076e937025b5e11fd3f1db6f776bf62ca67b0dfb3f048b8af81319b856e50947

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc37f7b6be37a0eefa6bbd1e26b1247e.html
Size

3.5MB
MD5

fc37f7b6be37a0eefa6bbd1e26b1247e
SHA1

b89786a048d5cad0d2c9c36d842983de67fb2189
SHA256

076e937025b5e11fd3f1db6f776bf62ca67b0dfb3f048b8af81319b856e50947
SHA512

7d5595dd7893d66ebd34c290e9fe96e1b4bdeb034d423bded1ce6d2d414054d2fb4f66dda5e0084f9ec78f023dd92e631d2687bd14cba72acd568d0e337f4249
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAl:jvQjte4tT62l

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000c3d4bc44ac153ac71b2a2ab0c39212ce1be00d6fe8f5e66837d5ac42c47520b2000000000e8000000002000020000000bf985aad7e977edd07c131c05857ca0dc2c8f30f4b2510a1529c62dc273f4a6b20000000d5c38ef517548eff2854fd9dbf524bfb0053d4062dc02db7794f488593f3192840000000704b5ee56a0cbe6aee24cea3ea477c59c8e5a448a76c58bcfd49a24eb7f97d32c19cad741c2606afb5d004e8c8769cc84e8c6cb3b55cd3b2f699e6f57d2b73b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F783541-AF38-11EE-B0F5-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000c8521b20de1b3d75d3e3929076a97f8ab913c398cf2d9c250ecfbb13671e7b86000000000e800000000200002000000011fac34ba79c33171b7b8787a11f8ac323bbf739e6c17ad5c61283b5897b512c900000002cf39372c1a7551c8c80bbff5d966329797316e06fa0d55d9d12977da4d0a9f3e23ef935f478c3c6fecfa76275ebc05099ce404fbc6c7ecbd2c62f019d26b0b1e384fc3a4333ad16d50c3d96e14fc6c529dc380a979de1b8c2c394ba059658e2c3267e5b43840ef902afb8e33b69b5effa61f5361f2d48cef5dc04aa80883f3d02d0dcf516a4017741b563f804285d84400000006b942592878a6bfa866bc882e96bb05e8633875ae493001973d5bb38fe77378e0b140352d54b608eb7c2dc2f9b90330940b7edc4b5ec03eea96aa66008c44ceb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209e76204543da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410998531"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2208	2536	iexplore.exe	24
PID 2536 wrote to memory of 2208	2536	iexplore.exe	24
PID 2536 wrote to memory of 2208	2536	iexplore.exe	24
PID 2536 wrote to memory of 2208	2536	iexplore.exe	24

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc37f7b6be37a0eefa6bbd1e26b1247e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ece2ba77b1cc9f500d1c85e24f85e16f

SHA1
4594faa8f15e557888e40253ee7d8fbd934fd388

SHA256
d55f0e496190b7bae68683e2acefbf7d76cea74c839640a91d1a7f24e3fc689c

SHA512
c06bd6f62de306c267c0e37dcf6965ee06162c02042ad72a38121b071f150eab1850f709dd6f5ee403895c6e4b81941bff01e04e1a83e96851cda76a0c940f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8989e1cde36231aefb28abaa3b13090

SHA1
cfa75152ff69403552c0118afc7e57c275c616ac

SHA256
a61be63b9fcd480c7865a0a2586786e862d5feabc525ab3a684d173bd738d66a

SHA512
4a1a950c36bcdd08f0774d907b9b65731c60073cdfc7f5d5d7ae18a9bb315efeb5f75131619647a5227d94c0d7a2a4523b169b6deaaac17483a5a050c10f92db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d49fc135a148744b633e81cbb65beb87

SHA1
75da7210dbd45541b5e6983d560188fe935e0769

SHA256
3fa1c2ae502d8c3ece62a4c490e617eb793d1f7a966faf7b5cfc16eae9853fe6

SHA512
72c45c6f89dc5f0973320f1f8035530a13eb200518edc8f7f914835508193863a779152928937e778693ff7a9c6d409f11f7c2f032483c355a97db52b41a3618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a8f885ea8c4ba78d2a1f0619be8a50

SHA1
54ab63abf73f2abad5a44e6ce9dc650569110999

SHA256
38b7290e026e3dee876422f4c2affd133d1b47f68a0a138f667368446400a4af

SHA512
b42ed4a326c5e840b03e54fd4ee7319ebd3d46b8499b7564e595e5f5435a860e2c7e0abdd4b31d184fb1cecdce224b509002a7c4f6b2369b9a3f43a69e8b5f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91922d6f29364ca5d52b9ac9cfaf28ee

SHA1
dd7eff8cf0c34e651806f56d9566bd87b6c7ebcc

SHA256
e41ce8ceee6d0074bf46f00aa1ee8b2b2724f03cc2d3c47a8340541d36ebd6f0

SHA512
e9d1177a7659de453a6d9a8790151fac7f6d16345c592d19eb3a61008f78acf45a04f838e527f88ecf5f2680aea921a54beee2ef3604b27a537f68455d5d77f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6cad8d1570d112ea78b96a549febb81

SHA1
2c5f7706c16e3a394d93446d08857894fbde5809

SHA256
1ff8fbfb3c9748d5ffa129c84e978e2dcb6040b61182d97e550fcea8244cd285

SHA512
eff4d645fc43bba63b79541c7d03dc96d3313fa06eec666ea9982fa6aedcfd40db7e36b9237ddf8c8e15c7207d2966a77fa0862650e47a9aa5ead8116600302f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4e01c0f9df5f7c55492bc8cb5bbd04

SHA1
ffa09019b0a5d9d9260df93c5c5c6710f2251cb7

SHA256
8bf8455777e2c6723e25f6a49a5387a842519a29093c0bb97f4e317b378ae683

SHA512
011cb30822ebdde44c63be8dc830a77e7df48f8f63bd3700f20b88e9849de6cbbfdfbd3f6993e1b38353ae5405926092e62c501b6162bffdf3eb2da14c0a896c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1482209571a6602781703ac010a15d9

SHA1
62ee66c6e4e191c401883f19c7c694eee6807ae6

SHA256
c9bbc5f5a96ae245d73838b438f859fe1c6acd079bf1dcf4b6522f7b557ca8a1

SHA512
f323c615b741a1cc60b21bb7b93422a084b5df70482ef1b57685c3f38584acd719b59df0a5d42cf25f4db2fbcea5e9f2b08c6ee307614a748803eb309c603242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1434463a31c4292339d7ce0ecc9b6208

SHA1
4c6f9af9b10a96efeaab972ee5bdcdb55f2b1fc5

SHA256
2054a164494308e6a221ae09c069b01cc3da8fa15b7972668cba6a82590e4cdf

SHA512
5f8574d4b0283bbfbc0ababeed1a2ea8cb0bd0efb150ff1b80113f58157ebd2bcd356988e41f20353d735ae1e94a0bec297c0b4129f27212c03dabafefe53929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c63ae03bdf301e8b23c338535f32e2de

SHA1
e526c991afdfb6bd8ea68919378617c50cd1aa15

SHA256
f7a0d39cec5a29d97c76791c0fd60f273c6c8a92bdd8e2f8b2936aa5f3a3db49

SHA512
f56baf5dc0b430b2565267a7954ccb8a5d828eda1b43042aac1974277331442c0b31fb080591623606454a30874121f02b63c6578ba11ed12f7882a301b998c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e59b8ed45dc87b06fab9161fdf669889

SHA1
2c751922c25acd738e4b81010036d124358f151e

SHA256
631a773d061adb8d00ab116fed2d88b45e288a50f55dab185c1195a8e816daf6

SHA512
953e7c367e20c03d65bb780394c389c4ba1b9d2203120ed074aa1658602daaefbeff02b00a65c8639a71c28d1fdd20721cae99752c4898d7f73a2791b0a823a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a24a17c5eaa141ee82b34bfad1856882

SHA1
62bd2c458d956a21ceaa4ebe370e8a5ead34b7ac

SHA256
7fcb7ba0c669779383e05048e83dbfcb4be4afcd6692df1d80c5649eae7c8767

SHA512
d780d27e4cf6e6e2db12d2c4d855608c53243def314d7fe775b37954b4e97df3bdbce51ff031234b1c9a0c25ae82608713a6b31ab346d8c2e79f5b125b9da0e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4de48e7d82a8b6768b464b1bbc3741fc

SHA1
294958623a0d15437f93d39ace2c1e40e8b9a638

SHA256
94fe44228fcc4ebc8aabf00ac438feea18e2c4626d056a519bb7e986f2008eab

SHA512
a76e90677378740d35f222fe7ff1ec5362ca62844129b7fedace6f7484dac6fc233f58f103e142fc90038e758ee084de0add4008c1b4ebe60bec531764978afb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87fab69dd0038a43bffac2e3efe84975

SHA1
642490a686165cf84be994c3d99be1b065e899aa

SHA256
f8829702169b14e1203104d11da69f017c790309d944a99207ec913331a83357

SHA512
4b1783c29a12761c4732d2e990d8e10dddb124f001b02e195a50a79e6e1e7eeb18bd6bfff96ced6ed2074d9322676305f807acbbced107e657a0bac4ac47ae1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1602.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1615.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit