54c895c505b669e06e8e3390026d3e93843693c4432c88637472a75311f03271

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

292a368d47b189ca701cfddd5cfbbde5.html
Size

121KB
MD5

292a368d47b189ca701cfddd5cfbbde5
SHA1

7fed6ecaf5800c3660f57e285e1662dfd18f9608
SHA256

54c895c505b669e06e8e3390026d3e93843693c4432c88637472a75311f03271
SHA512

dbb550c97279483dab94097a51a2f9a3a616dbcc1e50d6d0a362387db423fccaa19aaf5711c5ed85d916110c9c4380b5b8cfba7bce8c9ba1bf5757b3b99f2d85
SSDEEP

3072:VCnLeCyR2ABQg0+UcjvG8rMUnteedsg92vd8q1DHe:VCLeCyR2ABQg0ST

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{850CBD51-A93A-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e6e3af86c82659f2929aefe9b9a590077ec8b124fbfda4a8094879cca2a4e12e000000000e80000000020000200000003e4a65f1d5fb06696a846e09a8525f1b8f54b949f7da20d27ff1d0df0d0ab903900000006d808b155241dd23fe28d96925df6623cd9b7956cb15787326f745b10a7679bf2ba7e661694cda63e807c7945074dfb494c744af150faee313563f660c0c00c84f3e41140fb1815da0a6c24068dfdefe91fddbed50f7d22adde54731b4e937edc8b65bb6a1ecbdb1f1fdd782438d195f33700a33150255249628c2c4f724de1dfdf5000fe35c2c0f5d515757b411314b400000009f4936341a7c2e4b9484f46bf00673d2bce2581c6ed3cf17b475d90d48307b53fc20694e3593677f6c1ff80e5c5e7615dca515566780a5e1caa1b3808121e924	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410339804"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0751b74473dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d16d9517a503a7a430e8586d92f172b59caa692f0777b508ed0f5ee7075221cb000000000e8000000002000020000000b4be88972be34121fcf727f4de626a63646482367365254f8e57c73cc4e1366e20000000a86d915b5f1f6b386c28243a87776098667c64171561b3814a9d02b79bf3b1eb400000005101ecb0e4c93a04129a2dbe5cca4e718cbac16eb4495c01fd10b1c26d95c53eb4d7c4c2874a8204e51f8443136434213a99b8a01905d9d0c33268018f7c7adb	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3056	2980	iexplore.exe	28
PID 2980 wrote to memory of 3056	2980	iexplore.exe	28
PID 2980 wrote to memory of 3056	2980	iexplore.exe	28
PID 2980 wrote to memory of 3056	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\292a368d47b189ca701cfddd5cfbbde5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
4427305210cc57bdca1710add3dc08d6

SHA1
64e9525f7d2b88d3ea433792a12595c68f081b11

SHA256
982c59857489523587650d804d50498feeeeef4cc30d595fc16924d41db17b1d

SHA512
916659e548917a018fb9c4d8c8d6e9acdab7d107d506e50d00ecc0f2bdd6668a76a1a033ac90ce8c44a45edc4e0166b2ce8a2e79a664de9961de14729f104ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34ac92b64c2bedab23c79c96e14bdc66

SHA1
8ae820b51cdb6f4d9135b12fbaee5b77cce1f7d4

SHA256
7344c00afe7ea96f9927f13ca894d7c587699b6a978f80fd42360cef9056b874

SHA512
e21225391d1a333fbcafc54b956f533643ff4407067efbcc0a0e19349d8288212f9612626ecd53b4617d4f68aa1de2325f2e199baf73d3e09a86d7f261073e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
923f6168f276d19dc57aac0fdd28cf76

SHA1
e3e1e4f22888935df10d94962cb20257f6da692f

SHA256
344a6ddce8a4c5c6c8a379ee39b021535f782d9c3e34138f232c7a883528551b

SHA512
aebb865c38dc0df43e4c55d9978dbb211e22aaf12a334aa6026e899b84ba052a4086f5508c4be41e36c182fc75858ecf7d981c6365958f07f31b15990b23cbfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d69edcc6bc37f474aa24e9d7858d734

SHA1
61e47f3542bebf93e85189b4506b70d2e2294d31

SHA256
a437c982aa605b4c3d78723ff0ccd471de767e78c27dfe85bab317a78224782c

SHA512
2133dcc1462912a44dcd50f635f2b4cab5205980fc4f15335c315d308db12f5241618e4b16ba230fda52b9dc9ba0422645866861305ac5299b895aaa29d4e147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d93b30cbcb2839dc0995e69adec4c2bf

SHA1
0dd61aa3de5ff25da4aba10c5eeb428bcd530a2d

SHA256
73b8533c86c67ea061e196a8c024ddd3f23784a83f99de84655c82f4c8bd26aa

SHA512
c8101b68d2fb0d1645c3bace44da16d623959bdf05b9992cbeca57f12e54a7f3b5637f12eede20bb8c7567ff471fb0a22b843536f416fd92f32815c3ffbbadd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69837e46e4ae0fa34a07799dd0e73889

SHA1
e92a02579dc6fe132532488a085ae3c8aa8e6ba4

SHA256
cb75b29322111665aa34fac21531edc4e75d697643cec5c2cb2bd22a6b11f5f0

SHA512
95d16a8cc153e326b02684a78a9b699c4c05021685adf3872b586f2f5e851b4c4f3ccd14b3de664d9c87cbf0bb72437ee7a018f097e081bbdd2f1f31fa5d8cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f83fd7c0ac88d632ce9cd8a4f4574681

SHA1
2ad53823a628fbc9fa0e56720080246fd7e90ce6

SHA256
ec33b14c728b446ad5ad13eeaf8bf54745cfbf6d27bfedd48162ee3276b35980

SHA512
2dd7005dea3d3c537ada432fd427c2119d5a44cc5c82a8c06526645b30681c4ba40e4baa915c7cc75574ec68a5633ba5d7e1ed952528bbd0195258d383e4809e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e230f3dfef6cf6e80aeb4c284ec1dad5

SHA1
1841e925997141f5c88b1adee38cc99f9a866e30

SHA256
4d40e43bd72a8c70104f23ec55f572e0cb3f7ffc5f4c77af3f72aaa5fe3c2a74

SHA512
bfde1f68badd48e3d712b59f8ddc09ba15d4d8ace0e9a5fff6f3d0776ebcc3e5c6648f34144ce8676dfc73d79b1045d805ab6e8bf0bba0d564bbe97e747b1b97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82562075395dc0f35764747c7b6c8f10

SHA1
e5125df35d0f00a2894a1cee39f2e16f563942d4

SHA256
5834f7782de9f294e66cf165cd6c2be3402635245fb3d9ef62e12ba1e9d347ab

SHA512
5850472c03ce5a6929a817a4a65d1750a8c67af554bd8cbb0a10271f7e637be5048356850acbeb11ed00ba59fb51557b90267c7192fd271c27a8a9257c870e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd323d3a1b001a87765733477feb0610

SHA1
8dd9d703995ca22ac7842c10fb156c1aa4fae8f3

SHA256
b09f87859e9fd60ac655e585138df0998e86210fa8e0a22a4f044743ce0b6f23

SHA512
fbf5c3d70ab7b0da684818502741cfce21ea9b6022bc83896c2928546d6d8f02b0f99645bb44da44545ade49fc1dd42584dbcc2b63f15f4db33f9af40226bd11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD1A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDE8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit