e5691f5a8b5ff52fb8561d9843ed1861d51c82891e39018537e548fc2128bf7b

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a47bc13ceb9a1d107a40c05ed7ba124.html
Size

53KB
MD5

2a47bc13ceb9a1d107a40c05ed7ba124
SHA1

f0a5f476fb4415cfba718af5666eebfa7a07237e
SHA256

e5691f5a8b5ff52fb8561d9843ed1861d51c82891e39018537e548fc2128bf7b
SHA512

4628fd233de40abd3207d87478c8ed621990542b98edf7bbe5c4a0c4e2d4ee0c2b146cc9a80f3ae1df2dfa3c6a0f8cd0ccaeb0edb4171c7a7466eea1523f9d9c
SSDEEP

1536:CkgUiIakTqGivi+PyU15runlYx63Nj+q5VyvR0w2AzTICbbWo+/t9M/dNwIUEDmJ:CkgUiIakTqGivi+PyUnrunlYx63Nj+qv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410635225"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006657d66279df502f8f772022179c1e54771489eb74e18ce58b8b4f6d570cefc5000000000e80000000020000200000001b399ed0600ece6e53374e1abec2148beaa7b62f33a14c353d1ff1b68189382020000000a728118f64d13c522a679ecaa29d94e52d902a2093a7ec0eecded2ba2df23b8e4000000092783e7e4df0a7c8ce31054951512d0336dddc80cf31c1d4220a62ff937747dc8090e3c02390a2bc36d9d7df88c0500ec4817d9928b4582c296e65985780a642	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59D6EA91-ABEA-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d99d47f73fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a3c0bf4f4caf762d79ee8e29ed8e9ae1ad9eecc075dcb00b28069f63ebdbfd00000000000e8000000002000020000000d0c929cca9d4481a8a9a6a0851943e7b4f5cf2e77ebc6a7ff0b459f15aee56489000000077b61ce0e0af7a43e8ff5c462a5e05c1fedd455933cf5eecbf48e66603762ed8c74ad258284ae43d67c7887a732d778b14a5c24daa809774ba35cc7c14012cbc3e1080e44d8619bcb30229335517e76af903e6d5d2224b908b8c1c71ab6f658fe3ed0cb455a5fea45aa4629ddbffab1961b5bb4a23ba6cf97cb46184382235648a19f6e36e43c59fe2b8d94791be3e99400000001fa184a1188573e65a478ff52928ee8de509960585f11e96ea7bad24528fa7e3b22f9adc6c19cb49b5907fb366075265bfd1448e1edc66e7be5593f75d4e3e14	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2264	2528	iexplore.exe	28
PID 2528 wrote to memory of 2264	2528	iexplore.exe	28
PID 2528 wrote to memory of 2264	2528	iexplore.exe	28
PID 2528 wrote to memory of 2264	2528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a47bc13ceb9a1d107a40c05ed7ba124.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af8406bf0677e06204b3fc7151859166

SHA1
a087e4e0c45ed2d610d25c2baf18a3abceebf44a

SHA256
9ad645bb1b1d1dd863e770ca1f13dc2d608e5691eb6969a6b7df6fdfdf417dc0

SHA512
017425da6925028e729bef0b2fd9ac9126bde12409bfca8913905b55d15e854c0aa46bda05007ae255a12a17a548c9a3f69b2ce34d8eb43e6a2952af987002c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83fe80751e6b1868e935692c9167acf5

SHA1
40f6e06ccc06e1920361173b33d5ba7e1aae1e2d

SHA256
899900f1a0301add1fbe61e85c8d4cd96ae490c4804e4f419122a79c21a00d28

SHA512
a29bd2c7b3e4c3737c8b0a630156387491747702ca52f3bda2a239d55fed8f4ebec738dfe7df720050fcc4b23374d95776f368ce2c82965edc83a3eed2fae07b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56afc0c2ef27a13e918fc3a6e56b18fa

SHA1
c6526d926b90df7fd8f6cde3fce6e50e51d6085f

SHA256
05f0143317743c4ebee7f381c29843c2a42f067842c7b9884b5e4d654f2201fb

SHA512
838e06a90c44610c178e86e24abf17c7c306183f3faa08394e7cc0e7f5994157a593d947dd513bcf0da4eb0e47b5078421c485ab24ab8db0e10cf4162ba482cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4721f8569c4094af9f04745e5a1c055

SHA1
ef69358235817350967101ff381eda3079e9f975

SHA256
a7a870300d3b5a15806615a92473e4400af072f398269802e028dfd162536346

SHA512
cbd442cb2a971e921249c36c881e8ced9c63c5996d578dbe3629429b9fa6426ba1e9fb946d311e8aecca5d698ece531eee598edc7f6a4bcd2fe73b09920a56c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00af1e6a93e99d7fade7912244ce6625

SHA1
720cde0b5f5048b998f0b0092782d9d7295d43f2

SHA256
e77f7bde147a2d2dc2a8f597b0e40ffb42db9d7ffd44242e7d86459a69db7428

SHA512
526b1f62142c1e35e3e039458e32c167fc7aa21f1f0cfc7daf39de7cd3348f2306d2f4576716270991ac225f1de94ec9255e04ff1a1396e332d778b61307175e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e0bcdd11a2f8d0ea369037afde99996

SHA1
be6d95b09a987e76ac2d518e1b5f961265966d3c

SHA256
4454cd3a1e680f5f2ab2db8a58b55dc45d9e878fe245c4df5f3e4dc0489d3a38

SHA512
18351100334f58c75ee77432ca63b9992fbce0c3b6a150c83db5337001be9d99692872e06feff0f53c23545c302dc1b22969fb14126f63f5cca167149ed50fc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b8408aa9ad82363e7c4acf35ba7b67c

SHA1
d36891f028cdab4a9a9eb2ff9d41ca391c12a33c

SHA256
27375207d5a662f622efdf28ce5a1ca16e902fb0b13c60716e6a1e6dff2ef9e0

SHA512
c2d3bdb65fe4e8b7c4fa4aecc19cab2901877d029b21d0ef596e3b859d468f74411d378badf8a09b2d2b4d7a33bc4f0aebef53ea66aafb5801b38f806367360f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
274019ac92f2fa88673cfb8866518d37

SHA1
f00d4c0b43b93ce5fc9895a94201eab9a60ac890

SHA256
e522575bdf56e6f0cb4c27629f74e5d00539bf3552228b69308e687ccc8f56a8

SHA512
be91db08aa55b8cddbd035ea513aa8f18ba8f241d6b817ad8ac45b2b99c78646cbdfd636aa7086497aa2f200e8b536451abb01d334453f0d07c205945e66fdd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0b869a615f69bedb8214074e7152544

SHA1
b37f9489450ba9cdd831a2a6ac8bba6b5ad842a0

SHA256
99669632d5018401bc0212c2634935866569f6e2e617b6d9d23c559d13bcb3ff

SHA512
6e7078e834f8cf75b92f7e4d806d218c13c09854253af9d13324f17bb1474cfaedca9303936a96d80e4399a0cacd132937b05da455d7de3448a327be00c397e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e1bb71636612a713fa3c2f9e9a88e3

SHA1
d57c5d759ec765e63fc34e7563f92c89d2f4f8e9

SHA256
de65e447c825dbba70f15827366429a3dbe301003dd86b6d07c1696c7af37b11

SHA512
aeec213e8d2e951ec74c6381d51469aff3659dd989238c7f5f6f139774386a0310c608d7f95f04874ab9bcb8d6a19cc64e9ddd6cd4eabaf52fde652502537ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
699f8c04ea239ab6388cfefc33e15521

SHA1
0c3ff1dc670089137d43e45e6e09a9591dac6fcc

SHA256
202e41758532720cda905ba37177bceeebd000886b28c09885dcfc409f762f9b

SHA512
7f7e39bff63cde634ddb316b151c232c90ddd69e8150f228ce5cd1967e97edf548e0d9aa9838705b273d297dd8fd5d49cd4f3b18d88e6ed5956a0c4aac8fb374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab010cfc2974e9c2938215d0b20c7985

SHA1
2b0209c09deb27de20f0e1c29cb6c08f75a0fb6f

SHA256
b98205470b36af478c85d646afd638d5c4e67750266648902869a57f7aed77c5

SHA512
77e4bf45b8d42d4b0da26da7f6d84490306803c2291ac07b5c934ded62e6dbaae60f80db0d2ccd3d689cde08e5bda57008d0f4186f1b0f03335eedea26e778af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
027260a8e924042e589a22fbd9932fb0

SHA1
10445517d23080192ec41de5550f5d1fd135bdbf

SHA256
d0d34d0fe6e583d1a6e1b412f920a311b7e1257b8a00aa34c5b115f546f9e378

SHA512
d53d0fcd300d84baeebda1b728e63fdd4843f8c452725e90d99e2b003fd136b010a7247609853ab1125fcdca77f32d78b093afe6a5611781b4d8877c2d308512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdd76fb46f7fb28eced91b5bbc66909d

SHA1
9af43ddc92726c346eab7fa4c0a10cf2a7a28f43

SHA256
fe116e23cc9909648350c68fa5600910977431de08ea0c59035f1fb75006e395

SHA512
75d716e3f62fcbbfb3ae6f210b3b1286f89074dca6a16d970c17a6210760dec5b51e228eb061b87e7bcc1eddb0de1d0835eeed8e8002fffdc355e650a824c126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18b56d111deea134c748c894b26990d0

SHA1
393892504346adad1e318ff68d91c28d5a8c4387

SHA256
81544d5b64644e95c0ed69f349798641defa067022c87295effe28988450727a

SHA512
1033057b6aa99bd7ed8a3060aeb3b53c814d46c18012b104424a2df234eca7bf3cb06ceb26151034233e9cbfbe09be135adfc22a2d89858bdf82fcb9dc31334c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD06A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD11B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit