b48a03f2367eab68c420cad2f8146528cfd0aa081cfcb43e3f09ef76e9fdcf50

Analysis

max time kernel
233s
max time network
286s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2327934f6f711bb40b5fe7f9ef4acd20.html
Size

54KB
MD5

2327934f6f711bb40b5fe7f9ef4acd20
SHA1

bf8c2facea69b5f693197fb48c8609a1b56d4101
SHA256

b48a03f2367eab68c420cad2f8146528cfd0aa081cfcb43e3f09ef76e9fdcf50
SHA512

b5d420374647b55b262e89647049c0f753dc602af12c6a127981e52c2cdd9c46ae21bfa30d40ae9d7df9eaa3fe72a4fd9b48891cbf41bef9f586663fc02cadd3
SSDEEP

768:8zQKlrgOriWNcaSoagGbUnnoenoHHVwQTNvuAgwNAlhU5+R2Shonk0:8zQR/FOnZQTNlAlhU5+G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410583864"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000003af819193781cf56d79541c2234c33b00c6903bb46febca4037a7d960609703e000000000e8000000002000020000000e9b3b4a6e8d847983b31bd0aec4cbb741eb7395559ed1e30fe6fed756c064d26900000005375e6f996bcfec3c66840a4949f6231535f427a8bddc566364831b68830a3f5d121a40f63e953265a18c5864648e19ea7cfa9a84c83a73124cc16d0aa20c49f45534ff0ee06d907916b4b68d8a93347f5eefd605f01106c9a8091fe0f3f22bb0d059ea03b075d7d473c2ab26c7ee9ffc747e8e195b6757025a51d8f6e79d13aaa5575984d996790792657e7da607adc4000000087b9cd69cd2e157bb0ed71d792d03f4622380d9af360762467eb2da38656cb4deaa18ede6ebea54c703b4a7a2fdc497c1168bd2da2cb02d5d79ab8305a0fcbf4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A67699E1-AB72-11EE-8C00-76B33C18F4CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f52a062276b01223166cec5cb6affa633a00c93fe9438af14d0a603ae92098f3000000000e8000000002000020000000ec58aa666e291fba89108c57ae0384930427143a1412ae9aa6681b2d44f6512d200000005ca3dc7212348682f136a01234dc5cd24c47c646913ff9094cbce5564a2743fd4000000026618271d148e026ffe31b9bd0be2b9052730e7de082212618f60a04aeea5b1e97e06d5cf4583d4b52989e950ec0e72f712ec19d5c1b6c407ddae097409915a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706c0fa17f3fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2036	2948	iexplore.exe	29
PID 2948 wrote to memory of 2036	2948	iexplore.exe	29
PID 2948 wrote to memory of 2036	2948	iexplore.exe	29
PID 2948 wrote to memory of 2036	2948	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2327934f6f711bb40b5fe7f9ef4acd20.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1AE11409F57BC5D68541053A9AA94231

Filesize
471B

MD5
edfdd77da147274c67f62ae4f5101b83

SHA1
fba9af231a5fdd5bb777e678c357b1dab5d652e7

SHA256
11ac3842e8b60fe280bad9b0d909c1287cb8248832f1d3662cf2edc8c4e1a366

SHA512
6d6103402f6d29c646714b6eb4ad381c0c06be22752f9270689eb5420425eea5e0f25b87dac9ac7c1cc3cdc400f3fdc8144a98de7a914b666c0dad83a8af776d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe8b7ffa9989aad082ee5a3d95e01ea8

SHA1
0fa1d3e07096a069a05fef44642e6044f281c718

SHA256
6ec286041aab3ecd639a8947424baba357b78419e5e552c551db419b4fe556fb

SHA512
ae177fc62fa3fda51003e206073b25a406b8ba7416f85f6013c3adf3fa535fadeb6c5f59616b13c327d544a07a6eeaa1b32fa185b0c7b5673e77709ffcbc49ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f849b0d29e8b32e17b4395f4187e645f

SHA1
5ede224dc13860702c3fa54c980f85ed6de872be

SHA256
1d9eecc1e88e525bdcf429f925b9c9091e477e1a667444f4f3026028b07cfeaf

SHA512
efbd01817070cfff31b07f730b1c743586dfc195291e80b344bc0eda1ed84ef61b2171911f9fd8558e2d74f4c2667f3eeb55957c4f6212ab1a41fb21d8205a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
358c0143449cf6acdbd4509960ecdba2

SHA1
0461f57324dbf74b2776e14e2e87c474fc4bdc4c

SHA256
a9f4847f311583f046e73da82b8893eab7adcbd3c603f61b487b85cd49f6b9a8

SHA512
cb8a2b90f018219eb928c208c80d087d1b916fa4565c46b21be06ccacad206cf227c6580460cd28ddef75021fd1e3cd701d9cabfee0e4686a8645ad1c4a8cded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19ee87fc1f7ee96112674a58f7f28423

SHA1
386253d46ed8e75258c97e8d5e33f7b35c23f855

SHA256
35df8085e184ecea90fd83ce40aab74f611d4db1fac3d89c435ac0894bcee5cf

SHA512
362d819fba96ba2bc97afd9295f97b2782e3771ebe699180a3f9d761706aea328e524878b731fc619dc602a7a37b6fdb202e8f39d7f6847791ba2b6f85847687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8963b29a2f8e4c01db31e7a64955259

SHA1
a6264a70b53db7ff3b7ea6b65f9d1ced2d7d53df

SHA256
a08c32f0b9c2f5511a95cbc2e7997b62692a7f5f88e2c45ef5a2acef87000b7b

SHA512
a48430c1d452f8a6bedcf4df3b139cfa6d17085d04ad6dca551e50ee619f0c08273d614221dd55249edb89ba7b841ee3f7957349cae7c2e5d522e9a3bbfc556a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7efc1e381f0c5f1c48ce4a4780f201e3

SHA1
2dd7ac2a3f5e8fb8bebfaba99646029dda5d500f

SHA256
4bed9b43982b44a1e3833bfa1a3ff8bf5cb25d7064c98c20a2fbd5e8679e1f94

SHA512
a111619d1bfcc0427837e98b32f9e73952895cdd0594c4bdf0325b63392796887b9199bd28db13faacd4ca8846796c84d0f573fe43fd8466cd0960ec21abf13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
214aa25acbcec5ba55bb2e302c0f7188

SHA1
0903f738c1a707a24d2ee66ddbcbb112518073cc

SHA256
f7876ed7cfc0c2c7e3a15e5921ccdaa59087d562d5da17e0c8304b6cabc202eb

SHA512
3f2a650e855e7228f4f38341432682694643e4aba017ca929dc3be0aa7047424ed5ad0021332be630a1c8907382c00a199ff34eb11f1ae4bb162ff17d1c9d270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e360d0d4785e910d611d538d7cfbdac

SHA1
d7d814108b56263753c8c198d2fc30b3a6141a88

SHA256
1f7de40463b139f3549c59c4c195fd43952f4c6d1f8b0644822838112ff54883

SHA512
85268875fc24a6cc9f2c2ed621f02bf724f811598da2e02fd436b12e63adc81b552afa70a10502d1f9965ed565f86a30e2d82dd51ccbd89b4ca5773d170ac744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc7eb0001cc0aed9fe2ef4f6a4b881dd

SHA1
b85b3abb0f6c649715dde242b66e13796680409b

SHA256
920f33573c42960d1b956246510bbe0890673f76988c421c0ee984d4cf06e6bf

SHA512
02bfab20a4346ec9b6f5fe8b24c41877f06d99ced572f3b214dacb9bb740ccd98c5cb5e15864dc9ccaeb03b84cc89d6b68bf0a88935db69dafc5e52cfae1e63f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56d92be439984f3194e126ba2408098c

SHA1
20f67b76633b564c60f6f6770c54fd57f98cf8e3

SHA256
fe55e644e12b87d3385bd2835557d3e5ab666905f4f1b457688b00e8bf561c5f

SHA512
79c458f2c999655741e0a5c02af6d84fe441be21ed71088258ac25cc571dd30c74cc015157a12becab1fb9d4e8f39ce8cbbf16785ae5c114953c3b6f1de6fec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c92e1765056cbfd1fed28ab5f22d31d5

SHA1
0137dae09e598fa2b67e1ee182cab6d78b000550

SHA256
3b9cea5958592e33990a60b57b2163818c1d7f6fa5cdfbe5d94c9edde3ffa81f

SHA512
c002a120cfdfc1a30dc87aa8168c8079678ae00ab2e68055a3b38b872ff4242ad8984050ce95e36de06182339b4bf76bcd506dda6046646c44d70dfdd3a095d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CFHPCFFP\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTTGCPI6\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8690.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9969.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit