3c62dc2a097d28b7d3a65a8bc5ee8c75c718d431974f6acb94c53fee2a28af40

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5febdd499272d0804be6547fc9adb6de.html
Size

3.5MB
MD5

5febdd499272d0804be6547fc9adb6de
SHA1

d4659408e8efd283cf5b3dea87f78a2d4eb7c22f
SHA256

3c62dc2a097d28b7d3a65a8bc5ee8c75c718d431974f6acb94c53fee2a28af40
SHA512

dceef307ae7a73a23177147c327fbb735351821ba1719fc4c92bec7d613a1ad67a1a7fe1f1e30b5ce5262707f6ea870e1f18ed9095cf5c25dee82b7843c62f1b
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAM:jvQjte4tT62M

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002891387007ef1b7a8db892ea9989faa910c9b3907f65eeae37ccc75dd887f6b6000000000e80000000020000200000000b89a3c25b2f608a0cbe9fd0a71e57101f702bd3bea2cbdc8ec6b0c75a6fb0e590000000d4f63e56a29f0d0a85afa41e25cbc597e621676512c3f5f55956016b2712b5eba023fac93c11cb222d13a32877b1ff3a467f9b957bd9af4bb3689c4fb6144ab88c20d40ff403c4c4a0bd53151f0e58e52396d5c64a72df05f1263ed15e0e4b06c65cb66f56733ca0bf48a08b2f8ef4acbaa192a963597351cbc3a46c6467c2938b273784287cc1a6b0a1bde9d545c8c0400000001023bb36158504d60b20a5747007c098e4ccac2b81f4f5ee008b46934a2b860af1b3ef1f9afe154e8bb0511c52ad7178bd8d22567b97e1b9d58e89694534779f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7061ad226a40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B497D41-AC5D-11EE-A2F4-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cd7a8f992f84d6171c97a229064cc3dc2522c29bc46bf35c79278d5988a20d61000000000e8000000002000020000000b6dc2cbcf033ae106f7a7f755cad5083e290efbfce95993bc722f7e49b0601f12000000033434c6892e0298552b804a1777336100e812a47631eecb1bad7c8da157414844000000040c5761ec01aecfa20de71948a0c0a3e34107717fb1838519e599675a311ce43a293bc8c3e8fe95d9397ed6efcf446692a55698c59f889d8dc8381f282e1d32e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410684586"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5febdd499272d0804be6547fc9adb6de.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e3e685bfc1603fc1d536947b135d357

SHA1
af0f258e144b50da1502fa7ecd6f1b0709bdb0d9

SHA256
dde35e05b4f294572e3bcf8118113259fa6a956f3f96d192bab9f3e6dd6f0b4f

SHA512
885e292af76cc2bf6f9e397a55d750bc7f1c46417532ac5b366cdf0ca486a72706053c1ef814d4d551928c685df64ad0c04ce1ce58cadeb7ff6ff053fb095737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac4b08d37ee52a942e821bacf1d04e68

SHA1
de9b5d72e2e548d48506ced00896c90f2e161a8b

SHA256
732c9dca4aff3f1a80bd6d5c30e36392ec21d04349eda7ea8ba43e0bdb24c69e

SHA512
deaaa2f1cf08f53527496813eccd94dc2345a7a616bbe473a26241c8b17382bc6ad5982f00d45656fda92e111d3327d6b51f3d1c0139797deb18359295b4971a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd88de242e83f78f514f5ea5218713a

SHA1
e4cb085ef4d6a134482ecb2c01675f27148e5316

SHA256
653d33e6c925209a5862d2b38402fbac6849ca7f06079c3a7c51baf8cb53a9cf

SHA512
7376860d976d57daec36d21f2b462b90b8c44aa60088e45b6c73a2b1112c944e22505f27f7f3912636f41b95f81b7ef87111368ddd0a1430f9664d77e7979652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a319de60827ee06385b1facf83c2540

SHA1
32c12991ccc2900af8acc9260f71ad745ac13288

SHA256
a57b80cfe55741d75e29632b8766b34e1e6366077913d8e70f97ba3722d79c6d

SHA512
122a615b3478a2005cdded8f00386317179ab6ce1114f6fc4c8c32126be9e3f8e6b9ebc7201d1975f1d99b8b1f2861da6d32eeed85c021c0781668a133c1182e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb2a596d5e2fb9eeb0fac71d18703fb

SHA1
7f3eb57298560a787157f3c938b7340ddc7c5074

SHA256
1db4bd0d5e5b7b63e9e851566513583828b2c94ee5c25e8cbd2f52b54d6d1464

SHA512
8b644d98373caf76a7283b3b7bcd2ba406032c66f187077bc455b44aad2808dd5383e1f6479669038a37fc93bc5e6f5d1bf361a5c467a07caaf9dd05deaff025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7e4667a9000c20ddebdf898e498e7c

SHA1
c8b083149ee5357eafbe5b1a39e07e0e3eec651a

SHA256
eac0301aaf16d283cd3bac7421df8daa7145e51887f41150e6bd17105f7d1555

SHA512
e6d200399f866a523fffdef9beaea5216f589759958bd916ad5e4c04385197b07600e6c5c4e7391120b654f46a67a54a4a7da7b2ca82267f379f322461d0b49e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68b5e426e3551e95ee8a826ad0d10a80

SHA1
77be6b7a1b1f65b2e2379dcdd63da2e9b84b5c2f

SHA256
f7d240ec2f5eb656a0173ef17acf55a1353ff149f391120bbad2510d1210f226

SHA512
09a005463132fd80bad5f6ec0a12a87c11616731630ae75d8fe5f08e7aa106b2ef344fbb7ad544111fd67f6c5b9064bb5aa58237b3ca5120f38db88627ea78f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c91334292b7cbf16e1e4a407780b77

SHA1
4d0d96d8e794068a216f080694a26b3825f12786

SHA256
6803d0152026ad677de2cbf07c98f8d5c107cdfa802085808eebe35b3e407f9b

SHA512
8998eb2dbc617e7571413b7f0674a570ed5dc32b2c3d7c5b39abf4d5f5dada6dab167d760bfceee24afd1c47dd4553767456adfcf361dc74046cc0f35a6821e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3451baa13261f6ee1d811f68f39159ae

SHA1
05afc02f6edf630c34a3f47d0b91e6fde321af9a

SHA256
f4cceb6ac330f7bb7bc8877a05175513581e24447e2283c6d338a9233ac5b5c6

SHA512
658da2d7d2ffb471c5b4a266590b9ab3d87e1f5a6f05906b40eb1d16dcbbb6cda2467e3bd748a69f4e02e7e5a3b40ded171468eda3661fac3d65aaff0780649b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9521d521b58503997575ebfe23c5dd34

SHA1
b969158bc4375813d4b894dcae08c7a66606d459

SHA256
6d0a6b10b1051aa44135a3de661af7ef6b55454c1d074650ef6585cee3541dc5

SHA512
3453c8f173d43cb8bf98b3c741a352d6a2b47869c2bec18246f6be614567dbb00336c2af92bb97b2cb19ee21df626daa528ca4251126b91fc35e3c807ec17600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b98de0a4dacc83a2da9827259ed896e1

SHA1
284e0f7dda8bffe21f8f4fc7f79948525f5aea40

SHA256
1d767df3f8e639675b1b1f556366c72e7ce460bacad80525a7c111461ec58836

SHA512
9561a7e282714d5b0a45480569df9fd6a1dce3ae3178c1aa45c534a4a19ec81737cc6091926335c022286dc4e44c5d3dc51d02284b91fc91d267fc0d9fa58ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883d4feca0faef6bc1f3debf9991d96f

SHA1
0ac68c22e56bf76d4212f3a928f976c872e17afb

SHA256
8d62646fadb0533057bf3114dd98bdb0c31bfd209404b46c466d838ed6b78f3d

SHA512
bb4dc9ceda9faae4270d3de5ed22875092d708827fbcda66e6774cd6a750ec5e94ea5493907c214811fb11ee66b50df78f925105e9adce1a81cb65924cf79b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d25b32989c2358a4f5b7e755662ca83

SHA1
783bf1da9a27e7ba8c3d011f8b7b2d6ae455b096

SHA256
769d8a1b3513d43f6b619882d0a99bcbc3debaaab96dd7b5031b2fea7d9878e1

SHA512
27c3891659191cdc1bae501e6f80c4525be951e92821fd7cecbc88cec00075c0f2f0b6185b680089244373868ae0c71b051ccc1a1808cb0afe6b0a15cd91cac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b2df759a3a50acd5825dd4d2377712c

SHA1
cd013d8a548bb07c2135c860f4e54aee01b186f4

SHA256
6669808e5ee8caac8d82f510a6f8323f32061148c507dc459c82217d716ca774

SHA512
8410f74faea33938fabebb982f24ac9989e1df3874b28f51175f789d3dc679b89ef113634acdc302e3a1d0e63cbec316c76c46487db62128211832dd83b6bf69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2997f00d30858c205d0eec3c2342ef50

SHA1
2e21e0cdb19c0af347cf75cf6152436932afb52b

SHA256
859bac39f55a78766bfcc77612faa480e22c0bc7e95e9ca9f5153005f7767e7b

SHA512
88662aef8df895d7428e1bbfc390ded0f16f67306540cf782133cd553e3c5a8acca4306cff6edcfbe44aa4e40ef0176dd14f3365ab5138ada08100a7625df001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab789A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7AA1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit