911ced60177bb4481cd60a6045de4c7586da68a4d5dc87075e014bf96430ce30

Analysis

max time kernel
139s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ecb70238e63c0662df6bfabe24f91b2.html
Size

3.5MB
MD5

3ecb70238e63c0662df6bfabe24f91b2
SHA1

55ed21573e6facfc5410b75a8c59ce00df486e15
SHA256

911ced60177bb4481cd60a6045de4c7586da68a4d5dc87075e014bf96430ce30
SHA512

5fc97c55295cebf54825a3be914262ca240c69e2fb942a5b7852559f25531e41082b9233417b53fb78c8c082f0b8214cf3a5301c740788e8998a0541d3af3002
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nu5:jvpjte4tT6s5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4935DC61-AA45-11EE-88E7-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410454378"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f5af4a330ab11c590021de9eb5dd767b3e23ecfe87fe8e600efcb6ee5aa59197000000000e8000000002000020000000d0cbc59b46bd5311481bf66d2e03bdce1a310e8f4e82e1da7569342dc69e482b20000000b38e3b5b9d18d9d045ed04ed18a679c264cd1c6a2e2900953f1dd168ae5f857840000000b6b23d1f406c161ed374aa65af5b27b4503165616cd2174dafcaa26eb202f72aae17335ad73e201165326588d2596d9e5346bfd14cc35ce3e5062b44bb1a6dbd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ed6528523eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000030e9f24a32155f6193b710de4564380aaf743ab144a6184c2d3ecaecf81b88e7000000000e80000000020000200000007899734425880957352a1f9f9990adc371a0e0d115dbc3c8a951fa2b4c7868d490000000c87fbe8f3c3c5496c0279749efe9f5d8e97dd35635040fc198c14e8984612aa45b0dc76032ef818336de84743021a6641abdb7e90449711b08fb964d67b44f32785e7a332eb74373cf2470adf49ece8ff78c1bc51835a7ec6ed2d7c60275178641c1e01c1ee0c621d2ffd2ad9882cdf016ad73031ba4624f3eb49dff529af1d0237454ba53ed21c8c2a8d414a19ef39140000000ca588cd7c151eb3efc7d7e0707d15956ddc0f73e6531a644113bb9f63ed2225753f2bd8dba96686d109ed5cd7e2bcad968e68c6ba5d6fc017a0588d339a492ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2708	1716	iexplore.exe	17
PID 1716 wrote to memory of 2708	1716	iexplore.exe	17
PID 1716 wrote to memory of 2708	1716	iexplore.exe	17
PID 1716 wrote to memory of 2708	1716	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ecb70238e63c0662df6bfabe24f91b2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5204b5949bec62cdf8f1ddbd0533863

SHA1
5ede990ab4b6d87f5de1d307f5ba28295457d319

SHA256
7388c50795ffaa91ce95d270d15568d06815e3bc5dcd656b90240949e14c4cca

SHA512
a0361ed4a58893e2ae46924c3911ed12ebd4cc1cd9f657dd05f5c4f8081eec8e2b234bc4fe0ae6680fe22a8426696ba8ef99bec8ccfcd8fbde54f8ff176a7c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2429899db81b55cb4d7f419620a943ea

SHA1
0f94be16ee011c7e4c36ebd8a37bd8406e97b268

SHA256
bb5d0a806f259e21b9a9a2df6a9b1120b278b83d53b3c51b5cce6fc62b157a1e

SHA512
08c965b158dbfdcba33e51c1952c34cb8edd60c21f7f657b78357567ed3ec28c6eee6a9b50d0b6c81cf316e4d08ff80cbba929790d46996d473d789e27f66ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
811e14dcf080f3c9ce1836bb90ad312a

SHA1
1712061dbef99602709c19c7c78f6d1ba52956b6

SHA256
a5019387d75950de0f1dccdd8178da884060a58515a6b5d6268658e52b05eba8

SHA512
f1a4e4cbf010dcd3c05a8b718bc09acb18b2a0b721ca55ff0a7ea10f6d84cf18897da09388362d164f60c32ae3276ecec93d66a9f0e8abda9e17e5c8e3dfbe6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23dfb9da6ad6308556885bfe41864793

SHA1
256fc822666fbb3199697fe4baddb86b66d99261

SHA256
8083c1914b0628719a2781c33cd86032edcaee51bd260ed7ba38eabb2c13cbb7

SHA512
f5e5d58e1a3aeccd81fb0b6c1e5c8097f81641786a8b9a5014311f2f71104ff7debeed2e0ddcf553d168eb2727146f2c47dd7a367ad71e6389729c4cb05ebe03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b68d0d516c97847bd3f422e2c92b26

SHA1
7d49029ac850e99ba63954143f55d624a7775578

SHA256
f3e0429f8da553dc2c90a125a823bc489c4d08c4b54c691eee03f51b54eae18c

SHA512
f5fad3816cdf5c3a318389b4c618b62d4d592e612db58c2c607036d5ab83ce1cfa7bf3051a01b810f4e6e541be1b0096173630bdf7e46a88eb63088b213298af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a8dc62aa1929961bcabb92d6bd4f80

SHA1
f8fa97bc817f3d2ce6c9e1b4d28e2440fd912411

SHA256
7a422d5479c07ef369b446e5ba7c00a3fe683cac215197375f0fbdcbc358dc59

SHA512
d1c16a32c2a03fc903ef83da1209e0cf97593f4faa48e28c016efbb869de1d55b0e3c2006f4a9e50b036aa6b469b87b8c90e822b331c0455bc6e910f258e6c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c7d426bb4f8f1652b8c4bc6cd135359

SHA1
41f81ab880209b4d84111e4393e678c6ee7f0c59

SHA256
0f38c005302bb68ff6f9daafd3d911da57c480ba63c852d7dc3ab52230bff4a7

SHA512
41e8d4b3c8bd8e482196ddb6c0871c261443e3c758c80fba0aefda0787216852d72e138f03dff0f2b2f9a7c910e1d0fdcf18d20175ede684103c5eb8a3be27d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acb6b2ae0c9d6e37c6c0f7624a1feb73

SHA1
753dfcfe214dc159e81cc82bfdd3d04d8eaeb1e9

SHA256
6b57f9c029eb1f31df4a10d15aedfc041ea75065302cd19f29632a455ec6b973

SHA512
8afbc010355681fee558f10f8ed08980b1f016cf2a9f4a92d140adc6778035736c98f3f0e36ebb50f5deb996dff18d4034f65677b412e5dad179ccb081dbfea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6IJYZ6B5\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B0F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FB6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit