ccdd9f00b2c499344d43078f84ae23bbf67839d6755af0010777f33804967cb6

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d147b997ada87616c27a42d08721b0e.html
Size

3.5MB
MD5

1d147b997ada87616c27a42d08721b0e
SHA1

479d24957d998b6e8e0ca696a03993e0fad99f97
SHA256

ccdd9f00b2c499344d43078f84ae23bbf67839d6755af0010777f33804967cb6
SHA512

f0dc22d3a18115b70fe3f132420e65f4fdcb0c18098ed150d5a7adb4042385aaf050bb5581827e40083234e96c3acd550bef40a91dd31c305056f17d3106897c
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NfM:ovpjte4tT6NM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000005b257dffdab3a180b13662e3cc20e311611ef3393a555ef2a3ff9e430d957bea000000000e8000000002000020000000a2f10c12aca886172249f33ac6041fc191eee1457689bfd50fc54a3044c50dd190000000e493aa82ac6c299b8fdce5d0554fefa818cd72e41cc7defe4f6aceadb24d13fbe86b83a3cca3ab07cb6b7004ffa4281a18b62cc53e0e5171e18cf2e025f80bc8ec1e5fc181e4bc698bcdc6aeb42ab7c3474d132a793b2c8aefa5e4af8a3991ab73b11e5fcc0f740cf2b216efffa4412121623cbab56384f4ba58218409cbe6bb21069c38307bc369e285d0e7e77ea5c440000000defee660bd30a95d97a16caab3f03f0aadd1272e812a100e05421c4e790deb05a35c03e08203460f2b2b27bbc17250eb633b83d7cddc89aee185529f8f234e41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01e5aa27b3cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410252268"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B266BB11-A86E-11EE-B940-464D43A133DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002b656846c43f57a531dcc34e607c006f30b7a120f891775be763b7ca8c577542000000000e800000000200002000000097de907836ed270443ff3b24eac7694e510d50f7c701e77db82c8d8f60cc7dd220000000b23092c39f515059ae813801f26d71bf15617b0cff35fe6d62d245d59892e95840000000f0fc6f34f51c219b669fcee0fd02f32992cc2079ade2893ec3f9ef514c4061efa5b86ad21d0d6f948e08d7d365f1fbec32ec7cfe88868f67c44295cb7d695fcb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1956	1744	iexplore.exe	28
PID 1744 wrote to memory of 1956	1744	iexplore.exe	28
PID 1744 wrote to memory of 1956	1744	iexplore.exe	28
PID 1744 wrote to memory of 1956	1744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d147b997ada87616c27a42d08721b0e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14255dad621c9683e320384035f319de

SHA1
3d4575c7cb1177a38785e88c80d612dbc0132f12

SHA256
1cabf7023aa0dcc13437e3d5e64503aa2e7b0e34d2b2523583387b375cdb7c6b

SHA512
5fd5aec7b7ec2c9c21802d712f60b4881598a2de98ad68f6592727f1ad2887b9b59d2e5fc25b6d30bd0f39012bdb06c295e9741a0a86287edf279d617b39a882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43f4b3623af2b4dea6d69daa6f766592

SHA1
88e6891a628ba5033c077de9f1df914bfa0c6796

SHA256
7364e2e6a98b9ba9890ddf4cdcfa89faed95aba20f0bdb8b9591423ddc530ea8

SHA512
ce6b3494fd95f3e3f23f933d36a7d69ae416e7316434a1e51e0f0b77bd582b9b19fe716a9be8f1833d5d4ccd3417605f772a3318338bb4723db05f35e27d12a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39b6e64708d5f6982f29939dabf80911

SHA1
d1bd86bb95e71913d8171baa94c49343e038caa9

SHA256
2e19dfec219dbf724fa46ed1c22f54ed547041657525a47179c7ce69ee3a6912

SHA512
2434cc56fa663fd8c4b6b46d391f48b062e2a1820df0a5e99dc30833ce7cd7b96fc5f3c8c4da94415a94a87af898de9ab08f4a90ad4e5c87e4d160d0ab8d96c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da580d8d03ed53cab07e31e8473baac3

SHA1
16ac9b35faa0d7a1f7af3ef8ef7e398e4573cc6e

SHA256
8e7ef06ac50db9b74f27683a776e579f2a2231fd8dee64a7bd95176aaae5a820

SHA512
0cb0ff99db66658f8481dfd858fa915e5cd393a8adfd6c4c71f5beed02b540e926cbdb7adda39e4c722281edaa5cb0bdb00a2cec24bc9679372da4593d303ce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dba42fd8a39d470dbf5ef965b2d53d4

SHA1
e7c58bd5bccc563c1de545502d6742bb8f0bf088

SHA256
5cae892081662802eca01631229452d64cdfcce15e94a6bd3652850ebc549b78

SHA512
d27c36b763bd0409175811a038ee822a002a7516420c388816bfc3bd184de2c23a058ada2b282543a9bf5ec7b915e3c87671a46a9a718dd977590390bd037a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e20ac85aeb2e78a15d1996379e35769f

SHA1
c109cac2abb4cb46eb8a2ff96c475abc5b79a077

SHA256
6adbd3aa6353d543e8b38536a4465237b28c31d1eb41043991907076f8b52127

SHA512
4271c00af706acc936c2cb4b5e8ae407a5972e0a15d76b07b6160e31c022957af072d17a79d92853f6acc124198fd871823848258f7541ad01e2e43923c87848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b351eb33de5b36817996cb8cc6c7b46e

SHA1
4d88b4f3053b241e88b200585b8c538210283533

SHA256
61f47cf0afc3af0cf0c500192b69e55cfd8ac40695739c924b9bbdb3db142d00

SHA512
4ee635653bfc8ca0cc0eca4302ddb11fc1a162556dd8d0d2d6cb90b89348c28bb3f639912b1d3514576dcd2da4f2ea1ab2cd64e51f05997889ed30a0daf1fdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6080c49fffd12ae7f16690f8495ec4c9

SHA1
35896748050d0c0a8b72591be9b3cc8fcb19a9e5

SHA256
7e4145e08960e4b5d216dfae79ff935930ea7904bd0d4d370eef04704cf15ea1

SHA512
e84a7877944314cf16fdfb16b57c443991230eaff245eeed6ca9eea2f5a59a73c9f5cd0d2ee77f46af1bcd1ae087c9fe384fd8ff22e527c7c2375c6f52cd71c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b857b9d59e1339976b13b42149110109

SHA1
f0a11e168038614e61904b7971683720cbee77db

SHA256
3e3abc2e54cc7bb4e951ce8b7d10ae3811f9abe0971342db9ba7b3b922f1e410

SHA512
7c90426994dc165dc76c6e293bfb2ce35fa304580baa854764c942c7e5bd16ff2d30a08fc182c0718e4cc14301e1c8a363660dfdfcdb83d66dfb9c9c3bf15366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5fadedf19daaab419114bd59c2e56f3

SHA1
fd2cf266ec2482c83fd1486576fad4f26bf5c521

SHA256
6aa446b0aad4e2b33a8ac009a39b79480ca7508fdad33a9237b9f0368d596134

SHA512
d2424c52830dad22ed13cb96adc9f0e766e5443db305ad79bc15c3827a9d24a6f81e294e77c55b55bb7da82d07456d127d21ac85b9e288dea5256e2ff2ba5407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67b2a23040ca5174965f5dc6cc6c6003

SHA1
f5727d1908cad1e09092eddb19f7df30ad1b6d42

SHA256
fcb6158d3a8b0f8057a6b10d22ec688d3b4c25a0798d33592bed9f9f07afbcca

SHA512
673f2b1df9eac5ce8dee5e481127b04d445cf5ec2e8a9dd7a88bd94cfa50fd921dd1ade21aaeda5972e9a302b3e40ee0847a7dad83f7274f1403290a43308da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e764c5050ce2e0e97eef2571f7adae28

SHA1
20fd5e7f5e2a31164824d0a075bc800db1957bba

SHA256
ed33a3adca48318e159ed4474a06c49fbafbee2529a05e5e6f88b2b160aa8651

SHA512
e7fcdf3fdb5792dee14f7833247684aaa854f9be566dade229d00e78c7059edaa0619c7686eef0705a32943be4a4c92bedd866f9ab1e986304b00266e7ab6155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3efdd1b8e4b41afc7557ceec04b39919

SHA1
6c4008fa0e52435aca431bcac4c8631e77f6369b

SHA256
bfcf8e83aa850dd6dcdccde07e87b28bd02c22258a66f54614519d7f30865b2b

SHA512
8e822d24637d9499975c5daa927cc4adc15e6792345130ddc0c0dcc5606ae1c67b5dc35ac6b729915558c031e67c6d970a00707dcdc34576679ed5ba3e4ea0ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\jquery.min[1].js

Filesize
74KB

MD5
d021926e7aaa17dc01a8f1543b31ed1b

SHA1
334d70fa56d55a0781b912b033f9878340f2592a

SHA256
e57ee6256b33dcb861d91554dca4b9460d7891ca661a7956637fdea0cd79fe8f

SHA512
2f9c1d13761fb549c69fb8abcf3b0252969e04f0dcc553e095b081ededc37433cd807ab12179401ad70e7d590d973bd2fedef86efee006a720cf87a0b7177e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CC2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D71.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit