fea0310fc937dc77277d004032266b6cdcd9c09d37c473d7ab7f3739f4591112

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11a3dd97a0aad79d59e06ae4e1155dcc.html
Size

3.5MB
MD5

11a3dd97a0aad79d59e06ae4e1155dcc
SHA1

d57621d7a985846e633cf4ab41a99b0254f1ad0c
SHA256

fea0310fc937dc77277d004032266b6cdcd9c09d37c473d7ab7f3739f4591112
SHA512

c70bb29f83d45cc93e6f7e6863a03d6927bf687c036029e999cc2e2f4faee635e79d094f594a1b38c0b016532f60ede3bc32071fd0fe2a21ae8de4d3bdfd2166
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NSb:jvpjte4tT64b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02c2315833cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008966696b1ee92ae6c73d8627d64794d8ca1e77a70e9f7db14e0fa615a4db0ba8000000000e80000000020000200000003fd038eba716b7b5bb4a0f43f0435eb1c0f2a223bdf0ea462dc7cb166524da0320000000a7c18fbfef82c114ec63daaea0ee8e72c93e6765b82f2ee958d6b579beb56a2740000000c3bc5c5dea0075c957ac3813e2df7f3168f2d88210c8dfb663b0dee8bf8b6f8af4d3a9ac6f887e837484071ab877725ff0f5203815069b57ed420945e9ed90b8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410255506"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{319FE5D1-A876-11EE-B279-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008c028d5b941ece5e550c59f4d15dacf1356391999f727c10fadc702d91598f3d000000000e8000000002000020000000f6afe126b6593fa8c5be77c89f9a38d07019961b42b2973609b7876f5d80524590000000e0f47789c1d50dc2ee06b9d58bfd2e883308c54b6b513a8c43dd0a709edb1bf75af3c8445715f9aec06d0b13289b9b1f8914662a4d1200a1f24295db7e4c0f516e0513e5bc0cee4f1589baf6e6df34ebdcdbd9320f98ff40f9617f780f470508dc57b451f7be65bd1f679e027ec195a912b5e8f96bd82b68da01da8c2fa1df74fa4490afda335a2d81633283d75e604040000000c44f4ddf52206e01474ac59f6f65206a256cced46acad0d779c6455e7361544109049faf21f1c8012db6b39469f358f85bbe184eaddbc7eeea0237a8152152b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1820	1732	iexplore.exe	28
PID 1732 wrote to memory of 1820	1732	iexplore.exe	28
PID 1732 wrote to memory of 1820	1732	iexplore.exe	28
PID 1732 wrote to memory of 1820	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11a3dd97a0aad79d59e06ae4e1155dcc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
859b9fca9ac10cfda760f422fc9bd23d

SHA1
4650cded8a0142d1d8ac4a1ac82d9aafa6df496a

SHA256
5319d8bca0ba64014ba99b933875e0053e44647be7dd1c019360c79a9e3f5246

SHA512
7d4641b70743b05b868d006fe8167f405cb975a6bd453fbb7d699119a76dd3f50c37fc36ef0301237f2d96134290a1deaef80614bef9d173f7db516ecb0b63a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddc2f56e8d8f6dd3774f626e797de51a

SHA1
8458df05bec573cc2c9a1d370d36461fd8bdf7ae

SHA256
6f4ebb6d8b0695024c7f8f181b8b96390a32935fee07a278cc4d386685e64472

SHA512
3b79e8eb513d6c80626899a3d3f46d814ba369d042d9ab3c215fb3d4689f4c747e9eda06de5609c1447069c4305f6e5b20a415a91281acbe757d54b38fbf70b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11ca596cce1f2c3191ee99655a88b5d2

SHA1
1269aa785cee8172916793d0adde2564e4125af9

SHA256
bab566621c45a879f3f2bdec5e22bec94efb0701f3f672011f87587b80c0dadb

SHA512
a84d87e1de8b6ea4185c81caf233245e1cba95f4dc4a1b53013b175b6edf1f8237b470a18bb8716f1a8413fc4bbf342d60eebc00d4af0071770215880a2beb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36777f861350e5752a400de356a790e3

SHA1
00278223dd576ff0d42b87dd7e4bb90d26ed15e5

SHA256
4063099d32ed5e8cee90975d3c15c67350471232ecbfbaa75c729806beb52923

SHA512
650d8891fd1c8b3c68a1cd20582bdc60263f1795338bbea6ebb6c8adc7f961d7e055685a5a316472b59b97d7cb04612d1ef8f1857a6419785c450b063af004e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b900453345d00abd3132dccac6437af

SHA1
3f1130cc4eb2c4ba473555909228ff231dbf5a38

SHA256
5430e9fc50db6cfad9c9aadf561a1bec9d35b1dd9199662e1d05be8b793ef6cf

SHA512
00dc64b20694ee86852f23bcd54cb9e51affac2cedbfb50f6aa0dbf2f37e4408ed99c4b2d4e88a0ca343002bca829193080996c58f63c47748e68eb056af1c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982b4c8478d5d77e65dc7796f2eb04c7

SHA1
7fca9182584827f23885b946bde0b42457bd0ac0

SHA256
7f8e1bb8fba8f8f9d57d0239b354aa74ae0e64e91e65cbd3d29d221b01d49fee

SHA512
8a7501e3061dbd130d7c5c2b6e466bb5fae93fdcdf87248ec291e36b33492e44b7deefc2f7c4009f7c74f54de9e7feea30adb10dc913abb14d760f9ac04de224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201ef2d1e583b640033304b9505e1f67

SHA1
068e22975d71c8c838b6d7654998c186f4f09495

SHA256
8e6d56df30bd498ebb26995cec60f73da8586af97658c2f534ac941f2ac1c345

SHA512
3a67997fad9fd667f70da5094dd11649a9bcde1bca40ba422f473855760a6d577bb71f071f759d10c8bf037874e737bce7c5460df3bf7ef9ab84d46c6e916434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
693ba624e17292a620db2c5e6f1ec362

SHA1
626b15ad74d28040fbd66aa51fd6efb4b92cc012

SHA256
bac1e06809102eb2c133b49cc6fdd9377416f762b13b56f2fc59a7de88f096f2

SHA512
ba90e2fff098bd98ddb656f0029a96a13bb86aa31b2e8394d3df07cb04f34781c638396aa879a5a4924c4988e42c59ebe6a1d6132e9a2354c748fd8430e6ff6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6398de6e14d6d93d6aa9eed16bf02db5

SHA1
e931f0d3c9baf2d71f90a1ca253cd306fbdc45a0

SHA256
5baa60646adde16bf715a02f72ccec274466a2aa5595a98e81204eaf491958c9

SHA512
970919bb9c63d6eb8fb0e213c6837e5d259b26c492020130aa707061e314581d95fcff8b43778108900778ae90966d552a2ab73fe3cbf0d67a6e4b0ded57f66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6622846ad242568b11f28b8998fa402

SHA1
a4f448705ae8f35d652274721cf5cef9f493242e

SHA256
202539fa5b2de5b50aed1ef9b2be2c95616697726c104ee078bf548465da32a7

SHA512
4f675229b0bcfcddfd87b7e9bb644342d952185591367c381e3c8c6fe3a9bec5e1470a1d721ca4ed8ebfea2deaa28f3247aef5910132fb779456a2bbafb79805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04eda1137300f4da535f620c20df7646

SHA1
46b872191d793e8805421eb751e5aaa82b9a4fe3

SHA256
ff23cbbe68d65d3d37756872fbe7cd3860e5c9b3f74294068d85d277d31e0396

SHA512
bb1d8f6580a8856fbaab71049d1e423b00962c03913067265db13658483348866b56748ce9f1f4e798ebac1d74c082029f7255b5fb0079523adbec1821de304c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5092.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar516F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit