b8042ef4cec6f570b81590dc86754e6ae1da548e88c737460f68134045ae7700

Analysis

max time kernel
136s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06ed8e02f7325f0c3b42df671d36e2db.html
Size

3.5MB
MD5

06ed8e02f7325f0c3b42df671d36e2db
SHA1

1790c274e380ed08b9e83f75b7490bad63ae422f
SHA256

b8042ef4cec6f570b81590dc86754e6ae1da548e88c737460f68134045ae7700
SHA512

f826add90e38bfe3155ff159c692db3b89b6e158a215b6d88f033d968e8e6ab5b5e1dab561abf2949ae0e301a50d5a71a3026eac7c872ba49fb11f8752080de4
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6N9X:jvQjte4tT6fX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d0af6110af5c29165a99462135ad52ec1e56e0cac27c62ded9d48c2b0de469ba000000000e8000000002000020000000d778744391c456a8b95a1e674352bbfe704624dfec4b97e38949ebd21633dc4620000000c1ba75ff217c48e2d8ac42b5acd04c68a2f919535157ec48f64ddb3942cf8bc9400000009e239c108b619fe60cccca709685ce7f7ef624e3f6e391963994040f40e90528f1509ab78d087b645fc36742f9a95c4917f2094b350840e807b0dcf9ab30f3ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19A03761-A6E5-11EE-A80E-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410083211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206254f8f13ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000999eba8ec711ce036a7e30e781de6beae70c8e29407618c5a6e5f2eb5553c9a5000000000e8000000002000020000000d5181050bfb23b5bc4f5762b8872381f2c2d042888b90a6c0990a795c7631220900000000521484300c70caf4427a6546fb867b73f911d94892e7f09e98b4f02205ef5e35db5d8e47dc6d4c82c0711eaafa0abc4ea813cab41d5ddad41c0c482be3ed43304ef1e3f64f22e7001c4485be00fc6050c06b4310c480deeb0f1864ecd06ba075d31996801962c70f8ad22499ec52fa624c725c252be2a3d45044c89dea19dabffd38adb033d0ade0fe43cd32729b3cd400000008ec4174339db60cfe320db929a70a80db54144d3032fe699c920cbac1da6902803c359ad87d5aa13df862d2fc939240a3bafeb17154524c02647c1288bb31f2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2304	2148	iexplore.exe	14
PID 2148 wrote to memory of 2304	2148	iexplore.exe	14
PID 2148 wrote to memory of 2304	2148	iexplore.exe	14
PID 2148 wrote to memory of 2304	2148	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06ed8e02f7325f0c3b42df671d36e2db.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7027f203236654c16ab5a32584db051

SHA1
17dc19e2cf63b48dd93788c4641694aa9a8c0227

SHA256
f5fd998bf741270c8da76167681dbdf1124dd372110430caca10716eac7bd5a6

SHA512
d1d79f4ad32776b935232e6548885d96afe3f3cee4d2b78615be1580533749f7fd9f4c599addb4cc603cb754097f805821304b9d78b27628aa8a725f6c616484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23bc7bc346bd7ea34f0d8d6f1e70172f

SHA1
861451b6b7ffe9ee66eac789e73854630c07baf4

SHA256
b18ddbb87ffcd54af4d06eb80792b87ed37b08cb613ff9fe69d397e1bf0b71c8

SHA512
1fbc349c1e6d2213736cae573eb28a8f98eec1c6e537dcf46fcca763b4346adb5298ee826c8cd103f53cc2ebaa0172ebfc02c60cb6719db834106c0791099f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
618a4727d059821eee0c7c7750849677

SHA1
d15f5066889797d4172709c001a7c2d1e39d1906

SHA256
93845fda97dae7b1db87d6c0be0f80c65dad0f546901d61aabc64d9aa32a4a6f

SHA512
957ff36310673d9c3db9436dd600261dd4c792f788ad8de69ca92e2d77d198bb61b3407b203be598b6d4a55caece22d293214075f925c26c6be431dc7d417b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96115d1f2eedc288cea0118b6773ca7a

SHA1
9cdbd3418fce402cde7717081d2282e8dc3ad748

SHA256
22376ebf93c4f4d6aeaba890b763d1b150bb4328acbea9d2afe5d98a3744362a

SHA512
ad87697934e34ff40024f803a995766889980b214868abf3cca21316d0179461c2b988fd0d6453f34304c15cee9023d2fc36740e0aa36b826bd6ff141c474eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4334007a0452bf97cb28f023a3a32471

SHA1
f4f4211fad45faa1048cb53388fff6293df42198

SHA256
a778a535e5ed2150f601c6c86a9320bf705a7d211c5a4c8a972f25274fb8f904

SHA512
7c8013cc571d9795d73f683da36bf1a789e78ee5479244a0d14906c4701a80326b65738c40ce3516c17e461e639722a0ba90ed64f31326f836ac65d84d26bf63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8c1dbd52102971db9f4b79cb16a3cb

SHA1
d1ad8f9eb9301167d59d46129f30844c86c879de

SHA256
9065566a69938f01c285225c9d206399e53aca76b93dcc4df161c1bd2a1614d6

SHA512
fdc251ada8d4de8428292748799030e7a4e5bd218d3fa44833908d8a59766f24a9a6b553724138dd3edb00e39e0a7f8559ffb2d0975816a09dd83401346d9d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d071dfa3c869779f36e9dfec9c3683ce

SHA1
8197e2f73e01c2128b98ea515f95e60575aa7d26

SHA256
0350bf1ed35925d9221a28a784af0d54cee9bd8e923c764d5a4c07dad7eab831

SHA512
6dfbee6a472596fbcf2149d82662c8261a822bc3cd42d150d95c07f93effd6aa67548e90aac5d632216bebb467d0d5448c8ec2a4bd4b2c95061b45c1954a0768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9295e738457a2e67cc8406f2473b8cfd

SHA1
6800b566388ba9bff74ae68c30cbb1c2f6815a6b

SHA256
59637b9a4224aa1bccc520b6b2fe37004ad045c6ea8d4ce38766055092f9b6de

SHA512
0c3a9ed903c811e119d0590999a05331b337617c591dab711b0397f6b53600176db63c0785bfa7898d0f0ff298c16ef65954eb49f8236e9c05df5da2d6bb1f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee48801fedfda10c88e1278d318bc4c3

SHA1
ba813ef1e4df01d690e9c59cccf6954c269417fe

SHA256
280ecebe3fc06564bd3b6a3b7a3452f3d5006f31930189e50c263d74a325469b

SHA512
914cc226d76d357a275747ca64a1cf096ce9757345562eb277d2e04e86398fda597bed9e807209ec95e8216996a670c260c15c70635acd1b4ebd3397b3a11c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b24ab43e53ace95608c4c4813ccc93ba

SHA1
eeb4cd107b1cde8725ae4d87222755c40fc541cb

SHA256
0b676e7883fdd9a235a469b8d71d75ea36fd131d73d58502bcf1111d43b8619b

SHA512
e4b8ec4627431ee869389a54ac0d8b61b232cc53a27be54205537daa2af37049112b2ba92ed027424e5c5376c054c6796cb23d03343851e49741867cb006ad85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5db7f0e2d91078fe7757d2a77caa1b47

SHA1
99fed805a6debb5377a02ed730c537b40a3762c0

SHA256
791c80e8cfaedaab9059e4fdb7816ee7b36527e88410cd73cb1809d415b85fa4

SHA512
f4d539138106088b4f289f74f071d1c957560d2bcc32a8989aeb5b6b0a672a3c973b3020278b54f750b2fe9d2dcc03997ff5d1dc10a773613f6fabd0e5f8af7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668b7e6b4e6f71095656608c9b076863

SHA1
e08161fd78315ceff4646ded74cac263da53fba4

SHA256
01dacffe320022103ca7fbf981a3aa52ef48fe2849f28ffefe0d60c4be04892a

SHA512
33af9aead31fa1802d600a9284bf3a6317405f0371ca59944712388b5fc10caa3a1947e1581a265933002e99a1a119608e2844e6848bad38db0fb8823f5e1753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a361d3ca322b04582c96335e1522c5e5

SHA1
b417f0d92ce6a74640b995beb4ed52b4e8a854fd

SHA256
fb0a0ad8726d782da9097000b909e480e3b73373fdeaddfb4744e3e2f76a9f8a

SHA512
5438797e54fc3e027ed5048aab16f5ed31b4cc7b43e41cce0e575988df17e6b4f96bfb6402b10496dd8c5371c633776e10f3b2fb3248e37c012f70f1c8acad16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
245cd26aa0659f65735b6392a752e3e0

SHA1
6bad434ac3c40009ba9de2e424e7d0c6ecea3286

SHA256
710b91d54a8b3d029d0e47cb548dd715610ae53d883e817dff55d695206f5a89

SHA512
54d54ec6f2c97a10fc0f04dce017a466ac6d2e30b462179757a7995db888326370bce6ec81a8138229e97d94545a882e6b1367a61902ddc18d3a7c0d41140257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e67d6a91a5acffdbc92f7eaced697b37

SHA1
8eb98d1495e3de0d8890eefb057de5f76aab49b6

SHA256
ee0de82e3b4f6f05dd5b96d266393b1ca3dbc66cd538ec38c125b1a59c5a23d8

SHA512
68c2b3361727f54945fdff0e323d3a4c9f04a2c66c51f0df563b6935f3b651797e305e0b0ffaa513d4719bebe1e644ee53aa52f358e3f293dfa9d4eacdb6451c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E9C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E9D.tmp

Filesize
85KB

MD5
b4336c27a81019626050e233f1835df4

SHA1
cf7ecdc18c67841389711f678febca40f48d64a0

SHA256
74c2bc3b14e0d0c9d712c1a90630523eaddceb4c401848b8a2b0ef725c232998

SHA512
9f7c6952de25e40df3f9cda4fd7fcbd333e5a8066dc0c1b106b15c7ff5731a9129619ecd32fb44be4b620ce9eea4c7a8294c3402b7dbc405e190d1d57c01c79b

Download Submit