0a026b47cb02cd3b8903e3de451f3bb7a6fcefc913a492b4a4e146f172fa1be2

Analysis

max time kernel
130s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48212e19c0df5ccb0e4a528d460b745c.html
Size

3.5MB
MD5

48212e19c0df5ccb0e4a528d460b745c
SHA1

40bc6c6d79906398c5d69880630959586975d54e
SHA256

0a026b47cb02cd3b8903e3de451f3bb7a6fcefc913a492b4a4e146f172fa1be2
SHA512

2d3674afe1456a12f7d9812e9c51b81ad1000195eb74e442c131f554bc7b312d7216b8544ceaca093628aae5c46cfbf5eede0d63e70c5b29f7ef06664e48245b
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NfX:ovpjte4tT6NX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{130285B1-AD1C-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ecfef62841da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bce380c11640f89bc160fcd798c3e054f9903009ab0d86ff275bbb3782d3fb9a000000000e8000000002000020000000f00ee6082c9c23246d65504f47524824b4cdb71f7176cc9984a372978d4a861690000000ef6b85a6edb998887a4e2d93cc3a1afc704a3ff470e6561daf0fcb88d894ae155dc2e6a820105cc0112979483241c276c498177343c4c4d216fd7f1908b5b564470f637c3da1486116d00a9656e7f98177818fe228a00830467fe30454b2f8e630f9c911119f733f7a5edeff6fe1fd8d9275b5499b6760102d61cf245a702d2936f4e60c58698f2ae50bc91d73d977744000000021485e7268d44383d0bf146218710236232be46e80182d63fdba17a73de2a5568ae21b22d52c84ac2b7be74c8d5b5849d58e84f53f847fc40be8216d0e0f0c60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000062aed3ac44bccac42beb5284ec8ccad752b88376fbf950afad601a99fcec0b7a000000000e8000000002000020000000c4a3a466f63c89887e82aaf247dc3b55a8b0a88a344153387720fe974fcdc10820000000a941eb7b40f0b58a39b7c0766f00c1db2c3cbf79f3f83554c692ce667220eea240000000318f5e9d88d31d51f51f2382909ea14aabf30163a42c47def6727368c41f017135c376481210c630197ba823ee856cfd70c1acbc3a3dbac01a68770650351a77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410766535"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1608	3000	iexplore.exe	28
PID 3000 wrote to memory of 1608	3000	iexplore.exe	28
PID 3000 wrote to memory of 1608	3000	iexplore.exe	28
PID 3000 wrote to memory of 1608	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48212e19c0df5ccb0e4a528d460b745c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b23867027c1bb3a1436930261031cd9

SHA1
a162cf7ca987d0d8566c3ed7658323bc830b3c6e

SHA256
988fcfcea7ef64643f84cbac4a1037f783e17ddcf946dd3f71f311e113c24135

SHA512
aa7df5aa9a30f21e8c87177fa4e117caea0f21dba7117afbc7b03dbc09e4674c93c20dd4e2185c86a988abcef09d2ae9207ee1d70355b653b8d0cf156a4df0cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d86a032a98d21541ad6bfb7371a47fd2

SHA1
d5da3c3714836261f3778bc47c34902523029502

SHA256
56ed2f46e00a0f64289867c949e664b1455e2b027062a6c85172cd0a70e12c99

SHA512
bd44cedd8e8e562fbb5299dab228368ed5c939cefd6f81e08aab7faeaf7d21c53be185750238e05cef54f2a2136fa4f05d36db97852e2e71f883c0a78bf43f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b40aefbd34b511e826d4ba8556ad76b2

SHA1
f20c007793f33b2ce46aef64736f1b4583732d23

SHA256
34462c14c6e0acdbc50b9469c78f90bc382394c579a327980c445d000aa9a25b

SHA512
792d5e499377c8e518e3008aae5a013a3e3cc135c5404d82b7bd71b5dfbdb2b3e416cafa12d1dea6073e76c4757841b6ef1fb29bd64460a31c65e4c7c56771f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f14a61ff8feb1266a475110d45c5db4

SHA1
84abb9b7054c55121230cf29b310ecda28a77d56

SHA256
62ea72b2c7de5cf27323f0fa4f9e0424db8dc37d5bb7a9d9d65c7eaac947f7e8

SHA512
2046b9b56fdad003e8df80a98a394816eea028f3349c25608c30c58de2f6ffc3f9c82ed3458bbf5f6c391ad9772e4c471efbbc63ab456c94c426680360c80c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2bff5b8d29961aa1864555cbefa3021

SHA1
77c22800d320aa1062f0a5d1949da6aa1707e652

SHA256
7f6ea63466adaded448411022c50048de2e2c10404f56fbb9b9a036ee57c7655

SHA512
7f8cd7fb9a09a00d013f8b9377cf5e0eb49643dece23bc9d4349867edb2851e3b69cb252d10886183174b0c7fc8587883fd6fe2ffd8844bb97e1269323b98b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe6b8dcdea175a8fe1fc1dd33cf07437

SHA1
e9780a9c2cad20f881ad4afdbc657f98e725ba52

SHA256
a191d2135d2cbc0a106093bd6cd8455aa502f31fbe30a49835e1f3d51a930c88

SHA512
e011f64d73969ab1d2defa96268542c1f745b33133dbc3c6b5c8edea543c915353a8d605baf64c61dcf457cf26657be6d399a5fc031c111e8ad1d6d8c7a426a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fba4744a81c5028d139a81ea608e22fe

SHA1
b8378c2838c442783d2c1875934707d59d66c76c

SHA256
f3bd5dd9ccb51af011193c7563f0f3879f01bcc8d915051a7fbaafdf9d7b5735

SHA512
3501c8e71fc63da1a77a84d6b6fd34b13be6ed509fa9ad91534ebbb3a05d33952693e6d1c6bb0cf132900f598458c6b6dc94ebff5c424c52432bf91fd8b3a2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dab134bec85fb8872e2414ea1eb4b42a

SHA1
578f133edf9cc3696e8d7a858b2588de00b4ce86

SHA256
14be8fa80d3a44c37e2d3bcd9325f077ba5bc0584dc350881b1a54417d5dc4e8

SHA512
962aaf08c67fb7588e8808eaf29f275d955ead6ed59a14d5cd977fe4258016698e1e500d76f8f527ef7ec3a8c2a07906d4ce9697cadabe188620c1258c69d5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3979505e883308a9fae7ee0e5369063c

SHA1
975c3eb19363591582c3230aa76df65c3856489a

SHA256
bcd5392339bf67525e25a89aad772f403fbf39124337cac42e4cec31b2348b1b

SHA512
737e5efb8fccc5449fb0a556d691fc3102b61328504af00718e083fbc2189500405829a2cdd403570daec0ecfdeb5b5044a99750931edec1f3f2d801458f6fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fbce4ade6dc8badc4325d17a75cf8dd

SHA1
63cbe24f24edc6ea5e4b5aa25ddcbf8ca435d98a

SHA256
dd053566dab766ae6057342d187db8faace8c2e899ffd87dc08e5262f407099c

SHA512
768eccfa5419bbbdfa429ff4c2c6375d271df8ab9666b90f7a99359f75f31854443bda0a3a277815c9703d02b5d7a0b75f8f935e3eef1ebd3dc0558ecfacea46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7e51feade4682604f8f2529dbe9527f

SHA1
6af125ab0efa8fbe426c72f6db261a9b7ba60d2e

SHA256
65135b7d34fe49ec76d3b9e97a5e71486eb72ecf91b06032fcabbcb96de8eb56

SHA512
4cc6ed464e1b9d85b17fb5ea110f7f716c9066ef0d8f840db1dbd7f05d56f7031e2ef06604c4d8fd7fa4c6e4ca3e992c0857cab01fe56d12fdd8e9cb666a0a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10114eca5e6e4315f2bd0f57a8b0f5ae

SHA1
18ef53269ff8e55c41b511db0d80924f91e64769

SHA256
c3bf0f49f6de8469c474566edbcd018969750049565791220a572c13917e3a16

SHA512
ffd758894538d403dcb9cdc50b794944b9d9026843b7f763129cd3be8c625c78a5cc53f7010fd7300b61461ec4f278f63dd92fae088ce798b1c79d2466c8abcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b95c2dbcd06c61ef47c5ded3d9ca9ba

SHA1
02a485e972cbfda46556f560215ff4ad06c9c952

SHA256
b676d1639bf8ba4494062b956039653136eff7f6b55530b6316346d42c173d67

SHA512
bd091c1f9f98a06bf9536a28d34a8bc5db76ed2de21bb0443319cee7bad9d367c1aca41235c4069e0768338fb453c67676ec656da148acd3de0adfc06cd34fb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3ec8fc012717a5eae2480d3432834e9

SHA1
91d1664b85ba249a3ac856f61ccdc895b5c7e17f

SHA256
ecea7e8806c59e63dae83b682e39551ab79aba5cf7ea489e8cc03ff94f1e853f

SHA512
b9e55b172b5bacb5776002f48c94ff9968ab24bc9714bf8e22027039327c10d80a9682dc21eca448f06b2d474f597cf6674468eba236dd4073b69c0055019fc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DE9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CBA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit