33e057732e4a667e69a0d9274afe104b811a7aa6c308fcbfe460a7debee6d0ae

Analysis

max time kernel
162s
max time network
185s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52311e11cb034a530c6bb7b606d36bcf.html
Size

227KB
MD5

52311e11cb034a530c6bb7b606d36bcf
SHA1

a77d745ab0413052d2c9d88cd83be6ff74468ee6
SHA256

33e057732e4a667e69a0d9274afe104b811a7aa6c308fcbfe460a7debee6d0ae
SHA512

169761b546328fa48fd12805aedbc572d1f1c5fca71f1b7f36cb3006eb6b285e41e910e302acdb906026a40259ec8810de21d079103b1ea3dc248472e47634d0
SSDEEP

3072:ldDOBsBUZQPJussCfwkmGadePFYVXZD/xjpbF:lsBZQPJussCiePiT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201271622f44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411099131"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008b5dca88af9edb4be0ba96bde31524f8ea441fffe900dbdf4023b64d54f0ce26000000000e8000000002000020000000e9d8a4187c1a6a0f26fa2410023f2f296b6138bbdb4157871604e199eaaeac1090000000420e25d0803b96ffc6a937472796a8b95496425ae2b4c78208869101c91e753c5a7cfcaeb52f0501431714f0a81b86b2b7935794c08eb8f4aaaabbcd58494f9f262bc46f15008bcf901dbcd9a453782473139a2863bb63bedd9939e316430125dfb4fe29f7aaaa5c27daeca76878096471b1205e746d434cbccf4fa220a6ec52d5518cb808db6dde936f9a5c4de05f14400000008377d591a0005c0c88962dfe918dd7b17de87db48545c687deebd1663122804ddfd004f56272811de5bab5e5585620f47569746f2430d1e9622b3b4b61a64141	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74663501-B022-11EE-93E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000baac976ad5790c99861bac0512a7a87291b5ba05d15b6118e8488e28b98f0ef6000000000e8000000002000020000000da0eb4830279bed2b7bf0f2b4022030416e0571cd5796f970b732f35b8936eea2000000009594b8ab0d4230511f58823970c92b97afd568c8b3b5b949f812a2290a3b567400000007f7a919b2d8b84ae7f17aa1aca17d34fc2b60f7f658243f1305ad7f44ee3413d6773401411ed42348f8ec114425ab2b1c7edd1dcce08bcd39817b015cb198a6d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2120	2736	iexplore.exe	28
PID 2736 wrote to memory of 2120	2736	iexplore.exe	28
PID 2736 wrote to memory of 2120	2736	iexplore.exe	28
PID 2736 wrote to memory of 2120	2736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\52311e11cb034a530c6bb7b606d36bcf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
96b405d427fae93dfa3d415a18040508

SHA1
05a5a9bbdbc805bb1d493f3fb4f2d58b5f3bc417

SHA256
babe9ae8722a3b0832d8f2b2417f9c05885e7b4b8b5037b0c437a4e847b23110

SHA512
3c983248a01fa14265716093fe52d91866c91a353212d52c9cf529c46b27330cf8dda51ab56ecb65d962cb636383645e2a0ea872165e9f2277bef344d20383c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_C7CF4FA7BCF717E50C9341D69112D7D7

Filesize
472B

MD5
1c856b768f4a845324323d27bce5920a

SHA1
deb13958e0fc7d000ccc8df9d1549baa9788dd7c

SHA256
fc1b54a6cca6610ae0ff8f4c01f9e3d3ea8f878b1a312777987182e54c081701

SHA512
eccd4c2167362b34fab4370e9b1b273150cc1a7d3ffaba06cd36ea28e66b077adf92d86dc4dfd3371b6687121666d23e0b9f648994cd0c4d7a653a70e5f84d2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
e060c2042dc5875f6c5aad17f0b31913

SHA1
dcbf87891a5fa2c0cee60c5208e761693935bd4a

SHA256
8bd81a61eef20ab7639c098478fd4a92c46ac4b09b99731209e6fd7feeb4445a

SHA512
d587ab786bf4ad006592602631aeedaffe651cba561f55f6c307e9caebb645adafc04e1136ef92e9d814ebd1dd07e4554269c05b673a0ea3f6bcb59a0a281621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85704eaca3fc10a7e2afbfd36804ee8c

SHA1
e6ecee3f3bed4252221c7729a0e2bfd9f2472d7a

SHA256
30c5b995c123224b60ede2930aced4936fb5165c76144297e1f51c91dc682b35

SHA512
115731cdc913cc9be2e4cc07c932ea2816df99ff4e1728cee661b06f7b87b5da1d80955f8352ec216dadc35429d9af5048bfe900f955036b1c1dbfaf8f6236da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2656c007589b50182f0c04641cc00f4c

SHA1
ac0915cdb48f90e0dbae060924c0c1e2f8cf20ba

SHA256
6142795cbf12452976fee64669e1041914644180dddfa79cadcb9ad5bec9caa1

SHA512
c74ff18612966f30700ef55265d73454944706cb6a6bb2393fea913612f7c8abe90e75d746f4761d4c545e0f49b58e5cb10b0271d982526019a432a3ba192392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3be9c55caffd9ac2fddfab9504eee3bf

SHA1
9de4a34b911db196146906261541abdbef76f46e

SHA256
2d6fb36a364cf2243ebec3e5d6435d74e8b001d7e68124b92997db0d9f90be19

SHA512
5d5da02794e0646b9cd43255f143cae1df305d35b89fc1e3fa26c181efb7d043812a06146736c22eb476f258bc1b896b00e305bca9806578011b1eb39b57dd85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea3447de1c663118c2e505d6f147778a

SHA1
e3a4d71f494e3fe5b57943964e6888e4815c1f79

SHA256
048a3eee8ff885f49b4fe90bc8b21500d3413e9e750b03ad3836f05289ae9f8c

SHA512
73fc56d211fb8f967ebeae6af81e573dac96ec2be14f3c46219491918b3afa192468b3e73c28346c79d2d4990b1f2f3260799ed2783b180b18a5463c05b9b725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05af8f9da8c1716b0f3f92057a6a84af

SHA1
6d7c1ed898eaa408f6f3a7ebfed1038a1f3a9184

SHA256
969fee063b8fffeb615db1a995c00c3ee8983c80024d96bbe6c73055f0d300d8

SHA512
c402da366e5dbff83fa4a8416d19cc9f42821bdff2fa13712fdcdb8dd9d12881323a17083a07fe9a438434a5b22b31ffe495e1c799cadfefce7b053e9933ec76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef83b1a84ee0c5ebe77187f9c23980a

SHA1
d52f5a36888134ba91732cb30d64ddbe3fadb3fd

SHA256
99e5d7d975be1f41558869c8a994cac07e91c0d064ac8d9e43fc09af564b703a

SHA512
0dc90197f5c7e0665fb5b4be78cb441dab1ef243e6dcc88dc0e0a845e62c2b3f2f2884ec9b595d93df411faece9020fd9bf56f1db7c4d24dcac016f014c5e4c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
156072145900d7d90d211c83f4c3f3b8

SHA1
1c52948d122eef1fd0298ba7b42beb72aeb65317

SHA256
b1d1871e405214af184fde88e172ddefb08430016332790243494e246f4796bc

SHA512
e6ad6f40f93fd188a8ad65fd5859f3cd69287933acfd3776f3439d4335987c7e4c7a2ffb1a4ea776696d3ed35c26f348a19a2cfe940c00219a7447b26df227ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3463ee28da78dcc42adb8b6aee070ecb

SHA1
1996f31d8f1286c2dd52a5ce2f2f7d6cdb1e5774

SHA256
fa50920caf759899f6310e9f26793eb9637f78d6727fed8235ba8a41ce465a44

SHA512
6fbad82114cf7e0ccbb66c8da3886191fdce23adc671260a77c0fdf08399c8f519d9d4aafe8cca82c837642204c8db0c81a9063a1abca8cbb3cf23e5d22935af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfc0a6e1a4bc850eef9e272d6241c27b

SHA1
eb03d8b35a80621476daf56198ac09f982097674

SHA256
c246686addd854ab616ab7f30e798f00953e09833602368b07b5142ba70c6f77

SHA512
924573cd88040978f12496dcd32663656af38642d8db9fb64df8a228e24f404270643eb3170adf351c8ef19c29d36e446a85e7621b6ee4b2f603fa6ac41f3644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f133110860debe34d071cb5b9a12465a

SHA1
4c5585c65e762cb1c1b18493edf2e078610e9906

SHA256
f00455fc4a2aff9f5197e7f507bd2abdea78b72ced9961b2f90772544a352280

SHA512
5ddbb1034d0190195be76f42d2fe0b60923547fd8cd1aed64e05074164a35d6aad493c6cb5e9580c8324e889c91971f7cb4dde5b7003fcefd30a5bf5be368269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_C7CF4FA7BCF717E50C9341D69112D7D7

Filesize
402B

MD5
f62378df44276644d3a799f51e4ac677

SHA1
93a299df5b03a8ca49e9f7ae9370bf84e016ed0e

SHA256
ad3200a9c89e6531c1745a129db0e9272061037312d37aba254e4939df9ef7d6

SHA512
7fbfe34fabf745bf2174b71fc16c0be4504d3f4d1551fb068c9ece9afb0ae3bcc1ebd31a8b437ec9236f64558139d670e4f14b7bd07d0a6a61a863733044fce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6WEH2YLI\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\platform[1].js

Filesize
56KB

MD5
0d25af623d803b10050b53a7b218c652

SHA1
2dd71fa961b5df37134bc6eb987ee7b7e5861488

SHA256
0bcb6531cb0967359e17b655d4142b55d1eac2aed3fe5340f8ce930a7000e5d3

SHA512
919b48cabd548ae63a6b89dd3ac4df919b630b0cf75266d21b35ea3a6b54eb1ea5ed7371e80bb6611e105f2d994abf9f76f6dd8b6915dd2b8fda09edd263c139

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD911.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2A7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit