55240d9e2d80528988ef12f334be685df1659134bca74e75b1196872880c18e8

Analysis

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

538cb7fa7cba7541a58189207af9d866.html
Size

206KB
MD5

538cb7fa7cba7541a58189207af9d866
SHA1

15b7feba615311151740da851a1fdf277125c211
SHA256

55240d9e2d80528988ef12f334be685df1659134bca74e75b1196872880c18e8
SHA512

5308c6159acbee3f4fe1d7c2b84801459d557c3045381a21e573ff406c1c7a21e1d533ec7dc8f3ae9787973b727df8f70cd377480d123164533866e6f3c2765f
SSDEEP

3072:rF+Ge3/ToXqbIrqbI5BU13G4k5QhLpOatVeb3VJqMQoDcpviQoHL1FqflJq:hi3VIIIq3G4k5QhL8atV6Dcpvi9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411138883"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{075164F1-B07F-11EE-B201-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\cbox.ws\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000010e919138e567469298b0a274f1878faf217aa9cf160f45ee0fab8fc9d354f80000000000e800000000200002000000092f75e67cf51e94a135f97caac24a0faffa8243dee02e17d0fe6483cb48d0d8790000000676b7d63cc2b30a00816f17e8265ec3db9325e8edf3f155f2b632c9fee30a6ff4ea42a80412cd007bd30ac3555c9d99014d965321e680d081ca1164dd9793a03556a855255370d95b4a574e332237e658fb19caf5703cb7cf51fab5846b748ce1ab9f8cf9633be50bd0bab1eb19ae9b678014759ed92610716fb7cacfc6ab23b4f0c5fa12d458ac844feeb2aa5f6f2204000000004e5d0f2cc309c5a1237f7c7644bcfb2ab1f98b7344ddaaee211a2a6352c07b73929b1fe84afa35083192c6ba567e75ecc45951b7f7585bb684a5045aee062f5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50dfb3e38b44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001486eb2b6d59e44a81b252176d659123d37c147083e66be478e6b81cf6bef3d4000000000e8000000002000020000000f9213b89d15dcd39e16086776fca552da87d19dd3517415ebf829223bf40723b200000001a6fd8221daf77565e4b6b3dd2e232ed42e7f609139a3c60922b7cc78d843df940000000c8a14c45ce0b20f2e3bc1cf622f8fa09bc5c7da88f35eacd9333ccc232b90fe4d52de3b4df550f15b1170a88939eb6e32ba3f9ab2bef96d0ef419a8fee17f729	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\cbox.ws	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1080	iexplore.exe
1080	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2256	1080	iexplore.exe	28
PID 1080 wrote to memory of 2256	1080	iexplore.exe	28
PID 1080 wrote to memory of 2256	1080	iexplore.exe	28
PID 1080 wrote to memory of 2256	1080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\538cb7fa7cba7541a58189207af9d866.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
3db72e77d5928f44e47505b3e0a2efcb

SHA1
1c9654481f821313698d508cdb7e4af0071539cd

SHA256
a91eb4d94cc976cfd7982871978a935a894aa775b1f9cb61a0410b4f92e7f2b7

SHA512
36a33204fc24169a623f627e9e0a4661c8c71aa2a60c7ff93872dc25714e71b0040db1a229e7aaf8e41b27768fa90ba7324b5d5dec7ba324a01246b99531e849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a703df54a1435b0335bb09a446f523bf

SHA1
d01452383c4d427cf8b4e20066d672d5600029b9

SHA256
bfc802171c4beef20c72f9e35a6cb1335992032e53d0280b2ae7fa97ae87b08c

SHA512
937ce2ea50f18d0a2e7d8ef37f53c6b1bcf584f9d67c76f61d8b1189d52439e5d3e7fe239b9d4e46c94cec89d6fee9724556e1a5ac0c2ebc8ec75acce3a38d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06375fa7165b438d645770a0d74dfd95

SHA1
87c1ff0c8eec7c9585aa0711e80281af709775dd

SHA256
2ed6e4ea27012d53fa50b323de024d396b07952413f4b8d1f247222c8ca97466

SHA512
570eb736b2731bdbb217f5dfaac33ba9b170c43814d4db74d385064a6014940f86bf259765ae362ea3acd82f4c30dc236362fbb71b2980d7d6716e8c1b04e12c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b6dc3a88254da5970f54e1ecdc5c79a

SHA1
c53d55a5d8b796f0b5787745d1196de03d5ff6f3

SHA256
8a5f60febf91516035c07b3c8bdf5bd4997320236d2251b8156f244b1e83f740

SHA512
f31e966a88113bf3a7c8adf21026f9c33016a73943cc925e6aa8e1a1e5fb2ed35d227b60872e07eee4ef6a69244629fce4240ee327510fef474b696b12a739ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7cf90548531dab13d3e0b02207440c3

SHA1
937610c7a2b37803c63705f8b1ed4740ec16ff08

SHA256
1cda47fce684110c8e074924c6fabf49b88035ea914157ea0d5cac41a47f2e3e

SHA512
917190e14512acf04f0a48341313a701225ac78f19b7c6b0b4de6bc5b87730531382896ce5d40104cb7b14e272bc9c140942ec67aab0202a440bd3767ea00eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc99fad5e2db03d93f1f1b8473acb02

SHA1
d3b629d4d186bcb19ced9be4cfcf9942b9537762

SHA256
d4aeaef5e4f46ed4db7de26e78b64e5de5bc5eba587970b8ac3ea06ba69b516a

SHA512
0cbc7c1841cebd7ca7361572fb0b0277171f4f60466102a564ac210a5fa4a40e8a97cf7c324e9115512e88a5ac37fc23ef96caee5a4b06106a786d0b2ca5fd1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2861384299295e7e0c22577067be0d5

SHA1
8cad86f7fe9ee46a81c02c48d0adc8798f735f67

SHA256
25d3bbedd6424430df16b56c6a2be34384514d0397244b11c667ca3539b0d897

SHA512
cf233a359abe39088692ccc1a00d2251271683cb23c8377e67f7b591d5f72120d2ea370454815d5cc5c6042bb16237e69980bcdc073b064f9e40cbf6acf3cb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ddf4b2eb1ee5492b80e0e49da5e99b7

SHA1
e7e3af80aef0a27c85fd6bb4133e9131d435e33e

SHA256
12a50011f8a42fc938d0948af42efbaf0435e350e11bdbc280df8caf3398c1c1

SHA512
cc64871a2c2b7ffcdbcf349e6146a714bfeafda138a5abe9f27dd92217c7938ce89095d303269471690328fe6740d71797d83292ce75fce50dd2ab800d267861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d43383a44663112ecf50e34944c0172

SHA1
e8fb4772983126e5ec6c52a14b97432d391c49d6

SHA256
e0b4daee6ce07afba8f29bd6dea0fe0b3ddaca0dbcd09f3c65fe91334019c984

SHA512
a0aa3187e7432783f8913826831785bd7a6bf60cc1efcb7a43632f42093da6938c3800c0807ac5d4d41951f1b45ef3434b5d1d6148a6769db5823a6ea81f008e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72e4c1fd5068b9eee973c72ed47f6bd0

SHA1
484d590983694d71a407bef229b0e9f40ea4d743

SHA256
ae3c4612d17cfb5441d4e5b6ee11cec73f6c876540776b6c6f66391c2b3f9f8e

SHA512
46d8f9d33ccd3d579f98fc57d6c48ccee5f402133f01d4c391d40d1a7fd18a3cd8344e731a019c4e15b1685f09ce87c4126cb380f971d37145e6cc69f6b21f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f730501c98d4512f942d1fc659ff8a6

SHA1
003e6991b61faa94a7b49ac04c296e62e5323777

SHA256
fabf674d15441f9e04beb8c675e78dd1bb8361056c1c1f149ee800a8790409d5

SHA512
7e09a84f6ff66961e22e984d5b4e01e39b2a9c96dea95298ae2534e302c3e8e3502ba7a881027551b45ee21fd8c3717b96966dd01b3125f74db6f2c716a16a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a54cd3381440277d2d225d00fe49b45

SHA1
39dbe946e90b24d23763ee3ddf843b315dcf405a

SHA256
6458f94e1a43f24ebcb47d1e3803cd83f2d0dd3937de6659b7daafb0655e1bdf

SHA512
769f4eae8f56607897b09a040ea75b4f4d01e865cf863150eaf6504cbb544921e63546649671c568f720af19a7bc5b2cb2e9aa1f585f2e9537a08fa47887c3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\cb=gapi[2].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B8A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C58.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit