a89e8ae290c0428222a76bd780cf848572796bcb22f30fd76f43e1eddc26ef1a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48441c6c81c58c658863dab03cf0c3ba.html
Size

39KB
MD5

48441c6c81c58c658863dab03cf0c3ba
SHA1

8b4a9ae99e69c499cfad159785a38e6d900a82ad
SHA256

a89e8ae290c0428222a76bd780cf848572796bcb22f30fd76f43e1eddc26ef1a
SHA512

bb2f86660dcb90d01b1d7d3b2d26549d86d786728cc2fe03270cf0f38952985ee55cda9409044660c3d6ac76779df859874495fda7785c85be532548cdc044e2
SSDEEP

384:lcS2uIE0oq0M6od/jIB0YckSosZh5Cxo1Vgt1ZgpgxgpgJTnY6Gms1srsGDADfGp:v2un0oq0M6oVjIet5K1kcmc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46C247A1-AD26-11EE-9A90-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410770909"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1564	iexplore.exe
1564	iexplore.exe
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1608	1564	iexplore.exe	28
PID 1564 wrote to memory of 1608	1564	iexplore.exe	28
PID 1564 wrote to memory of 1608	1564	iexplore.exe	28
PID 1564 wrote to memory of 1608	1564	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48441c6c81c58c658863dab03cf0c3ba.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
c8f1a06ef93ff432bd93ed614f22c631

SHA1
862b0cdd63f2461a6d9ab05f19cd981d3fe4ee4f

SHA256
da67faf2bf40005ba4217341b003c23525c7119609d3ccd5d48107c751b387e5

SHA512
13ed00a11d824366142fa3be0bf6c7c65395a713f122d6619c6680521a7a76faa8f73b78f2eea0abf583fff5dd6c6efa4050ad85390c1499d4d599784d13f98c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
79b4f84775ed8118ae705dbb519d41b1

SHA1
2bd7e28d776cf9d3e75b090a61d0c013b39a3cb5

SHA256
d370fe3525180d918713ec40ff2208f506552b3711f1c633132aae20d46423c0

SHA512
4613965a94ccf907ff2641288e9a5bab8515ebe32beefdbdbf596d676ee8978580fa0cbe3845a54563c1df1548d9ac64b4218c5fee0f4e083ba2df12a19af0d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6670ea3f11c40853cdac06df2a06bc5

SHA1
3b06a9488ce7114adfe9cf24161c6e449da5dc1b

SHA256
96a4a1449a05e32dcbe24ee687866732e17521573784f4a26fa69f97ddb0cb9d

SHA512
ff7bf2dbbb2d1f95478c6b588d12ccb6982fd760de938d1d16c9709327b55f3bb38b6a23eaf80ecf8a9a320f8a705fb67f0b6fd953ddf3e990914dceb69d399a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493a2990b79a5e5ff8e8a0ddbe9ef3d3

SHA1
6b4f63f6995a979e79ad8fe412c3c647bde9d2aa

SHA256
5b8fd2b503394d07c200ddc0988465dd2a90095256ff5f70bc05953f9ed6eb1f

SHA512
5694fc1581783f88d13e8b035fe38bb9b65ebeee5d5dadfc5038edfccd1f789f541fd8474fa25176dfa5da475873a7e0cbb1dcd4e848301b1453bd56ebd0c8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b8b8059bb21a30e6a5b2081d370b3ae

SHA1
dd1c1a590a5f0152d839d519d7c63ccfae75c1cd

SHA256
178ac61aea6f4f0d2fabdc799f9781417ae8ce0854321cc2556e06bc5ef4df0f

SHA512
343a1aaaac3fc1cf969cb32a8c589e163e4deed991f7734e944e7a020f843fab3e12045e1747343ba762cdf7b07e345fcf5b9964350b4b8b3f1b7749c1d873c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8e21de4aae4cfe27370dbb05105f5e

SHA1
3f135a72c665e70eba4de4f6b2f50eb35951fa86

SHA256
96f4b450b477e4e94ed3f23384fb3f4e3845220e3e1ec487ce68de77771bb5f4

SHA512
da1a57940b42308c739c1b507c3de805a2415bf5464e4cfdff6b3c501838ca1ac7ec47780e64abbd0e0d08235b1d7491a9f8630337f1a9b0e325601c031645d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
806bee2d40c89ff0570f17e83dec9197

SHA1
428ea597e56f10987330dda0297e16f2e40ffbb1

SHA256
748c1f85a5dbc23b1615d9a3451e6ec5bcb31596195568c21de5997427f57681

SHA512
ca7c73156aae9c588d84e06845ecb4a82a357b350ef3ba72d21ae423b39d57ebc7748b9c821e2144064802a49c2ec7c5382932f4aa21fae33fed715ef76befab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614784db55b1ad641a822502a1a5f8be

SHA1
ffd4f097091b5d626660fb4d51b590a8e79af220

SHA256
ee71f1bba42724aae60fabf29be50dc771fbef60dcf58ee38015ccdd4c5bbb4e

SHA512
f9c08927cd44feca862722eb526984b4004a8697f15f9418af9a5a67806dbca7286372612c3a40f274788fa44917f87e51616ec8a800314ffb702e4bd597a39e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b44180f4cceacf79eecf4a6eb4435e

SHA1
c3194ade08bb9fa39dc46f54dc74a861abf00398

SHA256
f62f131a260f97473a86faaf0feb7deaf1023c67e75133e39c56707785ca117d

SHA512
aeb986d1bba13961a48785b70a54a1a8f49ff2ca7f0b16a3cc83b5deb94ad49d479695b92b413a9aff2ee77dc0a845bd03748e4e9c95abcaf01cf0da24febda6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c226f92d1e2aadca722ad7fc7f269c75

SHA1
e7ed68483116049a5a440218ed7a0a9263b0d41d

SHA256
4f3851bb41b8dc94e6786e8c5c7cd3f513d9ec7235b72695f821185a46cfab9d

SHA512
2fec9ade6ddf837d83d73d156903203c6a65611dd142ba56611a23e3c5d79a7d2c589192947b087e52d68dba30c83974af70c5decdc1ea5cdd7650132be15d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e86f6644f0c0b707b906a3867479039

SHA1
df4c5dc9439c56aaa1e49f6ba810c7754cc222f6

SHA256
43c52a09f57645b15ca73de5e395dbbd2266df1f5f183a0ae172434fd651709b

SHA512
25abda9258b29a9ed07eb17eab568bb369261f74a098f9bba551b98c118849f3849323a1fe22dc94d29f564598faa759459ab8d7db63d5320f9124f7af6c2046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe3df1b273ad072183ff52205c89984f

SHA1
603d99739f347705f35824e48baf68559b1cd1f1

SHA256
fc75d48219b6ce751cb66be41d7543f4d911af91363042687202d02046c54240

SHA512
668ccd3766e29f8f77c5a3dd6d8f91b073e1dfb0f686b74b733b8129cff25d115dc6801a8063ca827c1ce1700208147ccfc3f55cef1928909e748a37a030756b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6IJYZ6B5\css[1].css

Filesize
193B

MD5
b75ed4dae05585ba67202693c6fbd664

SHA1
a694bb55505d19cb8de8cebe28e13359b134589b

SHA256
84a76a530b6cc677e70b81c0f227a3285a22d863bf05ab5256ad3a63fae687f4

SHA512
ed16331a06502c02fbf2befec07d7d8b605202cacffb89dc2eb46db3cd8c56c0e162890e212910eac0cfa06ec4da4794f594c1d15e83348a5730a444bab14ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6IJYZ6B5\css[2].css

Filesize
243B

MD5
6daf2bf9de882caa6bb24104b5ffa025

SHA1
7f20892a8d0edafbbf2d65d9c0413207fcdcd260

SHA256
90fec720d4b316104eff8ff065ca63ca03fdca3b14404ad476d3adf1109418ba

SHA512
e9a2add09d394b7e3f0ed0069ba98999e77b426700c9bea1de91d4481f6fb16be983696f57171a045b77c1a355914f19d73b5d9b6c4fc8af5c5ec3fd2373359f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIEDGG3E\coinhive.min[1].js

Filesize
1KB

MD5
2ec43720699ba70c89f5adf211fc3138

SHA1
798ef9a5855d7f56b51825856cd84ce0356cff0d

SHA256
39f7a131d7976b1cbbf08c89727ba5c1b5c384152ed65bc83198bca315be5a88

SHA512
ef8f3d359eecc4e4234e18ae38a5c2e908bf352ccbe518d35cf956d8bf38b699724ef3d673c984625c2b725640e5d3bda45e363cfddcebaec2102aad7a34c0bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\css[1].css

Filesize
614B

MD5
d0a03545fe8b82cac8acf274e4b523ab

SHA1
a391e86a8c5078c8ce28f3c05c7000184e7644b0

SHA256
92bc9b99cab2d5b7a91c1de89e52391f4a829bfb7eac23a1635ab9ef477e89d1

SHA512
3944b56df855003cb645a4f02ed2decedb14c0a2cb919e74cc791d8b9eeccae9ecb76d3871a292b53096c771222e6a648beae40951ae854d0742da97b8e3abdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\css[1].css

Filesize
193B

MD5
dfe56e7c870555f05dc1d661b93b34f3

SHA1
9d4d55cfd1348e7503f0af6dc0514db76898637e

SHA256
fc8b8a9ca2de15bffbb3976bcd0490f72d4e6e5653e53ba7db45e5175b99c4af

SHA512
3d1f0285b8defb1b7be01c4cb2899aa51c4130e70ef274f52dac6b8e897c568a640e2846cdf7d02caa0f4e4edf926c12fd1d897890daba15cfc25db0397bbd18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\css[2].css

Filesize
486B

MD5
03c9ffccd3d53075868d4ba84f155c06

SHA1
192ae6bc75d0fc591bbb94d23773416d7f0fd03d

SHA256
27291c4a3a36c0ede12d17f5cd1c187dcd0c40ec60d8646fe0c0161945a39abc

SHA512
8a334c94b565989b8d1b71f2b2e4592bcee2187267c4fb3b0ef91fff654e89a5bf8853fc28750df9b9a7e6120cc16371c223255742fb4a9474d71dc77564bfc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D7F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DE0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit