9083c87886a66fb3318bf4394de7c408b9592973f5f4e4efb8d1bbd9bcbbede3

Analysis

max time kernel
118s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17802727b496addeae48bd4b0ab05af6.html
Size

2.1MB
MD5

17802727b496addeae48bd4b0ab05af6
SHA1

656f5d8e0a1760d7c02d7361f11a39532eeaec17
SHA256

9083c87886a66fb3318bf4394de7c408b9592973f5f4e4efb8d1bbd9bcbbede3
SHA512

46e874d0bba86e06f0727c9f1b054f2d912c54344347dd7527a32085d861f8b73ee8285350334edb699e4f142b10b9716677cdebe0ba5d6ba6e476a3bd80a1dc
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NCX:jvQjte4tT6EX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD0AF761-A80E-11EE-B578-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903f05c51b3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007c855cc5ed29e4cc45c8562bffba8c769fa0b6cd7b1b772350631947f90ca8e6000000000e8000000002000020000000c9fd086bf5f521200402af069b51f5ce9da5a487db11ab0af050f3e8ecc91e0e20000000bc9bf6a54965b67dd7c2712dc45288152813abcaaefdd557558f1c05e3f255784000000029b95bd8622d56f1b03ac374bbcef035fb15c0be65809127ceb8c893617828e72a3e1dd241be2d6b332d4b50ff3ed422917a9b565813db570aa6382d30bfd343	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000053801759e6e2a8bd666699c3940b8db29cb53a302d3ef03a614313d258130998000000000e8000000002000020000000aa2b4c14bb914b878e9a06ab74a6a2f1f7b4c32a9d52f42aca13b2241531813790000000e771654fddd4d86431532287b249536381d28b1a824c0dfb74fc5c3f3898106fa1d5c6f8c5750dce93b31f291370085d24b783b202c40d429051298c9fea7c183fab2f06b00a462452e8a2824a01a176c9c2d45e0b0bd6a68d77fccec1fe4f8185fa260d88d021bc994acb6362a9bafb1383fc7070b8c8b4e34475262c459230cb9621c83a9177482ef13b0a9d6f67aa40000000bb5c07fd63050dc9c55ee5238a65110d263f8f1506222237b5006d7067f460f3346ad6d8cf7193b1153b2f9c32f9b8bda6e341306961e6ad052ac723b2078432	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410211110"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2684	2344	iexplore.exe	28
PID 2344 wrote to memory of 2684	2344	iexplore.exe	28
PID 2344 wrote to memory of 2684	2344	iexplore.exe	28
PID 2344 wrote to memory of 2684	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17802727b496addeae48bd4b0ab05af6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d7241f80c7f0e13acc0f9a5490f93c2

SHA1
881e4dc74614730796e9f60504b6601be3acdd53

SHA256
ca4d8bd06f8f0a3bb15ea1cd90dadaa22b016fa8eaca637adcf60a3dea7e7ff7

SHA512
8f9645520967df3f2b5244c46d6c6d5ccb0eb3a7521b542bba1a432568f9ed3bc585c52954de197fbfea55036ea8d7e18fce0d20c3fd753635abb985596bc6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b788fe639917f8686cb7b2db5f286715

SHA1
844f54f253e663da09f4c5da81dcd0e76e7f601f

SHA256
ad2ccf780e9af7f37dc01fb7190a4163b10b69254273a736598d3efe75832ff4

SHA512
ac59ff2f0c08e1fa161c7ff3f0c20d82a963a84ee12938a8ef698e122bba1c6b55b5c21ba21f0ebf5e5e5c498aeb792b73c3dbb110b7528419b91a33fdfece43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a63a59b517b51c2d623a59c3d5b4e4d2

SHA1
97237557f58b13d77154bd7582b90ed82f01674e

SHA256
a899901bd3547802d1dcb7bcd9a9cabfee4587f8f559bdfbf9789ff795507823

SHA512
266c3c4c9d95c44f9ab53abad615bd2a82542218ca30e472df432048e8e02b09e441ed329f28a3deea3f008b08a5d960fee8f3517874a296c26508f3789f19b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4d1f29cab9f6f6d02fa5e77fab47651

SHA1
61ccdbf8046ef9627355657e6acc6edf3d943cd2

SHA256
114b469f12f9094b406e63c480d585a041e60895300264d71a34f189783e36f1

SHA512
eedefaa04673b839a65810886cdf528a8fb9cc06c6cf2d55b3f4df9cfcd806d3d3c9cbe8476b6244f3359363c25ff8f61b3dce937755d73ce9bd113880a54a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cda2345fce34a172d61f365f33c24f8

SHA1
cf73719e2cb0f9d2d34b36b3724338480b7579f0

SHA256
10b269f3bfb8ee396dc2c6c5fefe5023b772f3aa1d49265c6a7238117b6cff33

SHA512
e4701f766ea5bb0e45e29769ee3b963cdd3b572abdb14898cd70100a9d5d2d774e5b23ee916f6b921f21779c74c6f91752f65f32c31808c67a850672f46bfcc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26a1c9c22452dd1e9883852d99cb4f12

SHA1
6244f286be95ebe21726bb88ed9da840a5bbb766

SHA256
8fb2f8832238693674fa3ecbae5ecbd872ea05fff29674bb85786d962905bcb8

SHA512
3ad53085c0ea598283111921772c24f019f12052529ff647cecc838901401344ed2aa76f87fa0443a1fac83cd4d569fb2fca0b8ea63f2f10e71cf7a792e76e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65f039fd7a196cc39d57f0db81916019

SHA1
a0291fe902a3762df1d6592cd7328c03bc47ef6e

SHA256
215ac40f5fad6cc0af66003db48841a0e2446d1e4e293f7a491153dace38302e

SHA512
0a671edff734fbaa92f58e0a2f4818c1bcd20cd63bd37b2250866f2da5500d9e6b0a5e61d04003a8818c6afe7360709ba6dbf521176833259236a271e97e71d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa26cbb26ab0a4b6c95188305c36ce86

SHA1
66aae5cfabae9d17af7a93ccc51c9ad3a7ced3d7

SHA256
87f410bd122e6e9c0c727a807d1b6e7084905d56ef2fdf4fdc14bdbcea0898a2

SHA512
3d9d4ef5ad65356e996ebed5a0326eaaa7a406ba446dc84a771c061333f05e187a97b5b03980deaee6308a12b74b880cff68a1c484a838aa368caa31784d7650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfd6dbb51c6135f31aa2cfb02b05b288

SHA1
665352493d39c019b3574fe7e30f499bb0c97c1e

SHA256
5dcd4ab29bffa40907fed01b429ba25fb0bf9adeb7f8b54742ded800bd98e76a

SHA512
d99573b50fab9c50dd573b73397db74d30654e992bc4ed208de0e2e76ff51477aadbc06bf7368ade0e5c027726c49a450cd3e8246dff6a962e2538b655fac91b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
075ae728f891e887a8353327eab05435

SHA1
3cf2a25f48cb7a7f2232896cf7b2907268455a9d

SHA256
a54821a65fcf3e1a66ebbce24713169727bb5062f3e650930a5d12c6254ff590

SHA512
3aa4c742cc770451f4bd1c399a88da9bc0dce0087906dcd45b88bbab52b2fc5be1784b9fcfe8aa0cfe4bc2df5f057e8af69ced4323e70a0996507860fb49ee4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a81eb3d6c41061b78630e1afc5383993

SHA1
e209e9fe709d0a6f768daa55bea403dd9290e7d7

SHA256
8b4c623913c71724c45caaf6f6bc74f8f8c6a2e68d9f96fe0c76f7433bcb54d6

SHA512
af1367d36f2b92f5525bf4a7905a90100aa04f0c12a0605b2513be280d7ffdbbcedb393cae36ae04c7a42f9b9a2caff7d7515fb45d63f62b5faf6ce1c620e554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f334e559da5a9ae6b580c420d6a20284

SHA1
f768d2c1d974a76d4bf40ad84a95bb183c63d70b

SHA256
ecccee5cf3f7633a345a4543327d3cf25467adbac11e80e1e1afb880519cc9ca

SHA512
9027006a5f3186d924294a1291934ecc40504391204721c7029b6a9234dfdceaf206341bc03aabd4695f70e41d7b4d5562e5dea427fbaeb696df350530ddb9b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f571535a56c7129d9a0f083a95bdb80d

SHA1
374a69f563658af35d7cbd19dc929e74954ac29e

SHA256
4aec7edf91151c29d0bae530a4d38b547d6a41b95c91ce817043477b2850eb02

SHA512
08e3d9cdb6406f5f7cc75f2a6a5118b60558b0940b7b4a4d5ed9cf90f1f5874bef3f1088df4b7ad197ffdf635811707938831b9eef9ef56d8bf626ed2a2a01d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf7ab10df7b27417f1e372e6d9d6eae

SHA1
5ebee3541b0a6216fd1946eead88ccfcbff76a8f

SHA256
416b4f152aa4793c24fcfaf9edc114dfa1e51f60f63289c8f5342accba0e7c83

SHA512
800b2b8c39d0e647711cbc01a6367574dcb884fd2b06cf5bfb2edc4bd65cf3d579090486e4e21c0001e52aacf904c2665d92604c2c5365fa07775235c12028fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit