62c1bbff01e667186fbcb6ad3d8080d77e5a99b3d4a5a94103ec4385b6a288b0

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5129afb64de9f1f4f5cf0fae5ce4300a.html
Size

44KB
MD5

5129afb64de9f1f4f5cf0fae5ce4300a
SHA1

8f25719abe6e3fef1561688a6aef743b5e5afc92
SHA256

62c1bbff01e667186fbcb6ad3d8080d77e5a99b3d4a5a94103ec4385b6a288b0
SHA512

4096b2d68e9b0f5abecab185c5eabfab8bf748fa02fa8196151f79c0dd272c817cd3a1049173145b4394bd928e380d9710f00e2b104dbf7bb2201faecef49657
SSDEEP

768:W0zAVSnSWNEarLK7jikuv7r8HwOYl4F9/Xl5FF2jTpZh/:W0zhLK7jikuv7r8QOYCF9t5FF2jTpv/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009f5b5212b99dc86c83daa133fb57135f31fb4774139c9347746b69d89ffe4049000000000e80000000020000200000005885c55cdffae6a7520a575140a697eb01132b29e042248d15b04d829bc8dce920000000190d8aa8078e6dd5089287ef22a07e041fbb593a32e2b87686faf9bc744b815140000000c4e2a48526c6c42147e432ec5478a42aaeecfb3710149fa95b2be1837d900bf8e38cd0d7b3cd74c84d4ab8e1114f9238a7247a33c5dad80eab55f4ca2752b529	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b1351cea43da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002f207bc44f0a5355015df066cb43ffc8b68876cb3dfd6add993953ff05604438000000000e8000000002000020000000588a7692161d4c9244984365d92e8137f5aef037fa78ad17acfe2fb314a69b3590000000a08dfe4ce3ab0c6a4d2b13507a2fec2f1d96fffae1712b0649dd4e860fccff0150f99eef5e1a9ab6cf0f221722d51ff9aa5f8f5d7c848c8de63bd6930e023feee1c43e4c6e3251d585371716ccfcd5199b7cf8eb1ad0c1325ed87340ab247b763d8097663e1b9cda9ca484a7232f309e8819fd55270a43d24ba38d7eefb5a1bfb936acce01e86ab4a5d0bbe4981df5d140000000205f72822bb782aba4d23766619a7bbab70aac33e950c4ac688ba1ab332e8433092d4680970f4ed7151f3e06186cb599d6078cfda6ad7d34347110a5ef7b34df	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411069419"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{424B5AE1-AFDD-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5129afb64de9f1f4f5cf0fae5ce4300a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9abccb669092048794e059f0cb3c297f

SHA1
b27cc48a4a3e63e0a18640a381fbf63c445495a4

SHA256
ea77439e9d310540a73cc76391317e00862c4107e3ef5a0d67ca55efdbd270fb

SHA512
3897e61557d12d01c26e291131e9431922cecb2ec60b33581ed46e933fd9926123e4de9eb5b404ef8328bef3de4753b0cd0dd9f3bd47b7ba67c5136d5184f4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a37d42db00a4d11dafd4cbb9d195f4e

SHA1
2169b9ec51ca00955aec64375f32ce862d997b9c

SHA256
50da3582478964dc1d1420e50fe9dc922f0767106fc7f567ba700d406860b205

SHA512
4c4157ade44ba41aea50d7a07817464f8999a4b076f30aea72e8d4a2e1636a2617352d7ab0fae4dc25d1bca23eaa2f48a3dc60a29ef2f05ba481cb1783203f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10e076aa98906fab76f23ce6f94d6294

SHA1
8f75a8ee7ba09c1a4d6e6fda2ea4d6a2f4d686f7

SHA256
8648856566dc1465993b21325812fbfed6850b83198f027a11c4fb4f177a3d28

SHA512
dbb11dc664efba677ada2c9fca8690b0adfb869dec75ef1803b0a3f8250d1ae702270981ae0bca381fcc1c4f359d8ab5e491ef1df67f596a1bab153786013441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be34fef5efbacdec9c46700c25611b13

SHA1
95dc3c7543460fcde7991f42cdf9b334f7bf0cce

SHA256
160ce25536a8e2961cb9f35ec8cd3e63de3abc1bf97740619f4b8cc215393edf

SHA512
5ad130e4cc9328a14a7f2617466ef8015165da63cb953ef12d3b35d6c48c6541e350131a3c6e743d217620c892579a0fe9bc8c75140ff638e137e6571c85bcc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d136020cbc70d5863b3b2c3b5878d27a

SHA1
aff255f4d260ebc4068509b56aec0cc7e1d0dc8a

SHA256
ff5cb6f439a580324574f840897fb197af0c18f8ccd26a65d91d84821ea34346

SHA512
5284532d8ba8916ec609f6e36fc5eec986421230cca6aea9a5b6047978e71ba67dc54a9b119872891a53321787174a793ccb401dc4569ad093ac8fceb39834a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1973f80c5706896ec45581c963e96fd

SHA1
b83bc2af39abfbfa3caae632f315cdd28c7d256a

SHA256
bd38b2bfb2eb0b094c035e9c7aa48613582f570e10da8963d857fc60f42de536

SHA512
4fb1a1c4c5546783512ccffc9481472db2826cf7c78f951d21f0f296f92c08ad816e0898fa919151d28bd1e6943a703ce898ed73d036f92753c11cfff9b76875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd0d9d815281aeabbfb8bea21cd41792

SHA1
db94c00854f4057b838b5fbd99aadf43659ef2ed

SHA256
383e278a33a81525c88061a9e7755db412d80da842058072961574047f34e2bc

SHA512
a43a4b276264a3ff0ce96e5f8ee4f95e645f3547c17924a930ebe07ebc71128991409037612e998217858fda7cb0179c700fd4786c2d2a6cded846e0a5947282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2ea1421621be6a350090cd751d41860

SHA1
ec59485701612015fb2734b3276f168c63cc62fd

SHA256
4d5e863c94cacd976d543a4c3fc7327a1241a0760deb1235fadca83cb6f09d0a

SHA512
bbcd32d5b3efc4ae24a6c5485f3dae070cc50603f863e2f4ed2f011b27319209e087285150a37682e660c0cfd523d2a91248606769d46f23555c45a8568eed57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba69096c5bae11b4f7f2cd81b478bd8c

SHA1
c23a3cd3b88bb5bb8389f1d01fa93e276e387f41

SHA256
611dba2e479ab5532592a96077e0572a80077621db13fe151f5e8b1b0725b16b

SHA512
1a4d60e84d59bf6bb7b43c57bd4b00b72fdfc2fb45f9e825a69a3173b91538f2bd4406d5dc158aa01a9002ed0c3ce0a24d46c1aa157616fa49d68099b6fc7208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\cb=gapi[2].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\dnserrordiagoff[1]

Filesize
1KB

MD5
47f581b112d58eda23ea8b2e08cf0ff0

SHA1
6ec1df5eaec1439573aef0fb96dabfc953305e5b

SHA256
b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928

SHA512
187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA91D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9FA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit