d1c2efa4cf5905039085de0fd8cbecf743edc754a0dd79bcea3341437cf0e8ec

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c298801bb2083439e72c31710a92715.html
Size

3.5MB
MD5

0c298801bb2083439e72c31710a92715
SHA1

7c9f2dcbb1a3f8962963bb390a39c8c695d8f901
SHA256

d1c2efa4cf5905039085de0fd8cbecf743edc754a0dd79bcea3341437cf0e8ec
SHA512

ce961785309b42f4f8dce87a84c478f2962751159cfc239623921e45ba04af099b7378a7ac9a70d3364caa9b4c5ef1c649d8e6d8943f8b253524d57a0e3b2acb
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NIb:jvpjte4tT6eb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000024523796228c611dfc63be5ddfa8f23314864c266a7b2f975daeb304bbe88878000000000e800000000200002000000080d53ea10ff7deae8f85c9745b81046069ce6d737a8e7dd07b6761f1bca6ea97900000000252011bdc598b3e7aea9d49b962401dde2be30de2b330484f1e5b939ec181e414fb73ade7212d2b70922d892179bd0f0884a51e9adb55780363423cceda64e77d0237637aea1e9f27e4526f519d44889560440e4fee7780d03e46d62dfcba31963c0aafcb57ca566e57d5fcb73ad3ce39c571dc8a85db56b34f034cfc2b6b546e07f68cc4452ee0d4c63452d0f7e74f40000000f072c1ead8b0593c5461eb2e46ba70867088c03ba221de14393bc607b6ae72879548753c50091d01c150f24783dfb7623a4375633eb11de5c8fa96e541abf67a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c4f21baa81cb67cdba9d795c3ff7947771f3f6a43c782d83001babee547516ad000000000e80000000020000200000003dc2767ab0d99ec4ad9db7818440946c45f5a1d7ae6c5dc38cf3c9c26b8b4c7f20000000e65ab2028f1bd0c2a4d039c8768568d962765e00d4b1ee136dae8e458778c1bc400000007d4074030c23f09610f921adde1b5643da497f840f04dc0e12450eed10d6e3c6dfa001222a9acd96a6e9bf1284a5161aeba14a1c54f81e5fb16188fdc786e95d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c53a97e23bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410186530"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAC8A1A1-A7D5-11EE-B201-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2360	2500	iexplore.exe	28
PID 2500 wrote to memory of 2360	2500	iexplore.exe	28
PID 2500 wrote to memory of 2360	2500	iexplore.exe	28
PID 2500 wrote to memory of 2360	2500	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c298801bb2083439e72c31710a92715.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8ac09040c5bb65ed398bbf721361a9f

SHA1
c2e12e9fd22969d2d0cc31307c1ab9121036274a

SHA256
6d4cc8a5a1769e073e7ad875688fd097e7466841d9daafdfd83653bb90a43a52

SHA512
2bb2e9cb78fbe072f6566df76c926670a36005ca87133787f7aee682348daf3aa2123da663f4f6d074ba752cadb07f755a970ba4f4288e1e5645075564c08c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2046bddad1b620bfd9b65e910b036363

SHA1
f1252a81aeb45bd2131fa9bac974bdcca5fee614

SHA256
76293cfc2e56445d33a4ec3477fa2325c508ff0c3902255e12f84f30d6bc870b

SHA512
aa88ab128c357ea4119d5f57f9c27d0047094dfca779ba88c3f72295bd5ec42efae75c6cadace045d297aa04674fce66ed6b3af33007bf73b8cf1c8d654bbe93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
573d594b6da190ebee888848dbce41ad

SHA1
a5d2b41c450ecba8c4192ee236652171fe90f02e

SHA256
5d4cd86ccb98e1fb3b6feafc81cb35ab567ec284fc5c73d53ebebf7298258a9b

SHA512
92399b19b5f0205fb5c222be9f211c58eb7ba6081f5bf77e8c9cef48c83be80b4336902bfd6c520ecd55038fccbf079b96efdde1a22e8db091374bb13e30a42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f42c55f681afa3853a50df5d6d717bbd

SHA1
8f9690ce79e91a5269aada14d91d9aa1ce2dc8f4

SHA256
cf138482095c9de63cb3ccb01005ef1f2620d8f5cb1b3f30a9d152ef920daa21

SHA512
2769ff6f803da795cb3ba21574e7027a0936c7afa8265efb1568efa812bdfce268deb819bb6cd0737e2c370a631ca6e8bfe7d99817924609b357420e49564424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb5adab82c924218322c0e15b3f7f64

SHA1
28f045c91a1343b1670a048c68afb5853f07080d

SHA256
5905036e1619db4b745efc8e8d1bf34104b984717827451ba872090180d04bec

SHA512
2a62bf06b6c751bfdc42bbc60383d6ae04c224da64b7a439ecd6fcea3ad96ef21c7bd4d1b19d4b26923db5bd11bbbab498561eece0838a21fd6444d49785e986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10028b106bd78f748d001902028869b5

SHA1
e414677bc87675a7e5de9752b89050b0d7698863

SHA256
7928c8b584877031a3ecaf303e2ad6d95cfbd2cec5fbb7d0f4a0c61bec15e4c3

SHA512
af98e837539dcd9d6a847fc4433ad03fd30b36106cf2831b87a455e93782ed285c8dcf899065f88f76400ffc5f761eb3a02c9773cd05be3f5b79455b1ee7f5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b91ad75bb151ba7e1ba6683d087cd0c4

SHA1
c37ff2a65aee8f28b3ccf34abe509dc33ac6bcb8

SHA256
74b18c4f2b5ff32dc3baeb6b2aac04fe116eac060373938f27293c9a5fcee7e2

SHA512
12a79f99906c1c6eaff6a2964909a6acac10bf0f8f6c875410b62f7939f7a4d5ec0b677531621828f5682efacc0aa7ae1a5f05b9ee7f75937ec8c8be277dc9b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9089a2b495e52d8071bf6d7b18cb4a

SHA1
eb901797d163efc1656342a660e67af30632d074

SHA256
3432607bdf6f084a322d3647e28d279e3583b6b3c66f104ba25cd7f69f1789e5

SHA512
b57c116947084efb8da53a4ebb9895245c09211dcdf5532425def3bb2a3ed235cc41d9e4aae4ca7574950fbd04c4df8635e6c9e2d94f4185aaf0e1ed09b16c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd9594bf0ce220f988e4a0ec43136b7c

SHA1
b3cd1c6057584fb5ac8cfdce78cd5ee4502cae89

SHA256
493b03b929daa5fb21c047515e6a9842265c0719e15fc98f15f17781ffb2dc12

SHA512
d1d9a2a6f0de2f269c270cef0fc56de864ae614f2cfea97914b0c4f226277f0d7c1732384e537331a7200ae656d3979385f2d0c086375388ec0619fd99ad8c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
106edcf43b41ab0fa64c09de95f2879f

SHA1
c3e1c947c92dc10efaa858acfaaf140ccb633566

SHA256
611c3267d0b58dd6a1a25c467f487ee70764568dc354d5eab54017152a6af496

SHA512
c57d69652eeeb3d0f943575ff9ac799761c39e5a42757c118dd2171b7dbb4e4dc500bc9955f4f70df19863dc61e68f725573877b6da185c63669761f50d69563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4f28ae9eb82711a6f93af21262d0187

SHA1
5a46524b9da4c4da93da0b0e8084dedae7130ca5

SHA256
7311c3884a779130011a0760dfec6958d1538099a8158b2f5773d2b3fa4d4a0d

SHA512
654cf510b20f14afd26a5afa52b79f200679ce1aab5ee5d840e1b3e955b53f95b1b34b1958a9c9ec228f6a55a108f0df7ee852e2bc3111f9f91283414ccc1fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb1bbf8deff728fde1a3c65160b7335d

SHA1
8de29e826b4d1f22aae1bb22127eea69c8bf0a76

SHA256
7d5e9afe96855e5eeffe9d584af1b33074c514f37565f706abd8d9b73f49d7b2

SHA512
edb18c13fd7394d7d6b75dfa6261c3bcabcd58c896aef21913139f21dd6335efb53bb86f0bce1908f480670b45ccafb2ebb2e51d34352283b07544b3bdaa6b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
095d2c13214a49f21a2abad232197f91

SHA1
9775e90b4188256303e51e752c142683ca1ba408

SHA256
7323ca73d28b347d2ee69276d15275b80be9d91ae40ec5c9e12a3979e3b7e58f

SHA512
b3cc96cb7f16a0352119bb0244d913e4c21e2adbe7fbb4551762c3a082c7116770bf080feb8d365d2ffad7a959d7f067e09b310e86b264da319563121b574543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6A49.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A5C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit