aad43f7666161b7091c7cce8851bebb56b62a86446bf5cde9e453e4688414711

Analysis

max time kernel
136s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c1f018d7f373099b30bcf19c1a8f0f5.html
Size

3.5MB
MD5

1c1f018d7f373099b30bcf19c1a8f0f5
SHA1

fe697c9b94f7134546f1254471727201fbf8130e
SHA256

aad43f7666161b7091c7cce8851bebb56b62a86446bf5cde9e453e4688414711
SHA512

a7e8bc8232790e0fa85b6f5219cce0db0f53466fe4208235d5fb744b79cf787db79178c663789c24f22deb81adcf09cada7da1a039c29e49ec8acefea955ba51
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NN/:jvpjte4tT6D/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005f3a4624d4f3fd3ff2ec2b05490a636f07085f4b2c5ac60216879b9e17cfebf6000000000e80000000020000200000001a91fa50e90f493a5d40a6270ac5127e378ea0054c05d186925ccb33ae4394f320000000149d29909270914c2625d7ef9a44b188a07cdf746ccc8cdc5428e331dbb832f040000000eb6d048ef6f24334ccaee605f47e182a1984a98b4d0744cf8965fbcbaa6ef77f335f40a56f10132d55bb82bc30cb85ed5cf4532d991dd707cec49d73fee9acf8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f088aaaad53eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C93077D1-AAC8-11EE-8723-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410510853"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005ab8ce86b12605efa12810d08172d9c6c1ea52517431ef86f048ada0d2724b2d000000000e8000000002000020000000e02c8dae4507fa22ab9ddd27263dd01e3faff8893aff46d3a4549ea4cb94f79d90000000fc8afa73d18493886c29e6c3d3cedd8287b9822e65259ba1e0f32a23e9f0af1d9faaca1ec48c5b29358566fb8959c81895d1e24769141fe97f77a013ad0162695a4d680af12def835e97d6400945901d7c6eaf205381de7a25a03e3e304ba04603b7e0db46f8bf98b4a1b052e1c13aa920d28d9df6eb0b79be9a50ccdbc465fbd91ca06a6a7b654950ebed3bee9fe0444000000022978e2f45880623ac308dc245bdaa173a1c4571d43e6d5d52f999cccedc55fccbf1ebbd265fc237ba1ddd2160d8c4709675199cc702f6c495b3cd9af767fe2b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2744	1956	iexplore.exe	28
PID 1956 wrote to memory of 2744	1956	iexplore.exe	28
PID 1956 wrote to memory of 2744	1956	iexplore.exe	28
PID 1956 wrote to memory of 2744	1956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c1f018d7f373099b30bcf19c1a8f0f5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d3d6a1ce1bbb2a9882ac54d27adf3b

SHA1
4c16f14ed5e2bf39d061c0c166b1991cda8e7318

SHA256
2e6689c24932343ba2dbbbe8e8afbf66f21f2a150ee0da7f03f976eb8b899cb9

SHA512
085b3715e442c34884918d91935346844c313d610032b76485bec97d3f5beefa67f067bb47944ca3690002da99ae4d9a4e1f86bdad367b3d5def5d9bbb22e162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a124767973965597fcd0c23188341370

SHA1
e0fa0ff81378e6d8ae496d59f6e516a1299d5e42

SHA256
775099329d519da301a381ba6aa6a2b48c5327dcd8ce857ff1a2046223b1bc31

SHA512
a042c59a329b76575473d991465b4d84cecb43b5168fcc39acf8ce784d6e2423864cdf81e639f68dd011ce3c33e0b8ccf0680d85e189bd056199565140d06486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb2d504e86c92e81eedcba841cc7e6e9

SHA1
2beedfe406c6fde04e29530a0c64acbe6722073e

SHA256
492f7305519c60f198c2b02cae13a1ed53fa67895b3236bddb46782b46e11262

SHA512
3e18a30def63cfded3ded40983a660c348f17b5f01ea95b45af49a57cf1f6cca38efd2c3052c4a9c9e4a4013332f40dea7af8e78cab7b629dbb7f385e7b917d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7925f4ef16a222e1754646e26cbaa9c3

SHA1
7ac44cac65df23477914185b030dd7bd7e2e115e

SHA256
b0023b843a6042c717ca287bb47830d1a0ecbcd5583318777e8bbfcc95f5be14

SHA512
39749f4a34354f578eafb96b1bbbee5a6614d1807a609088ec27b428dc07e2768f4ba07e4fab7e97da9d22fe0a383254e38694cfe7e48841740a72fc34259975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d2b719028227c7283b6bc437d9cbcd

SHA1
64a60138312704effe3a5ea75afc9f488198da7e

SHA256
c43f9e98a69f9da5bae9b2e072795e74b5dcdbe24997e4bdba2ed1c9d76ba81b

SHA512
be7b24afb5b255166cce206fcdf8510d080ddc99fbf827361aa19d85257e9ac6b77f7da093012b664119b1c5a5b2dbc70bf3253060ef611c50bc150aa771c040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ab24c59a3d48d5de2d914fa20e0c0a9

SHA1
1389acee3de451899bc43d2b4bf6afd1ca5bfc57

SHA256
c7497e9d808c6a5f83d661117f5cc318ba6301b34f31b7a7cb540860b039a3d1

SHA512
c8839f985209f20389a3a4c18b69f54712eba3dfab19a56e5799eb191e23e1a461a0d0df882248a49d88159762e198aef02f175982cfbfe9ba5835cf0e7fb569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
769d9107205172c75c3a3587b09d5db3

SHA1
b045a5afefb36bb626359f5e15c1e2594efa74c0

SHA256
cde47340ccdde94d8a7fc21ea3d4063bf934802796f18ee694961c3cb141afb5

SHA512
1d0ed60289fc1058d87d13860d5e7b27ecc30b939bc5653eae51ca3adb9e90a919f44947bc0baaca36a68283b6ad8672e6516e96912f96c2c92c1c1aebe21027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88e86146076673288bdf37285ba7bc81

SHA1
23feec6a44b34d055cd9fabc501fc1bd4d5cf925

SHA256
612c20e24309b5558e0ab6e28d7792e9e8241db69af22802e1d59cce5a144ce3

SHA512
a1a270538117e4619cd2c5bd82c274cfec7bb0671e910eb52477fdd3b3628071da3c08274d803caaba420ace3bfee51c532c22d9db2d9072669c73f0cb0d1691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fed14afbc8d91749ea75dc78220fde2

SHA1
90e48bbe736d388c95d726a416191d9570f0ae6c

SHA256
1c1ea6962a46e7f0f3915723593761e016ef7e568f8b353e8be9f33b662ccdfb

SHA512
997b9dff3f4dcb91f3dcf5e7c3f690c1c50882b0f564c7277188fd0f0898f14560f50c10b70d58c629bff29fb3f3c85a18b4a5da34ca67fb469f9ca119ee1a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
498c7fb0e8ab2ad1426f84cdcadee114

SHA1
1c6ca8966b9dbeb7c04b7767c68891a4f9a18868

SHA256
973dd1cbeea3b37f1a28eda4961ce7e601d55ab9801b4c6fbc9acf4e31f971af

SHA512
3c1d004806a9e76232708aff8af23e0e6d5c00afde2bb71414031b735446322a23e576d6f5c9605ef42b2a1d2bd2d30f634e5cdbbe5d7b4b5985790f24ed1fd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a3205f9c70c374e34b29159e6d28a4

SHA1
71dbb92cb256bf3212db2598d4c4233c87e31f52

SHA256
5b6f327ab7be2653fb1442bbd6628002ebe247fb24a5a68abe01f7c1aa09dd65

SHA512
255ebd2875b77ec0c65f36e019898f3cd303c6f3df389459215de5202c16deedd58848f4fb88bfe2743f8227975fdecd69218e443bbd808ed2711f9147ac1d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01cf30fcfbb98285929730d84e80f640

SHA1
c0faa7669566985ce7a43aadaf1cb25c1b1e6f8e

SHA256
ea094e98e95ee7caac5116e0bfcd294c76841be5aadd7538c6b9e8fd6d699bcd

SHA512
0045b3378f11a0edcc4f2e71e2845928fad02565b152ef37251a09cf435eac796422c971da95f0488e61fc656f21cf35fcc36f784fcaf63b01671a187b9b329a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c756edd20bcdb8b01aede997670bc18d

SHA1
d5d2f44c2008c4831ba5fe4118009752ace1aa88

SHA256
e0c63be7d181ad09ddd360ce193ceea049cc4d24b2bd195a410d4087d9376dc1

SHA512
106d29f60aebf352a7b352dfe1a920dc1f5e2e6813579cf55e5359b4de2340f7706e5aef15705207ff0ce38dd642e7904546af7183634e7d236f3ad20976f074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BDF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C11.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit