06c219a47a68e43f20e26fbd96948e64c7dac9c3021b0a9c6337b5cbd1eca002

Analysis

max time kernel
120s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f430b463f2b241def4484ae209b84b1.html
Size

185KB
MD5

4f430b463f2b241def4484ae209b84b1
SHA1

d530359347a5013604af851547b9ca85ceba2e4c
SHA256

06c219a47a68e43f20e26fbd96948e64c7dac9c3021b0a9c6337b5cbd1eca002
SHA512

c258decaeae9637363306686f39a4c0ae7ebc1d37056bf9c4f41805bbc07f301e66ad417bb93709d4ecc36d7a8f212aaced0a9974e6066cf662dbc0643e75777
SSDEEP

3072:BrIFlGeC/ToXqbIrqbI5rU13G4k5QhLpOatVpOp/7fpBY9s9rNd3l:BANCVIIIA3G4k5QhL8atVkF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000311b813ac48f59a419ac1d68240047ec2733373c56b8e6ca1bf03c559ac29291000000000e8000000002000020000000d9283b07a7648d92e7db72ad5b85f66e9e4906e51504c56e7d53483d3cc9cf7990000000627f935a2b3fab55bb9cbca2fb7036c394121dbca100e88945baee1aebfac9c5acfa634c9f5595307fe6ef97716858538f4848aaecab5240e0aa3fc6bc40695a2e959b8498ac6b13c12d93ebc7ec8d238edc2489f81eebd5a801086c09001e8a3c796dc0d2e6bfea21cfc25b450cc28db18a990d51da08315432ae6431acf2abb044799b0122ddf5a1ca56b80a3d9359400000004204f905883489438fdb6b2b934820fe2d78aa27a960e3ee72986187ba755326eb0c9cf45f2845afb9e0c0ff22040246e316078f48659c93464aacdf666dd8c1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03176566743da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000016661ffc451e40e064643793c5a8a8b7aa188a7d31e4f92695370982091c8042000000000e8000000002000020000000f926c015fbe7f3b706f1a6dff903d01dc478c33e5aca90a60dfe0f9cc1c954902000000086ed64d8503da63e703e723935aaa1c8a78abdc579d3f8ba64676cf445fd39fa400000003075bc9cbe3fde84ec4e85199b2874d1266f633f00dc2a5cbb21d84a66473e81bcb710805cc5093476e3ba7d9bf15970afc85ebdca500bfe5f96657115f43060	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411013239"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7BBDB621-AF5A-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1204	iexplore.exe
1204	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f430b463f2b241def4484ae209b84b1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
cc46f03dc7b4f4daaf89bdcc0579e2c0

SHA1
083735ddfc64d46db4d0eaf44d2957499d215382

SHA256
eef0ae984a4ede3f3d4dbdd4ac24c0e07effb5f0c9738b90065e96ca05f43003

SHA512
f2138fd3458293393da1c42a7b7fc5b60654471ed610ecaefec16c87427534f2aca0eb87631c9ca332e2531a1a2cb15600b67d756d0d4acac70a92ed8cf6ab1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67c1a856324641d7bf3adb9da491f56a

SHA1
d8f2311eed6ab024f574fd5d2e06e08d9561c372

SHA256
f57d7bc62787edde7e2ea7e481c19f24705fdddfb769cd4c5049a323691bc7d0

SHA512
cd5b8733b3246dbcd647d5776f9cf609b4394f27b0a3f06b5398ec5e642e41e88889c211415f1b6e29ba0372859f7a8575f2b4bdf226c775fda3661ed84b0161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7a2dc59457d58d0eed9b7e2330bd31f

SHA1
9df2442b61e0d1ebbeccd17e6341d968baa98b7a

SHA256
18654e2d588e029a879c16b97f425667c01471aaf2c9377a474df9879eae844e

SHA512
193b0ec7f61f5fe289a74485ba6cf24e51f670242993f00da9329c12547d1399c02fa65b3efb52c353dc038d0abe79dd9d796c92f48251aaeb8ba5a7af86864e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
416078ac7be1a6e894c0f621d05a105b

SHA1
9ce7ded1d1b03056e16c6df1da64f41f5390b598

SHA256
789169aaf6c6ed487a69e02f78b32beb2765aca804b4ea126e65b7b974484b5f

SHA512
a5dc7d62c7512ad5089a5bf79b2d25549d914daf829d78f0050587ab5e2bdef1467f96a4f8624d17c74843de90f5418a7d4dce78a663be2f9217e6e0d4e85a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ade24c697b42643c314cf6fe73f807c7

SHA1
aaa49cf44e2cedb998cf924fbfff58d3e4c48eab

SHA256
f94fdf81d687f9f002e02d6a153054a1e223bc614857fee1ae116418dc1166eb

SHA512
db48463f71af284040f1f23779b4351b0963ec32d735eca8ba408ac45bed7443a69278b6540b6ef0614d8b286d2594bacc780319bd646555138957a4ccaa6029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4905bada7a43bca7caba556e00c5cc18

SHA1
5ea4aa587a8da767a18195e5838752afe60bc086

SHA256
1bccbdebfbc5b4db2f5b305c5303aac2502343d322fa968c19fc7cddff15df6f

SHA512
a2e03a209264aa6b71f3ed4269b5a32ef7605a9621f69de4d4cfb20e2642b71294c29b440c0c5fd1a8ffeb8191e03e50a21c3bae77bd2fca24eceab0bbf408e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
026c8f1865e60580eeee0a8614fd7c59

SHA1
8360a35d8a61257ebc5ade6e05706ddc5af39a07

SHA256
1630073270358ab6c76d3a0f68fb7401b995452e5c292b5eb81ad6305005e7a6

SHA512
f89b3bcb361cc5e66e8c9929461847cd30a16b1c5db26dfc5a022f5303aceb8a45e3193a6a1e01bd197028e40c20e4b8f067dce211bf91111d73e4f4cf18b655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b75f611bfaf23a28f736f9f2e879fd4

SHA1
a1ddab78005351bd663a13d3e4c379bb1509d791

SHA256
383f05257fb5161f8d3c5dfae4da2617d1d699deecf575e8d3b1c08850e261f1

SHA512
215cb0a550c16dc2b74c86858a4f6b510fec9fc3a232f8bce7324c9e6b506cf9082b7591c1272d20500449aa2125f8b4db74dd723c88cad74174c493cb4982a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fea34d5795259da74096f0ed0ced833

SHA1
b25748dda57faa63fff63c0bf500ff42666fd134

SHA256
7c388fcdfbb05aab4471ae0bb09d15ae35edbb79e2063f1e4ea3727fb6c99dd6

SHA512
7d9b099f3c73ef21994d87928562f45eae7d8cd7b655d819149b1bbd38945d4da2e711fc191c42347c4e7863125daa289c72a6b0c4340fb8b20af41b6c2d9ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39c29202e2d9a0618430233bc2bfcdd0

SHA1
694dcbb53f2397d36183226b0d4aa381a3e4f0be

SHA256
bdb0b3c55bcff0f47065f47c449d3f39e509a5827c7485dbee9804a0ba1fa724

SHA512
d1edfba6a1e4cc82c86a0c1f950f3e5d815e2b792092144d58fa38d39e2a0b9312a7b8d11f2b40376de192febc5d5a31adee6f1c75bfb2ccbecabed8517ae20a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53379518e55d96e35e0bb78b4b37eb9

SHA1
9ee95d3c8a422485e42685b6dae192fc23301df2

SHA256
b605805d1ee9cd9122fe9f938b3af287b8fcb7a73ab19293ff1023251c1353a3

SHA512
7c9339302d76ea6dd8affc746fd01b42331bb6821f463760752c17be3b2b65ba00f2623185201b0d99978d94fb3627443ec8c88288de2327c2884a191b93b33f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c6d73fb94851ef9c856dfb04447705

SHA1
03978270f5bfbe8f25cc4142ed1b36b9afa12446

SHA256
9101546c66befaa621702290df92b2b738571ab52c6182086e1e10e2f0a08cd0

SHA512
cb1d56afadeca8b21dc2bbe675cd6b7c55848bcb26bd9184fbfdc8f052269ffd98a9a726e7bac6caa015d91676132a6ade96ee7f7ced5d87f244c1823046c277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c4ffdd1774660d2a5dcb86c2f75225

SHA1
3ab50900e6e7a4b8404ed94b10677ada276556f8

SHA256
8167d732fb6890b041837c58d2de4876335c2420237462f35ce75eb06087248c

SHA512
f5c304dce11013a8783916abc8f3fe2793fb51e87659e3d73d3f326493e8dc436e5ccfcdf727135ba1081a4306b732b14058d23812160bff145187c70a12b8df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17f535764a7c922a53bbccc5a5d0a852

SHA1
579f68ced479f53abc9aac595b674e7a2fca753e

SHA256
6381416266870740a8f5431fed45bd3e79f4278ee7e3d4493d7585aadf1a57b3

SHA512
b265c602eac9290997b95ed20f34c00f7f8d86efcb7700ff0fd93fb0c643f14c0ea0e140a14959207a42def22e293d03bc2730e92700af9bca5806b7a231af32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
688a731f12f3d23d67b774b196e61597

SHA1
3f11f730bc8af560cfaeca556e80931d1746533a

SHA256
8de62130748d85de7d3a17d9354dd4fb63264ee0ec33b009f0eefddeaddd849a

SHA512
66bf330287481c0be43004f87acc5d2e4e62343220310b3fa23c37ad615e7cbc58b8307575f4f303b9ff0c411e85a7de8210fb92debe5699b79ed7409feef332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\cb=gapi[2].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB9C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarABAE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit