f2116222d1663d151a970eba4ec04b792ed2c2dc81430fec956ae54e4ecadaff

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

160ce8ff41cd7dcd441db3493e0511f4.html
Size

3.5MB
MD5

160ce8ff41cd7dcd441db3493e0511f4
SHA1

7e01a5315ec45bb4a1ceefe32a43565eb0ff30e1
SHA256

f2116222d1663d151a970eba4ec04b792ed2c2dc81430fec956ae54e4ecadaff
SHA512

a2f9ca47339eed1bb8ce43b4011f64827889a2db97c6e3ca346bc36f17f13747ccb08c24e8fd3aef1b0baf917832c8a5e82a5dcd51098ae9a81d9f4a90be30f3
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NNy:jvpjte4tT6Dy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7018171bec3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410190648"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000629448e5a12d9ccbd76c4ce0a5a322aacb052a8786418b35d02e165989acb7d8000000000e800000000200002000000017a4df88287a4afb4613b6dac2338d6ae56cf160a8a8d64e911a875b0f8298802000000084bea327d00975c35d10db2f06a8ed0d1946e33f74c873b9c953fa4e2a4e8126400000000e0e5069aeefc542840fcce93c9c24feddca04334ab713edaa824514c3f107cb872a77ce6e9b1f8fb51600118735f8798ed2d29ed02dbb5b154328ee25e24f5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000376b06bfdaf3bfda6328e34307871facce3ad2263d5bfb340d865d655f2117b4000000000e8000000002000020000000129d463a25f7bc373c36fdb66f8d21055fe854939d11021ad3bfd5b3962def4f90000000de842a0e9414cc2da384a49dd282bdbdf7e9cb813d2a2abca8ebab0ffe750c2499741d1f9f644399c679acc9925fff3f36826d60d900eefb344b7c020dc25d9787398e7b431b410355e11363faafdd7e77e7a81427a73533766e6074ac35c335ca29c9dce4793af0bb84eea4af110d66508814f16acd7cb006ed9a30d40a36d8dc5b13953f83635a95db875b5e13b40e40000000f981bedb811d23023348ce6364529f5f0827973bb952ef3e45876f65fcf68396eb48733bbb6dff7b2c47996cd5532a7c429b3375ab31f8c07c7441105fec378c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FACD121-A7DF-11EE-9A90-DECE4B73D784} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28
PID 2512 wrote to memory of 2256	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\160ce8ff41cd7dcd441db3493e0511f4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dc6cdcd57e62e04dd1c2bb86fdcc607

SHA1
432bf50214ee721f4f31abd364fefc769be20e5b

SHA256
3c5b90b8ecb0cb3a48754e3aebeed157a0c17e83ce8df4635d1c2ccc8899af6e

SHA512
d2eafff6dcd8ab207be03be3b257f9f3591566f7b9352e44784d6c28f32c1814cf522bc092c63771fb4ff160bc6a5e5337b024089875eeb92b000973fd9b7a55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4bc863697a10a503de37e1d801abb23

SHA1
92d9852cbc1781781dccdf529f718a1b142dcc9f

SHA256
3bd8cf350f4ddd60e1ee91f8ee4018cb504759b5fb72dc00156d013652e45aab

SHA512
f165ad485696502ae71ada6c5357daffb4b22836785deb0159fdae0dfd89e0aa4a9dca00aa6a8e9c6fd106194712789e6b1a95e113efaeabc6fb9e4149d01037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
694cd4691252591587c35c8c1107ff53

SHA1
13f7b3ee27bd848a648e3b816ac435d18b2e434d

SHA256
46b3d2d0347eda20fbf02022ac5fcbf0fed68162e83994a084f8b4514f228a9f

SHA512
0480e7c336adba9b937f1cd0c420f704ffa3cf6a4f0e59911a3666603af906a4d2b922783a326047ddad4f3bdf16728f5723387cf8049cd275488b49ae1d941c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
041aec829a3579e8d91bfd5db12d9a3c

SHA1
58a8d78b49ec36f855f87b641c88df13d9727695

SHA256
1dccd2b7e7402e2144daaab2d967c230356904ecdb58d26765f16776dea1232f

SHA512
312e5f303eba19ea453785fea577c1814dc78999dbe3f2f5520b88924692745043556aa62aa586d0a3c55f28c16d8adc6474f1ce1aed6889ba2cfb4320c4d772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d1cab98529e206ea5e05d29c594bcbc

SHA1
ab7c9bd94900db3a2ba44dc2c164a25e8c80105e

SHA256
2ab149a8a67b8c12370681baec0f0f1332c3491824169a8320803f272214bc86

SHA512
bc05bc530b459cfec986d4380f629d14d2a4b3f5e0fbdc0d961a0964951f1eaf29d811a0860e502a71b6607fafc37e16d2171bd20b61515019e12cb747f54917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed8a7df313ae83eda151fccfd73c27d

SHA1
f5e0a174bb4e977ef748a9da5ef47dafc39b5696

SHA256
5619c432214ff1b63f0cc540499d853e28d3584a11d3294d541242aea53c1c36

SHA512
f4b765fd14ff202d6d0edd095c1ac87c9997fe643bfc2c456a7460006c941e9da8fa3e34d34834d7abd8042793f509f7311fed38d0fc5eb8193d1ae6bd29c4ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c96bdff3d721d645c684f53feab6878

SHA1
bacb1b26025ce8620751d85c45320d6533f5e423

SHA256
1c8eb6baf4de3d6c45a72c65a87b6d8335b230f289689fb2f91a5807f3471e89

SHA512
cf8f2560b6bd439a65a4875d4b2f099e8d3d7a7e369dc40d4fc3540a2d0ef9307a4e6053b4a1e23175f6b312abd063e66153df11e5bc0284b488fe71b744b489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13969e10ce509e7e4920118f8c171d0d

SHA1
b3c12eda4d46a8add485d92a52d0d154d4a3834d

SHA256
4437258bff2bec2e544867cfc62fa9426e60560550062882d265aedcbcce123a

SHA512
f3ceedd08cce2405e3a3d6686b4873d79d98e001dd7124e0afd8610bc89be179e7f567e88c73186bcc9b102d3f473f1d8646d196883d302a31937879c7b59f61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4702e7103816f4805ac47dc54d326bcd

SHA1
7e4335df29d4d21fd2d9e7901beb7e0cf9586baa

SHA256
fd1d31f0053159d52242978811d5062a9889dc94d19b53df9677c66d5ff70e10

SHA512
af9af4b03f9ae912de86c7aa9222f7d09c6c71f2151d8f19b261fd5abfa2fb2288ce47b65adfbb1cbcaaf8e8f1ac6ce5d6d9da76c3dfa7e6df73e8175182acee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b745905a49fb6569a9a51229a1f5ab99

SHA1
e9e5c7baa1126aca3d730521e4bdfaf73d9b522e

SHA256
056c75dbb033fe055b3007b944e14a426acf660b19c1bc81703ef2067e6f5c4a

SHA512
cba138e001e42c97d1d1780fec5920af4b4865f5a41701ba72518ef74205e5e1470d9f76bdee39a5fe4b0a01727acc64eb0e0b13289f1ed21c2b601b8ac8aacf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e42793d498311e0586febca0545c140b

SHA1
e3abd848f2547c771ca983bc387bfc9fd7623e3a

SHA256
06aaa0702acb2a9584ea055065458fafb4d9914a219c42693537c4279768a35c

SHA512
fc671ac206f66dbbbafa15497d99c61d4b7b11330d12ca1630c79456f4dd6d60b99cbfaf5948f6d20465ca8cc86036a52d34b555c48c77e8b32c570ee36520e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a001ff73c24f2f6c764a06b711e4ada3

SHA1
805384adaee6741af4ba68a3c794bcec2c5020f2

SHA256
4bf6edbb46ca2ec473250d4ee10433723340f7519e6f69e2d5cac1db93827d41

SHA512
8d494406f17dfd9c419bef9de17be3a03189c1c25d1fd0dcdf6e62d1c57a9f299281e1441690e059c7d064b620f4c3b80310176a00eb8942b4c0651083b0952b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
807b3b3d6fd324c8f7129c77f73d4379

SHA1
3bd7b83d33dbc2113bb7b2552ae97cec74c800ee

SHA256
6d42df79f05456c66450c0dd00f6bcd5447a4b17b4758048f0be172eee5548c0

SHA512
86f1ea24951f8bc9cd476a0dd82b414d152d706de21fa10eb0a5b21a8a8f084912a39f34cb9747ddc3bbb7a027cdfe79bab606488a41fe289c853f36fa64305d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22EE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2310.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit