32540a8ead1e55a82585568ecdb97b9a864d7b7e674286c964f1258b32b483e4

Analysis

max time kernel
143s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

004fe84b747eae521bfb30de4e9b20b4.html
Size

3.5MB
MD5

004fe84b747eae521bfb30de4e9b20b4
SHA1

ffc5c171d85fe4b83086738560ff0910fafbfc81
SHA256

32540a8ead1e55a82585568ecdb97b9a864d7b7e674286c964f1258b32b483e4
SHA512

4b1c75eb9d1600c5ab3604955f5e32c46ad4ecb221caa8d12e46f36e1033be9ff878b1809c5151fd6f8f5a533a395f3f84b81c77696925e31bbeeaf01a13d717
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NNC:jvpjte4tT6DC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000d0cfeee9133f8c7bf0ad0ea17c3d4a49531a9fed601e0194d3870141d5ae8b76000000000e8000000002000020000000210d3cea4f9314664b5981ac3acc93165c603d4cdc1bebb0621f731cac017559200000008f180bc7e4f057a757c9c5b29c04738617e5f8785ee41cc5f42b64d46f8ddbc6400000000ded5003fcac9bcd6328045f3bb22e4c61949d1df10863cacb3b1a95e66bfa2b0878232cf060a8f53bb3f6d4349daf5918179eff699ee85bf53f32e41d51d9fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000073d7a043706f0fa2c41df18a856e34ce7c990171ea0abfc4ae90edfd996d8b2e000000000e800000000200002000000054effeb14af4103b9fb59d7cb48d4325974ba383aeb250b200affca650271fc390000000689b11a8050789cda75bbfdd08eb21a2f87f53a16b87070caef872e26d272d748424f3d8c0a24a37db2a51ef4bb741d082db31a8eff056487fa844d5ef577bc2bb93b8225938ae1274565418dfaa94b7c9ed9253cec004440c6701c91e12361c157f8a5cd9d3d656a438e7b03c93f2df62525741f19061b92665cb2f05d2be5b4506419b65e2678ebf44fdec04f494d14000000006bf2a6dd20c085c741e8b226cfddcec50869f3998a3a9dec82b9c072ea46ea2727043873001f7b8758284f964f9614a84e537f109e9d6715902989c5a289473	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8F91A81-A7E2-11EE-88ED-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a81dafef3bda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410192182"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1428	1680	iexplore.exe	28
PID 1680 wrote to memory of 1428	1680	iexplore.exe	28
PID 1680 wrote to memory of 1428	1680	iexplore.exe	28
PID 1680 wrote to memory of 1428	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\004fe84b747eae521bfb30de4e9b20b4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c8f604564c2b3492e75e99aed64965

SHA1
c275a42522658ceac7eea0ea9049874687dbae60

SHA256
f97831f664e3d5890429a6ec671b2a5edb37562f7db7e43a6969bbbcd537edaa

SHA512
9c611aee7a5e99afb20b4f1712d3fd928fb1e59b2eb5b98c207a82f3d39168f70acfdfaf680f3ab92d68f4a6d81537080fc570084f63db8a7988cb55472964c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c279bc5c2d5587b347fcbc7caf0b8c06

SHA1
49d44137e96ece669220d892c6c76b96fb4cf55f

SHA256
94706b4162bd336e34e846fa7381d79784ad1431c8c86a2e2b2a500e993cb409

SHA512
9dc63e54487a793cb382b554b0288863fa4e1961e0eab1543650d4550f0d8569b77c90f2a3bad47edda07e467d6083086ed68f6080dc7bde8cbb0991c265976d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c63cfd0504b9c325ec5074d5dedd48f

SHA1
4c5ebef96cda8dae0c7d6b4c65c6df1e01c26bcc

SHA256
4cb25e917a47856afa984e7742a5bcd46dc1419d40645d9d6bd1b30d045e5443

SHA512
8796ab5525b388ebbaa367f39d9cbe761843f1f69f7d6840f8be43b5a0507768d6e641e23a50328cff8c5c97c4eb09db8d7592da1961ca2f264cd4b52277b41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
142a93824f8a713844957eaaef1dc313

SHA1
998ca097d3015df01f6d7d818f1bba8ae986a14f

SHA256
b9c3806148def12e24412179c5b06883fb3bc7a606c831c4dbfccc668d3aed34

SHA512
a710da155544304b6a312aa6f21c62b0a5831ef968afb6c2033fb31ccb2808ec0678043752e16de54c1c55cb339eb4cdcc78b5e80374ae2544985e8d4cca2824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
debadcc9d15b33e11145ecd5b15ea31a

SHA1
d2157ce250c019d443cb9e7a1c1ac356a7ca4147

SHA256
feb8d5afb2076f766c402ee7185204ce0cd1a2030fdeffdc986f005d7193e93c

SHA512
13a0a3d204d4df85cc8cb497c90ebf35fda20c6ac7f537ecd54b973112ff6b81e2fbad8f3d5e30c6d4739353ff253ceb04b45c21d327753bf07f1ad7a2e3ee0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f935859cf64f209ba662582036c19834

SHA1
c7eef09bb7a514ad6a34a3d2c25bc3942f0ad277

SHA256
cabf236d6041261dc526c4d31c5bb3e367eaf2650885348d959e343ba405a435

SHA512
b5a229701191173e4ac5f1fa6b487945507ff05041867d04d908d35fad262e80e3a69d872f4dfdbb66eec5608f0eea8a72ab1776388aa3cf7402f255bf626a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
743ba3f10f76adb5bf71d81bb942b046

SHA1
552eb08eece7bfc99230cfccc264f16e2210425e

SHA256
dd6dc880c6ea24585573d6aa434c3ff518d07fbb70054aae2744d8a42639b1b0

SHA512
e7655c65ce393633e28f949c041d49131fa849b257bfb654cb719d60c17786756eb8a71dfd9c433bee8133f1c7ce2e81b9c683cd8190f25a72851adc1545d283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d634e4f59d437d2f9eb8866278f6bea

SHA1
97dfa964ce687134f503d856062d954fcaa39c1b

SHA256
c0645d1b4518d75c957cf9f09a330631a9a8360daf68388d4daf2a16fb8c9f42

SHA512
a0e6a295fb704872aa7e5ee5401542936b928f61864db8cc85cc913da619492df18f0a2ddacffd61667686fc0fd9f3038235997ed1ee08ac2bc0bf776ac776af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f370d1d868be1f85128851894d6b2aad

SHA1
773412074706e8427e7d6b43239b33d6f75efd86

SHA256
b97bfd51a40c46369011bc8beac1e80aca13bddbd3b4c7a5ac84953fdd4514cd

SHA512
d7623cc2792cb131cd60dd4ff880b5c9c83bb4bdcce106b933c3652f595a7ff9ce59562ff76135cdcb6ee474f691d5f3437ee0489ae49611e90b9617a7674600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a4c3acd5a49168e47e73a22815a364

SHA1
5793c9d186412accdb06c35ed1bcc4c72afe4d76

SHA256
36ba706b83b1d16f9ecb003a3569ac66064f51b899c7cb6f38447892942032c9

SHA512
cfbbef2b7827aa07bced65c8831a8250a92730f2f197a2e9f8b14f37932bc79eb56f954dbaeca196a4268fab834a0cf84277954c79fdf19c755e705a44ab6231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abc5f351753a3326379aeafcc4cc9323

SHA1
de979be07a9d9fcf4d5f4c7c789a8587fe55dfd3

SHA256
14d206bdaff00dd974ec22603a54844b325ec50107e7ace0542998c3074d8606

SHA512
a8a2456e70d1508e9845e3b6acbf7e5f52b819b3a7fc4c10f4b7e5b4d7436e58fbb56e55e8a7f8d8f5f763a987befb535cfd07683aa65cc6fe10b8db66173021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a0dea59e8c9e74f42e53e5381e0f43

SHA1
0b81ada1cb3ac468238da8186834966128b17dd5

SHA256
cc815f3e53ca294bfe29981c9e2112dacf4435662bc05c8fab5f960c84bccd94

SHA512
2eeb7a9ad71bc21965a1b076495e2261f207c6b4aaa4afa4a70c7b8db974e40ed4ea4f563afba3774885258563eb4fb7cf1817066262985cd24475de2336bce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
634354346044b129530cb09945a45e5d

SHA1
8c6ee6166bc30e41ca1c0727d1063f9ae83ea46f

SHA256
ebb75fdcedaa8cf0ca0fdaf4f6e17ac4e19425962348b4e3ff54e3502668e4f0

SHA512
697f34e2edefe2600c7c7cb5a036a689107b1ee19ce81d659f7a49560c0659f56c8234c321d0e7c35ff7c78aa3eae85db2d6de0fcdc05f2f290aa7fc5e638b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c3eb2c75cbb4a370bf1cbc17ba31804

SHA1
e85e63f42bbfb5b7c87fb4984bf9fadfe50a7637

SHA256
a8e3484d3b3c2299e9751a0484030b3f5b98fad904a9b0f0a990fbfd9ea0d9f6

SHA512
73a1471249a14622018b1cfdb28d20d3f1894cb80a838ea79a11a8b3d23a34e6c939272e494b165603d8dc88c4e833766b621eb8096bb9fbfc652d507a299fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7521.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar75D1.tmp

Filesize
16KB

MD5
d26f01c735893afab9e3eaac568a1a87

SHA1
4927fb1d894847da7ec547da62637a523a6e6e59

SHA256
4b33a173d08c661cd6312ea5828d9ffa19140ac414c5a372b43dd27d7af3d605

SHA512
1f4d938c89a6692b669bbe2e2a1f0312fcb186d93f9bf81f32d77900234ace88eeacc18fd569959969efc653ebecac37f28cabefe843f1018cf1ab1ef049f1ac

Download Submit