ad5fb9116f1414207d45ec89594d33c71e90dc9e73cee16a09d376715e3fca9a

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

273c322c9bc860d625cca43bda2b0dd6.html
Size

116KB
MD5

273c322c9bc860d625cca43bda2b0dd6
SHA1

261b67817cfc854681093b3edcbc80b6b997e4f2
SHA256

ad5fb9116f1414207d45ec89594d33c71e90dc9e73cee16a09d376715e3fca9a
SHA512

58d7d8a9a1db5689274b42ccd4fb1771f1893b8e26aeedb774a7540dd41966a1d82511174961b14bd9ebd7f31f0695ae5daed5f6558c89ed115bda1b77062d50
SSDEEP

3072:SHrc3APA+d/2KPQmdtg97UKdedeadxdOvr3:SLrdndadEdOj3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410614708"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307c6f6fc73fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c74170193504ce5cefa95d74f5562db795c5c523b67201c1b0c1447e3ec8c07d000000000e80000000020000200000007bbe7821d30d8751212da0cdcdaaa11eaf0e53a78caf46270cbf1a1a6f67c55a20000000dd298c576ab6ef393cf727b7f92bf5f112421e91159abd497171f45b1b926784400000003c1eb4ec452998a2b976371c08f32d606907861bea20e394dd9f64411c19b761dc335111ea9d42ab215b804c6af971851c1c3343581bcffb123970ed52b034ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000023c7cc99be1254bf3946d4226f915c7cdcf19b5903c2d5c36fd067a789814072000000000e8000000002000020000000238f9b93e890048fd2a4d50114aa184ef13bc2e841d6be2f00b8fcffe855c36f90000000ec6eaa927dc27d0c9c5d4e3254ac05dfa8816405df0a79efd9d869c009450fb066125058d07e7425993cafc4f670c26d0f175be03fc9f4ad16fdfbdeab9759f6529253126dab9c2a1895e949fd902d80f0c886b26c246dee5943c4134d7adab39e738414ce590f2924c31928d147fee55e323377f45023189bf7ee852193cd5d47f58ec269d1e9cc3d87b403f84076c840000000d475d1c27c7a82f55e039e9957928b9551080c9f7a9b833b1085c86a5c7a20a1f19e0c8b367e59a41dc0239262de8eac314cbc7773341096760222590961e02e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{909DA7B1-ABBA-11EE-BD45-D2016227024C} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2308	2232	iexplore.exe	28
PID 2232 wrote to memory of 2308	2232	iexplore.exe	28
PID 2232 wrote to memory of 2308	2232	iexplore.exe	28
PID 2232 wrote to memory of 2308	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\273c322c9bc860d625cca43bda2b0dd6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a01fc5a01f07b82659c0cae11a6646

SHA1
7f5505f00d709263bfb3312519956e46f0cf9113

SHA256
872b9ecac092cbecdb995b642ed8fd867429a5150232d30116cb3ed63b1a716a

SHA512
2a7f3c386265c27f11e156b22a2a4535c6cc225cb118726ef5dc7fec03db726a9ed686c3f6edb3985be31dc8a0ca1b69ca263284551896f46fb6b884c10f90b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
342e1eada78ec85953d83bba052219c6

SHA1
07281f7f5a839f77394a753ccb9eba97922995d6

SHA256
b124fffa641b27739c541a5820c6eb49d049ce74fddef2fb60d75805af79c907

SHA512
195d338c8e20aeb62fbeaa41472be9b674028b1fbc2aee7c29a356017e2d4cc6cf3f9fbb00ea16793ebbe198ebe2deb55fe798bda9e68742d7ed779259a68594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba3bdcb9e40cf771e2d82829e08e9836

SHA1
22c0e038e01302695162aac91eb1710fea1de909

SHA256
eaf188ce2518e239708647f7a3342d508306a4e02c63dd9171891d509a9eb198

SHA512
8008f36f36fbda69fe2bdcec70c56e0f993e53404b8d967a20cf346ff1ee16a6708124c287d5c791d143c058350adef092e3127fc6e6b2a5e3161f3490950bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175fa4f8d2b1c4d7de2ea0f57efe385f

SHA1
ae0605f07c1cc85db3a8c328173ae7d07cc02af4

SHA256
6b8c18fea9240881e24c4b2794bd51e28ab2a13236198be1edbb7fff25c4e0af

SHA512
13bbf14d99f8f7b3012a62c157e64cbbe97da589f9adf5720b7f1ef685a397b9ec5c6102c80d520f5feef8c2c01d551a37aa2d97fc3a8ca41ae60ad1d01ffea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca47010e7a535f0692090a2d53003e9

SHA1
4d00129ba9ede28eb21634334e22deca52e52244

SHA256
b545d441118dbd9609d98d86e0dacb237a7ddacda7fa9c504099a828820bdbf8

SHA512
3acb80c9a3af532a1dae42dfc61ce549b5490016c115928d57e79945a96fe608ffa9839405ff5c0f86fda48458b575c6d3c77e69b8d1f3fdc8dc0a90ca708179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f0a80206f46330f3b43be976abbe06d

SHA1
f7130e8fc51ff42af9f1f8b0463d6d8e9f7ee02c

SHA256
7ae5b641a33ca037c8899105f750d65ba4614d24ae0d9c59ffc83b8de95114f3

SHA512
86b259a150f5dbd96ef087e7b6454de70025f2d0cf230cce27ae39b5ce0b326855db1666a06e0572444ba3e050ee13cfff2d628779074a2785ed5e31d5ad4693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b764a281ed01eed00fcd5a4de3d3ebe

SHA1
a23c0d5b17c58c688702a61794c3e6f06194a986

SHA256
c24fe45a3c44f5a44722c420bfe75b083c8e559a2cd40a44d2f24e3b44d1e514

SHA512
b6681816855ee2f60d59fce321abf918463c2a5e4b382e9433545a1e4e083eb4e4785bf485b2667f37a095f38ec45e1aa58be715cf9bdd301155b524b3b31bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
354d28b7d4138c492b36437d1122f70b

SHA1
5e5019006091c6d3ad41a3e9e4a0e7da6ad02c59

SHA256
9c85ad35789d1f305c32f21045ab6080d02a4dd0bc90133a34c6111716fec125

SHA512
088394acce8600282d50e9de149135a879cd740e9884d24e4144c62a8bdacc164ad7114adb54cb5e24bcadbf45a1eee83a46f83aa180dc6bd0fb73beb56c8b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
029de11a232cb8abf2c94d44cb4f9fbd

SHA1
ed9cfb604674782c5105d2484bf800b93a1ae837

SHA256
c29a8a0da7b52b6e3688cd048cfbbeb72687f2ed72f5ec40a7adcc47dcf37717

SHA512
9b5c8cbc47bb03e5267dfe1378cb281a4983cc883594571154fd2926243f8c3f83352ad06d1f6d6adbe52c65413471998a1fe3c38d933e2c001928b389a36a36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e3b6c3e0b845e419ed3a757b47e2d49

SHA1
0323106e7303f8a825d8fc83f3cb16fbe67c4a5f

SHA256
76323906925773610264552d96329c8dc35b70b3cb736237afb8a40537d937a5

SHA512
230b03106a11e079bba854eed7c0ac45f58addf3a5f1e7cdbe88921204157ab033543c89257d92f154f2cb2e9f6bae681a240263f05ef13cc84641c2924e9727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAJVCBJI\suspendedpage[1].htm

Filesize
7KB

MD5
f8609805f1411ee5e928819a147b04eb

SHA1
acc4ca447347d61385f80ea666cdc667e3041b69

SHA256
5b70a58b850859696f1d7ce5fdc57d1c04e2ea86afe92e55a4190369a4619900

SHA512
4e74c4e639d71b9f33ea1b839d8b72175add15bf9b1a808254238732182d44ebf8795f44292c2fa1ea866a8c94c25fe64d35cab5fd23087248a1e2a6f97a5443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\f[1].txt

Filesize
174KB

MD5
58295af04e77aed8420b9e1f17c9ee5a

SHA1
c6cbee02ea5b162ce2a922747c17727bab368816

SHA256
1ffad2bbb0ffcfd26c9b308c282ce5e8d257f0e1011b9f055397dce04a5be0b3

SHA512
6c7f79edf7052b197cef82582419a019d641fe8b37cb7601e10e0bdced02249b320aadea8372faee9ebabba04073432aa3f11d30a93dd1ee2295f566803c9250

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6460.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64FF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit