7d2cacdfc96790ee5.html
Size

11KB
MD5

5af1138a278e8dd7d2cacdfc96790ee5
SHA1

5d73ab3966a9caa4c97a1ddabfba0965fcf69769
SHA256

52943239f5012fb4ab9ec7cc66096c95bb4262fcfb90e833b3cda234367fa8d0
SHA512

69c9530078da92aa19fd4961ac5de5e6215977c335d237364aedc7695a6a27d9a314037acd919b51b83d4b7384686cb141245d8995a34f7f1e624dc11b802f4a
SSDEEP

192:t58GIJeMg2tQkPlX8mB2xc5qrP/H7d+8J+W9vozledGs4fY+:s847p2e5ob7vKsdGs49

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410670303"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{061B4611-AC3C-11EE-A7E3-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b47ae582116de70ad71248b830c5c7210d6f3204ceae6edaa3bafb85cf61168e000000000e8000000002000020000000a9204b36818e24957bc61e68ed26bf733d6368be1604daee5bd7d1e730ca231d20000000e984c5cda2b99d0cc396db670b074e1f9a23d45697e124c958e37c26c19f5f3c40000000bc2169044d12efa3bf040d1410d51addf40ee39abee3a64a3160fe865e5b2fa4b581f3b589ea7cc3a767528e2a2d9cba7bfe9e86e9350436711af57021733f3f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ba0df24840da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ff5774c42e0d7e7479cf84617c111413f8f867bfb8057d751002736bf677e83a000000000e80000000020000200000001f98f273318e4b92bc3e79ecbec5117752229890fbe47e74da766253bf60ff0190000000ef1cfc710f0c4bd2ffab1d1f8c05076833e648e63d89c0792c33bb4db2e7382cac2b94ccfe21fde817b535d325e2f0b88cd4073345bb066e3023c491d9881712818fbcb868e4798bcda57068a16452337f6817c3e64a333cd4a8664baedfc555c1e19313d86cb5c8fcf012566d9ec647902a0c68c20285b5eacbea68a63246f3803bdc2e5241ec6d3a8004f357c5a99c40000000f6fa8557991b54a8abbcec1f6cdfccb0afaf93824cb529d1bac7c911fae54e6c26725df3bc73a99bc74d2e2f2a3c69ce82aad627e9c011819972f4026e198e10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2876	2068	iexplore.exe	28
PID 2068 wrote to memory of 2876	2068	iexplore.exe	28
PID 2068 wrote to memory of 2876	2068	iexplore.exe	28
PID 2068 wrote to memory of 2876	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5af1138a278e8dd7d2cacdfc96790ee5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a63ea05c73bc02178fca90488dd41c1

SHA1
622a81e80f5817a2ede495f1b37fe10c2e53c2cc

SHA256
60b03a94a5b7089b89dd49c4ed72bc688513c54c59db5208d4058b5852043295

SHA512
5621b0b6166eef3ff657c7bf125b6fe6a5355526b327ab20dcdf5af739a8ede21e5bf744efa05ab4fd1627fef9aaa1bcb6b57a56e461b9bde0b944e037de7532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4dd4705d0dae8b98d5e914d8de1e870

SHA1
b03053dc5680d168473adfd6a9c68fc920fc9fec

SHA256
19d4d9cd01e8d7d727e9f49a7ce9eae7f60ec31259ff7c1a96c0bfbcddd0f5a3

SHA512
0a19ee2820b6a5f3f790df56a3476af4e34f34b1352db4fcdbea887d40b4c6479c8ac2915ea7d7aee40d48e510fa6e303cae59a9cd882980c00a69217a8403ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0c5e7680f26ad33bbffd17b8920eba7

SHA1
fdb5653a5fefde691e550e8596f8e818e829ce77

SHA256
d779041a962bb494f66399baf15027f82ca13603dd8366ff8b79dd0d626b7f60

SHA512
b7abea4d6f7702dae590e0a67516bf667474c8195baed2483b9ea4060067d48aeb8d38150a7e82b4578dcae96f27b8b4229c6ac8bd2ddac519d3efbcf0c5ac79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f4b4cf3662513e280332f78364760d

SHA1
b21164c6eb8547f5b62dc6734bfadbf6e7fbd82b

SHA256
d675e6e7863fb28f76a42f2d248aa02e3a0f7079d77f9ab657689de76546e24f

SHA512
b0ef2f422f3dec7702c94f3b603edae4df5f08d87e4fa5e10986e9582d5daee443d6c43225627baf35beea6ba7c245e44afd78434d7546ac2cd74e1199006477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa55c337bef5dedf01e6a1e76d4436a5

SHA1
135519f0e5ce911dcb856c1621b9f0bf7a685d89

SHA256
14b4b137d8b5c888d35d61b8262fced3f0a529a7a248c386a6fbe82a768c7365

SHA512
65892c12be577e312f2d66bb65358d0a59e0f2a336f2734fc7fc02a8190994f1977dfe82132c936dc53271c579aaccffa2a64a302ce4967f00696f9a57375f0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f92fdd3b2552603e0c0de17f862252f6

SHA1
da47a203b3ae70e3291f899bda060af47b2583c6

SHA256
c850ee60e0bdfcda7cbe00266a674caa555c9e90885d47c93629a96ef9935ac4

SHA512
f6cb12b20b2585c8a8c34bb4dc0786e75f7ce815963dcb133ca39ad6daf7894b3b41433651569d76a4d15c5cb9092d644ea01932b17110d4a15eba2444f3dec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29bbc758bd74a7d20c91e9ef32521466

SHA1
2eb735fb845f8d492020f3f3256f044fede5f146

SHA256
6ff36bca8ec5a1d7e49d2416ca17c211df3e59a22f9ccff18628c78346db66a3

SHA512
feee1395a50264864e79936b18e268508ff2d42c12d1df77b5c70f4fda0dd313ea791b92e0f94acdd4c9ecc2b2b18b801af52b629d30e724efc67690546db74c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fab764692b8d4239abf81b5b179deeb7

SHA1
fdb7ff449445f130c993ec92fdb6c71997d1e911

SHA256
23f17c4ce1469a8b4741704a12e915383b0ca9601b27859bb5a5ffc3a063b967

SHA512
e095886d95e535703465cd775e3928b398deb1b1b07193d3b8b6352ef938c91338cba4a46da682b09b16f6714d0053c6d809877204f1338fb1144291aa331fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72cf0a963920386ab0638ce7c5ff134f

SHA1
94e92a0fb58522990ef5520634839554f9c4cbf5

SHA256
f48ed0cc995d7a67771c891a6267dd1c40332db0ebe1a7517ea0eeb1b6510997

SHA512
69f633d6d9efd5210d5bf02ab90989be79b9c4a2957349c0b0be99fede009f6b57f23ee2d133f6d192b35a2cd3c965a0e0198835900e3ae9e94f2b4173e1c35b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d16115bd227259dadf0e6057619f2dc2

SHA1
102c9d8aa46f4615f088f6f9bdf1a87cc8a856d1

SHA256
16333b20ec0a4c676bef9ee845228a059b80bd88720b0b48f1f4e58b042e0e86

SHA512
853bb3ab5ebd9b97b8523dc70284df3eae864cd87af2affb68d3076a11085beb8337b493dfb969a6bbad1a53035908dd876caf671ef9d1cc68bb575d9b7451c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2524fe0bdcaf835f401f470b1ac4b6d

SHA1
4b090aa0985e42a885ae41704fb24e744f98b0b2

SHA256
e4748304dca2ef214330d4e0a7ee3c4d17b36af53725713b7cea574703cd1aba

SHA512
a348a88fa1f90dfafc127230f48ea9cb1de6ff958271a1a78c7d0cd31c9d251478e891e053df03ae6ef6880d3741e6b3908871244a9e0979cfc96733ee377a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56b9b730a218f36f4acd65a773560b8e

SHA1
8b08ff4618e4a1d979acc85721bf4e37b44ef7bd

SHA256
d5e2d6df3fdcf7d449f317ad7ec0c2af501124d24c787d7674b558c4a945e419

SHA512
f8d53cfde4536f95d8322654f16d1af6fbe0ceb952fd7a1de93ced46b010ee34e183afbd7a0b0c62e6eb57bc6565449979f16b116eaa9712a670a661ad663ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\jquery.min[2].js

Filesize
55KB

MD5
bb381e2d19d8eace86b34d20759491a5

SHA1
3dc9f7c2642efff4482e68c9d9df874bf98f5bcb

SHA256
c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899

SHA512
abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C65.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40CC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit