998966311c8b5560e9f3d245e3ed1f4e97055a0bc7f75f13c572acb69a32a70b

Analysis

max time kernel
143s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58721fd26b06827b7e34e0d559bab168.html
Size

3.3MB
MD5

58721fd26b06827b7e34e0d559bab168
SHA1

04b69ae681f19df7352d2eefd05763371205bd34
SHA256

998966311c8b5560e9f3d245e3ed1f4e97055a0bc7f75f13c572acb69a32a70b
SHA512

1586ebab9b3dc549efa824d9332a86150085f31e04c80253332bdfc08cba3fc4a9248ae9622cc11ff597bb9595a6f04b33e01e910e68925f5c20b45577e65a47
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NIO:jvpjte4tT6eO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009866c094a4604cff23d9cbfbde561c0f9ce29c7303cd3a4011b3408e4cc19e44000000000e800000000200002000000014e7bd1c49e0f69dee926de77cca7cfdc874b7252d73300419d3d20b2fe5b489200000005c0c42de6e3034565753b3b97709e78ace7e63eeed685e5e74e2fced61d74cb340000000a8b6cf548666ef12380a7c6a95286707bc4274818b04b6ff5bf8804f9308792f9095db979aacefeb63468bae1ad47a65dbc331f5b0427a18cfd6bcc750f001ef	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a36b470b3eace61783b276eba50b9e8e08b510c79f815e315cad45f0ad71b041000000000e8000000002000020000000d322787fd5a8cbae7014de35e564f9864fd8c6873547f6aaea999a8419cd9e8b90000000605e1f378bd9af3e56f33e82e60269cec5c352adc5bbbe41e4aa33003806627d4a185cab5773031f6ae70581786495ad52dceb7adc9faa9078d2da250086554d97847d61f35a2c3478d074e135e1a59ed15f1de25617fc7bfc8ed3200d399656e88a75d5b07a5f5f0715972a0fbd39dd120ec7367460354ef719b4ae7ae9aa246d7991b496ead23fa8deea515b6f0ba140000000d32274ab0a1acc6f70460673d3b722a5f9e85a93959f18325db4d8c09371754de2df462acd922a6b38c37c852af9ba0cf6d56ed27bfadeeb2e84a1d65586fefb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00ACBC71-B1ED-11EE-9D00-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40733be6f945da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411296074"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1680	2356	iexplore.exe	28
PID 2356 wrote to memory of 1680	2356	iexplore.exe	28
PID 2356 wrote to memory of 1680	2356	iexplore.exe	28
PID 2356 wrote to memory of 1680	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58721fd26b06827b7e34e0d559bab168.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3f65048c74eecce733bff59e72d5c3b1

SHA1
f600e4fe4b79e1f80baa9bc5d758a7bfc86cf9a7

SHA256
5e771088f10cbc0be88848804c37dd2e351cffdbeb194fcca5cbcdfc1c4b260d

SHA512
bfd677e852895f3422b9d5d75b3829fd6a8a23f75182c9bb91e6a1d66bdde435507958f1861ad95df7aef4093d956c54d8b618ff2fecfd798f1357b1e6d561a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581eceaa189bf42f78c90085b81ca976

SHA1
f394f2b20b9458f401317a67e6b8ad9b087e0fba

SHA256
680ba9a762a641e258c74c1461bb666cffc16851f26257ea738abd1283715887

SHA512
e009ef29288975bd41e1e53e6ebd85aa4cd28025caf652cb7dd4d962359bda90b5ed04cd44cef1f41760444838e06ee6b1ef2ff0db21cfe3ed95b32c066a1487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
037585024bd6584868985956cd329785

SHA1
142ec19de508a0694b984d0cd8ae73b2d7bce094

SHA256
9aa79dc14388dec791a9cd21ed9f16f6ee87dc47148eac96c974d69f5135b973

SHA512
50c3a3eead997818fea3ce30ba31b9e55d81447671190ec07651dc9b299f38c1bd73cacf47951c614bb11fdb8bea86e38e02594b6f8fa320dbe853544307b9c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98ef3e2848771428fe309afd0bc6a3c3

SHA1
2113c0fa38d6b9650dfea03f223ed91bc2e79b6c

SHA256
300202e50e2acd6f5ea19539782faeb85fd4752ed29c002d546d24cc2c5e71d3

SHA512
ebda400e58ecce6515a8b72dfb5892d267123e97989f8a36f61808da05c08d150765a6a3590f659062a53643c233a61450f2df574eb34ae4832d0b68e0469c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5630ca46f9310000722306bf7fe6ffcc

SHA1
d01d4bbca4182d13e0013916e09a4a0f3dcabca2

SHA256
2b1c07aad2d01afe4a8581fbba35b5c84c5fe74a3323914c395896089bbf9ff4

SHA512
a31f099b7510c056cf1b962012626bbe1e2b2bcc0c3c670aaab3f9efb395a2be8c5237d959563a8a15820dbf92e7442d5b091580b9aa3cd22e5281f0faa2e728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0db66bfd6e8d2766583d68f8ccb2e7c2

SHA1
33e69052037d34cfec622937f73f499fa0bcf462

SHA256
b63d7ce54d39bc16b30bfa01681036df89566a8cb31c198f204fc71013b1ccbd

SHA512
dc2e4f0b14dd8f1672c8d76802040059e79a9153c9bc91fa7debc7431e13861fa323f2412f8509944f701fde33a56a98e4fdba1f6ae13666a8fd63fbca88f0d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
580020f9774ad30e9cc6504f961a93d1

SHA1
26b2563d8b27ce54c13d97480828f1c306366c02

SHA256
9e58814a0b7cdd115b992942481c52bd68385579dbcdd66f4d795e121d693f5c

SHA512
9e3f54262916aefbf9ff38125595cef44a75281f21642b779ffc0614fbbe26144ad48679ac9ea9226bdb88e4bda7682e100516bcea68478ac4a303d29218a2cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f8dcd62b469fe08b730b5d1327330cd

SHA1
78945ea4a5843b88cbe619fb8702b130c0b23aa8

SHA256
6f899ca171a4d33b1e415e308d2a26589b65d39ed7fafef658f72bfcf3c190e5

SHA512
4528dd673983b9e4784b96dddd67939c631111a64a585b71e699f3e5fdb89d1481fe4fe2d6a0c87d85e01a2dfc5cd22dc1f5fd66fa8eb2b57536d070d06bccec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8c83458397eb7fb504e8566f575f3a8d

SHA1
5f9f84ccc2af17b76000fe7c058cb4d3248a1a73

SHA256
5cfa625217cada3629e11adcdfee151d8383fc6089d0efb7967e30cd26b60788

SHA512
e8fdc396c90a2ec2550b3d646b0b16ba9494b1e1bcebbacaa82da390e76fa82ed003042cfd7e73d4e01adae6c75b290545d4355fd933ab51c09ec090a816ce15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a51db0a1b30f46dc002c7fe78ca7c68f

SHA1
aef0a5fcdc188d34ddf806c742d456a24932b07b

SHA256
60f6b9fb8a70e744433d1400fe39e8ef5acf9e55e0b6bffb40b930b21098fcb6

SHA512
965fbe64659b94c86b6b2686a983cf8ba7c35c32f427484e9480ccada8bae26c24aef9e09de91af6b3f879aaad3dd992e627bb3b620c340125f4728bcaa6ca77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF35.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF37.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit