b0beeb28f33ca3c24e5372de1e45c63a9bb16411af76bd367dbd511f19fa0a6f

Analysis

max time kernel
163s
max time network
178s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

523d220ae39add3c365f8acf6d8a3c18.html
Size

58KB
MD5

523d220ae39add3c365f8acf6d8a3c18
SHA1

2763b38e4691a958f14faee662ba1ba9b1a9fa63
SHA256

b0beeb28f33ca3c24e5372de1e45c63a9bb16411af76bd367dbd511f19fa0a6f
SHA512

f4bcf3285658841a8a233bcd1755a34d996a5cc63bf68b38e9480e6a93a321e5fb4ac4a6dc5abf1cbdb9bd460a2ca7bcd9157e87213f91447a3986e2fa9d7b51
SSDEEP

768:zLqpHvvCIoodZylFely4vJpyk6VRh4qFW1L:zWHv7oiZyKly4vrv6fhPFi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE50D6A1-B025-11EE-8B00-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007bd996dda9268af60cd8c0b8cd0655fd914b2788bfcd59afefd81bafbff1a411000000000e8000000002000020000000880199253c322dc12af2e39a5e3ddc26480efa2f3cd47c9179dcbbb0bec07e1a200000001b9c82ca525ffc5cd31efd57b66279d86f4137494a1f0049214753430caf51f040000000a62705dffd9b25ca65069df924f3510e2388c22f91f563ce34f1fa530d3a20678e83fd21f6765142d98b68a8c20189dec01f235416b19abcf9c94f3982250c63	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90781c973244da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e280cc20d6b879dd830f688265bd52ddb57af175005722f138866dae29097cb2000000000e8000000002000020000000f0bfaff8ef06b305f67e47d245868dfeeb730b846a6ae13d026ac90281d15ad7900000002a733cad9596d70a315c0c5d5b0c36b45a588a1299c0a9982f325ff9e8da4065eb11a2fdcd6416a9402656a71c7fde2388d0a4cb7b8098baabde162571199f420b6b3247cd6af82799cb9aae6d97182eb3a37ed26d2f29dd131b44b383959a646bc3f8714cda65c272b399c7ceb166e8ff67250a1cf1555453bdee47c1b409eccba0575122b0a8a7373130f7b4743e3240000000c9f3bbbc3957f747fa001114402285b246dab62920d0bb3fcfee6e06bdafe989d1b5c8577cb2f857a4e0039a884c819a67e87a8b9f3c5d9ea250f2baaad65141	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411100507"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1904	2792	iexplore.exe	28
PID 2792 wrote to memory of 1904	2792	iexplore.exe	28
PID 2792 wrote to memory of 1904	2792	iexplore.exe	28
PID 2792 wrote to memory of 1904	2792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\523d220ae39add3c365f8acf6d8a3c18.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae13e94451848639fd4e833e601c0572

SHA1
2d0f4ae1819be0e2b7e2f1b510f6d4235da3e144

SHA256
fc1ae84f35e2a40eb1410f73ceb800fc17f90ae5f4cf4bba668863ea09ae135f

SHA512
37b43a2d67acb6d83e99100809082e41a243b46d1b95a368981b66beb07a7654ef5e20e2188705d423e660fb0299af695f78d92c5f6140665da867a62ee0eec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
121aea3aafc489d62830f1c8191a6a44

SHA1
47b433536508416aa2a1669ef5dc064db6d40566

SHA256
40cd2f7fc54a2de2aafac6491d3f97c91a3a248b02d0486d02dce65f8e28de8f

SHA512
30cc5d6955b962c760ee64fdca4c5fda75a9fa90e392bc05622376eb203c2720be085a3bd5147c827146c3ecabdb6a98ae1dd1b8253661d8c722e2bcf3b62a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afd76ad92341035feb9fc08681408a23

SHA1
1e3ccf11aa02b93458e7736d9469b96100ab022b

SHA256
72b95c0add16003797fedbb403ddaeeb845b613f5a19c96b97f5bfaae507634c

SHA512
e06c1b00bdc34acf91ae2adcf8763c287a3f25b1f173925ce4f316bed910b0212c5e872642b9982921d96f1571b9d5fe997bc21baaaaabbc933511cceeab9264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29ea127d660e8bc54672cead95037f9

SHA1
7e3e3ae5a2f565ff978c19335defba4a118642a9

SHA256
26dd850d344cc2a89cdf9b07c9fcb7c1de19025c68b89e9412d27cc2537d0318

SHA512
97781ab404910406fdf6b1de8615e1a4932e3677d39e596532360350117d50c93925b0d5d097ed95457e1fdc17fab925adc55907b8eeca3c0a29b75cedfefcaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7127cd757a2f566690d46f430403a885

SHA1
b45f246597539b34434d0a15416f777f1f910fbc

SHA256
45a5a176d100c83deaffc516ab03740ac909e3043f55544555536d9d444b2f7b

SHA512
15ed0370c8980428eaa72b4064ea4b13e6e820360e20369fd6277d22709842ef6bd2e16792f0670a8eafb9ea6c6f20010e1af52aa4704242728ec4b3604adce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62768f65932085d47921b7df0f3484b9

SHA1
cd5b56226083bcc2b3ae8b3c05ca10cb6b9fd278

SHA256
620ac30b22bbdd0d8eb3c0dd350b1950dfc061dbb7fd93a6be276eced21ad887

SHA512
2dea41a2c32da2acc1f3c88952c391896eacb32549f5059e7e936d5be2ca5689d1e2a3108a3e5399a1a3ff3bf96b7914290429671aa6221ac09c2c16fecd16a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
688aa6e7aaeb7de4a2e298ad17060ba8

SHA1
62ef467f614159d8a877f9798b60d4fc9fc90f57

SHA256
167e3a369afe762919855b784ca068b1b2d8c3226262bfa319b337f84094d5f8

SHA512
94cbfb2f0d7df9797c7b2343ae2f7919103fd20d249705a5a5a11029a34758e7dbc406fd22913fff07a62c3fb60047f932465916323311c81886bc11d15396b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e877c720344594a3f7b8cba9bafd01b3

SHA1
df6b725f89e53a8d06dd743b6d74c8ebb004cc98

SHA256
98d2ead613a638a0737d807f638b0c47a676ba6676381538945db83da256df6c

SHA512
d386cb7fe903f6d80d3b1a039a6ec5845884a09f524ffda185b7948e8cdac85931e39a5308b857bff26fca20943fb99affb4af98f4cc44d776342e4b2862e7ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a08f1aa0abcd6af9039778fa4e2e616

SHA1
5311a2783321b9f8440e2a13f38d0a70b3bc68ab

SHA256
2d1da8eb4280e3b5141f72e576063ce503fc378f8d48156b8232d7650bd88218

SHA512
55bc87f37dae25fa58de310d4b2773b526873a1f46b8b7fadf26a8ac73d68dbc0b7a4de4e262a14365f82c0a44e069c28810ad3cc712c8cea95d7f21aa9b2eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47d222e70cb343faa9db97be9ebdc922

SHA1
3cfeaa22a2f7f9a19f6c6895c07d61d5f40d54f9

SHA256
cf7c47b120d17431194572115b77e5cd0eb1986c1651abe928d2fbb8cc6da1bc

SHA512
6da187c7e40eddcd26c9e4561bb8f1f377fce83e5dec82fec23d4ed865a69063265532cc1ddd91112387a9686ee0279cb9947206290d4216a06590b6903a033c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
640adc66c533c5393c48950348822a99

SHA1
c26542de654fbcf8829728ed2290867b27b3c025

SHA256
334845af65da921e2728ecc097cad5ea1174420d0c0a2f6d2196c500b890ef13

SHA512
45df5b008b6bc967a0657b41c2dd961f5a01f2bffdf780efe8f04d216d116a6ae1452442227ea697c061d7b8519eec3e07dadcc3124c64c1acafeff29ba53dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25522133f43a43c981a1e4e6887859b5

SHA1
32978d99a2f4224e8c96a0be5b38aebaad6a34ae

SHA256
dfad48d08140b97c24f290a86fdfe9b9be9e74118293270ae5f5d315acd8fe89

SHA512
12353643930f5776defdac2a5b686e84b32b6fee6b3a1d102a071fedf86ea7cfe71699e928b1516239f76f3aae943d77886e30aadaa76e1344f7522539187a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57e5bcd2841efb31a64d4b797590ff13

SHA1
dfe9557ad62c39d29d8726a3eea2207e78a33cf0

SHA256
d7f3e85d5591132d1a63ee06223619ee59550858278df2ebffaaa1411ffd2c3e

SHA512
c6a740737736f1ad335c65ee244cdea5c67690403530987b1e4895d210b10eeace9e2df8a696fe06f514608d27981f6763428f655d51e18e45d8578e2f2109f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e884919ed0b692633608e7b42239219

SHA1
014fe5debfc94ed4e3e9c9846f2c55e632d12463

SHA256
9bbdafbd20ac5677667734c05cea38671c5426975d026fd8e46e6d6dccaa5567

SHA512
b07add103b1e5b200c0d232c3e1eeaa775a04b63925a2e85bc3edd40c32e17f42d17554b576fcd2cc825473ea0ee9414f8b95893d9b23eb71c09e07ca24dab1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b8408de2c78b04781693c69d04a83a

SHA1
557548496de4c45085277c3e03b1dc49995bfedd

SHA256
0487dad62833b14e4da110d5d86b92046b8363305eacd8ea0827a51e64219eb2

SHA512
62700286856ac0820f0a8e7458ee86a81c5211331373ab3782228e3c95ef164909107db4a20930b7b95e1c920707948406cd398a16366ef90e57611c2118d234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\cb=gapi[2].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF901.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF9EE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit