5513e198236565648b7b06577792c883075dbb50b293ba3da9282325fdaf294f

Analysis

max time kernel
136s
max time network
165s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47a7ebbd8ec45b2dbc6f74bb9ccc2797.html
Size

63KB
MD5

47a7ebbd8ec45b2dbc6f74bb9ccc2797
SHA1

23219b1cefa34ea047b9141be1e38806751766e4
SHA256

5513e198236565648b7b06577792c883075dbb50b293ba3da9282325fdaf294f
SHA512

3b42a1e11cc20a8f4c4571b3568eee503657bd6956e00e8ac8aefcf23aee0b3f21592ca586520d7c2feb3232b02f3038426268a918a1f161a8451ed3a0172109
SSDEEP

1536:pxA02i/juqQhtmdCcJOvlanwQWXGdXb5ZEbIFe6WErUJ2Ewe70xJnonFnWn6nBmU:pxh2iKWCcJyg9W2dXb5ZEZ70xJoFW6B5

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a9541fb42bb356e0703fa90f0e5c8a89b0fd2aa5bca84edb0a76d9e2f9a1058f000000000e8000000002000020000000600492f8008cbf9c39bf10e3cc91f35095f1b5993e658842c5dfc53c3950c95e20000000342549575ceaffb9718a3165aa61f354c8bbd11d61b8618fc980d15598413174400000009028535af45b37f99bde972e48c0be7c3a21d18effcafc285cd4105e913692b03ccfd0f0da8bbe54931892dde624ad99662465243bf6fb55e10b517274ac3feb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006d8a70b607a74c847e8c3b1bc6683533836dc918d90cd02ad801cfc0738cdb72000000000e8000000002000020000000b0663137d1f7c2f34ea1dbb222904d548ecfa217b9a6a13e96eab1cc3ac59b9a90000000d8e249f156b49c41b1780e9c745746a0a1291a49d69e6f65e156c89a262ceffaff15c05c4e3bfd7bb9486ee02079da14367542906e630e55156901224a966d8604a9731e730c343ec3feb049e7fd23ff1aaa989f70e34a50907b20d3ca311b3d5e68b460ad1d90ac1cbaedfd1488796a1e227a541b6d5ed0f3a8471e1f5c26e0daa5e6f9ae953b0a4cc0d02320ec83d040000000b4e1327a10876c066020d6aabd1109ac2a41ae0f381fe8a4bc72257e0e1eb543fdccb2cd5ccdd9e0fab67b09eb63e369ad3042aefc918aa3c308798512834672	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410752212"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03f21920741da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B52EF8E1-ACFA-11EE-A3E1-DECE4B73D784} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2124	2068	iexplore.exe	28
PID 2068 wrote to memory of 2124	2068	iexplore.exe	28
PID 2068 wrote to memory of 2124	2068	iexplore.exe	28
PID 2068 wrote to memory of 2124	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47a7ebbd8ec45b2dbc6f74bb9ccc2797.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9706299224561ff665abb3a51a22f734

SHA1
cfda234c62d476c418144e0cafb67a52bfe7b453

SHA256
e538d225f8eab2a8df83b48ff75c92d52c5d16ff82fbfe257a10c6350bb018e1

SHA512
262be5e5e047a7945cf1925163f29142b8be32764bd395c7e9c46ebefa833de551dee6acfa0b72d57b9f0d1143d495557ea5236423391f851747100b4fa56770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd91d8b91df0821b958095f3cbca8da3

SHA1
0981d863c8bf3970edeb8974402ee9884d99bef0

SHA256
f55ec240799216a6d738a89937bbbb9969b070c35a903181d4c7a4749953ea1b

SHA512
2ed83b6aa2ce28b187b819007f7a4c062d134bc12f65ae42ff9d11e7bb55b4ed39653cabbbe16724f9a42c080b61a760c029cb1f8f5465f6b3de14f38edf4726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e078762c47133a7274f699a87db4d196

SHA1
5315d588f92ea3d8c70555dad9d1d45f08403031

SHA256
cc66a8e816c7c9157bbce48d9f7d0099352da7ff94798a701106d64b7604cf31

SHA512
547a7ce288b720eaabfc3a1201ac6fdf7a8ed2349e15c04132802dfba884d1f1f8d4b46432bd03203fca3790226dc61033afb51029c0c73491e012916a272430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
645a97ae2f42d10cbbbcb54427eee689

SHA1
e58782fd023e04f61d6afc473f10ce92a77c17b0

SHA256
61744b272525a6a6797c918339b34c5eb1c94e6d73490aca5ab4b553bda12e95

SHA512
ff4cc2d35958047d4ef1471477f88ade0e25476627c8fa764cf746105c6d67839ec998a023858115d64449029211946dbab1886af2da0ea17852cd7053e1c9ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b770979bd38e5803e6bdb57d3b1024cd

SHA1
e75ff3ad9b0eacba4b837a657247ea1f7a9bfc3e

SHA256
45e5355421496d6c19f658e625245ac3cc6c43ddea016dedeb75507872896f42

SHA512
128759ab170f30d96808601c81eeee9951fd9d11b52b5d2e938ea5db4bbc1b7c578c75424a2dd879c646b639bc47030e7ac34ab21adcfe907b9fd10d479dcd7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cae27fc604179b9a533356726b74244

SHA1
9690425dedf8e4315bb7c36cba89e6ac912654fc

SHA256
c3462061e4de803a369d3837564bdedd7c316e0f1d3b738737ac9bf0b06551ee

SHA512
c202e21dcf336c375774fd57aaed19bfa87907447f8fa22d9041f41fbfa73a628faab6d9ae220964650b9156173acfa8708b128ecff4aa07f1048337ec08a8dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14c681531424787a4ed14fdd58ace6d2

SHA1
8c13b7ee58efdda8c48b7513b47ea080bfa1c55e

SHA256
7ac1023b77da5426c71da3f20a698085c70ed10569831e6ee44bc5084ae1bcb3

SHA512
ab43988f7b25498f760ef30734ad10b4dc0ff543e3f7128c86e701a2deca51e26033198735753de4cc96b2c5d4a2113e7f06800c23443184026aa20279aeb17a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed7b4b83725ed0ac2348430c820acad1

SHA1
7247c146a4621bc1715e94d7acb83db0bdb0e6cf

SHA256
d6533357a2081c65a603dd1600394d54de7a6b66bd682fe56b124c419948a27c

SHA512
b480041133642b71622b5a6430bffc4182cc6dc0c51a6e8dbc6aca5eb1c3a9dfadc4f4c6045723ed78ff48a2bd2d10f96d307c01eaa0e97681bb48624cf5dcaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89cd6f9fe85bb7cf84beb7005ff13acc

SHA1
b3ee9b3c6c61d269135eec54f66ce153a17fc8b3

SHA256
f70b9fd9e54e577d304f029b17829eb045d821a40839ace5932920f34ab592d4

SHA512
172ee70cf309e170b60525a65995e3ea6e5e2b74c58d87b9dd61976db299271fc48eccdeafe0e2e367623eb09c74ee74a96ae23ab243c15200a2931050bb36a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82b902d83b0e7ba491e66f59c8ce5d78

SHA1
e2813727967d228a5c09447b269b98df8a324cea

SHA256
4af72b76a62c9c6f77e7559707343295ac0944af2445e162b3141307746059d0

SHA512
708b528a4b15e426d05d456df630cb1766854bfde8ce173aea030ffb4d3897059542969dfe365681aa496c92d9f78717ff0d96c5c53a4e17f34b5331ec16c930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9ed1f4a3c3a66b8c00491883dd8f7d2

SHA1
578ac0c4ff364242b6d97fb60a901363df362b52

SHA256
e575225c15b49e91f4d6c2df92ad313e0fcc9d1e6ad029b6e67e607ad8d8548f

SHA512
bd55d29930a9d450bc46dddddf50940486434507c3d976b60c4c436fd0aaed6c4fd87b922c201f066511c68730f9078b4bb08ffb5b571b6be9b867e48adf5734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4947b2a56e2c4f267b9004d0e7e9fd14

SHA1
31f52aca7912765e079a749308d5a84ada29ef38

SHA256
1bb7132b6c1b53cd3949f803d6d02105896f43f595e48cef848c56eef39093d4

SHA512
862db971f7ab8e80b9cb0c76c8a89713e458dc2dbc2fabf0fa5e5766a95fc1f871c0c1b42c4a49e86a7bc99e296e8e26ea927afdccd74c2a24b89326c89204b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
929fe49abe5090d4f8fce1a978316446

SHA1
980e56e923f4f7204a2285b3d9359f96c42f7e4f

SHA256
49ba9c0c246433a8d6e4da60ecc2129ad30a67937d86a2dc0aa07abde4a4ec5f

SHA512
8526e6e7ab5ec8cd239cd9a8a6ea626e8ee5745074ee0b57e727b48b56290a52195f27c1e2e923e213bfe3f6902eec94183974fd42d78f0b3d6489c055ec99d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\478691279-postmessagerelay[1].js

Filesize
12KB

MD5
92169c8a0fbf6e404267d0705cdbdf42

SHA1
a5cd88b74ca5ced239cdbfb458fe25540d671f46

SHA256
dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384

SHA512
8c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\rpc_shindig_random[1].js

Filesize
17KB

MD5
f019fdda31635d2a31b151ad8ad56c7a

SHA1
6adcbec55f66ffaef83d9a134423aa98eb2a2189

SHA256
c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831

SHA512
fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4D1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit