Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 18:12

General

  • Target

    8fd198987f2befc1e69ed4d5507aebbc.html

  • Size

    106KB

  • MD5

    8fd198987f2befc1e69ed4d5507aebbc

  • SHA1

    60be1eb7e0c9a7947ffa86e2469a5176d4e01328

  • SHA256

    55102bf42abd5fe0e4a1ed8225cfb8e8e999b009e371bca7ece16aa3e2e7c136

  • SHA512

    08dc1fe0d03b929fa9b7c290c658cdfdfeb8f19054a071fdbe61534bbd1f4eb23e7e416adb83df249d74a2c50cdadc667fa2852119fc0e814dd24465238c1db7

  • SSDEEP

    3072:BjVJj8YeO4aWrkGE7+5/tnP7+l/tnuGEbJhvdboqEN:BjVJj8YeO4aWrkt7+5/tnP7+l/tnuGqM

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fd198987f2befc1e69ed4d5507aebbc.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4312 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4260

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          7bde92ff965b73dc76190e608c2fbb93

          SHA1

          95547789d183bbf9ea20ef6ba4c6b2f0249fb30d

          SHA256

          821420f187b512f853c8b73d9439e940e6e04c499532561343a739717a9a76ee

          SHA512

          21406b04613e8be9f2036f5057d6d3de568ec1aa4eb6471cd457e70e6ddadfc3b988d5f4c2d316e548b21b2850944a78d75a44ec3bf929e71fe61fb6b0de4ec6

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          7343e35c618fdde11ba9ef903708dbdc

          SHA1

          b8c18097eaa70db6d1507f81bc028bb3a9b090c0

          SHA256

          42b8eac07cba772b9e4f7b201832e0171011b066c82ef35700a4372a06d4ef9c

          SHA512

          290da13b3671c38c8de7093fd8d891a00759814cd566d5a64b2d24961db18afd7d97862f8e297c9483f67778d5bdd30a4e4567bf198dcdb5a6e4f5b7681f84f6

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\errorPageStrings[1]

          Filesize

          4KB

          MD5

          d65ec06f21c379c87040b83cc1abac6b

          SHA1

          208d0a0bb775661758394be7e4afb18357e46c8b

          SHA256

          a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

          SHA512

          8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\loader[1].js

          Filesize

          2KB

          MD5

          beae9a9078cc3e0edf38e71a8f1be9ec

          SHA1

          273ba339be0544351e4737f49c002abe5ae0147d

          SHA256

          98dc0129110a40d076932377a78b9a67b7a4adc909feefceebdc12840be3359f

          SHA512

          ed24f74e2f271280a30d9a3928d1f6cd93826c182dd0f50f5901ee7f214d5a143134e840314f78e9df46c071acc9da6a2b94a51b43a9fb2c1f2f4f9f3c7e43dc

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\pop-panel-script-for-multijob-site-pid235689[1].htm

          Filesize

          28KB

          MD5

          d8bd2a47a380ee031c5a1a0bd4001f9b

          SHA1

          b1b3f5925f2cf6c4a65cbd7f29dc36d4b541935d

          SHA256

          4b248a99f14e822f4b40824373dabae51592c7e4fa9b73d29eb5f5d8fd88d5f0

          SHA512

          35cb8d98606d5649578c25a13d587664d3ed9477624ccc7948011350930e0641ba40b6aa922e2183b9aad017fe1515942cb1ff06a5afa1a6df94ffd4fdeed10a

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\site[1].css

          Filesize

          44KB

          MD5

          72b0a069a3aaed9d66f47238ad1926a0

          SHA1

          fcb835274dba2239e4487a53aab6c4a156006fa8

          SHA256

          f3674b3e9d54080491315b781feebbec45e4674d341deb6f8732e17f855014e9

          SHA512

          664ee79210b14ee3c6031a86dff1da844188e32863f1353284300c0987a8eb4f05b7221b398da3f08d85b0f8f2af676e59ba5ebbf8065252e7a59c77f34d7221

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\style[1].css

          Filesize

          5KB

          MD5

          e7a5e2d2a69e98d38724f434444a2d05

          SHA1

          759e8682aeee5682459331d77ff1fa7837aa6270

          SHA256

          089dde2cdb6386d4e90d721e1559c0b233acc1c5828c4eaaeb316e465d21a911

          SHA512

          02f7a43c98ead9c167179f5ef20298d520a2aa7a5be11c975d631215e8183c3dbf3ba5863fc3a2d9f85dc9cf55987b6f8e15e345f9211159ac995f88590a2368

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\calculatorperfectmod5encoded[1].js

          Filesize

          10KB

          MD5

          ab146592deba8ef9a5a9e3ce9a178ba1

          SHA1

          90e7db1690a8af2eba37f3fef57a0824eba600fd

          SHA256

          7218b9001ce54855d30e53442c2f8d8e9f43690dd58676ee1575e5f5a8259a82

          SHA512

          d41ed8cccd258a6040d28ac7605e0a98030da5c5de971476d0da195ba81eee6604b72a3022c3899d4fda5a3d9cc76dda598896db1d65d1f1b9cb2dd152231507

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\calculatorpernotencodedmod5[1].js

          Filesize

          20KB

          MD5

          c4987894c9a05004950ce1ef3dd4850d

          SHA1

          805651b029410c9510434b6c9046ba08ea2800ec

          SHA256

          e20f21e8ce9c984bce9ed126aaafcdfe6560e3a9a321663e857943160540b1d0

          SHA512

          5afccad9daad1efe13c37f1b9c2c14f5481dc4f6aee7ac0005647d2e9705eba6c109f98c4418f90e0abbc0af13c4493ea0b007983205144764eff25404f21612

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\irmoviedlbanner[1].js

          Filesize

          12KB

          MD5

          86013e1c0976ed4575bf072f1ed70f82

          SHA1

          144af5d06d5a6e62adedd78a965adba0ff6d7ccf

          SHA256

          c4420612708e3da1682ec026981fe6b0a2dedc94eb80cbf7f60ac05010930315

          SHA512

          a261da9477eea0129074f6c86acdd4df2f51e5f56a5f6857cb0541ee662e176f61c23237557da917d42f8fdda9be4a466d413c085f953231d50ed32fd8e4a8b5

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\rozblog_ajax[1].js

          Filesize

          1KB

          MD5

          f0d32c937ac30fc64399d611412e1bd9

          SHA1

          ec0733fad2c52bee2b5ff8b42f93432790492d42

          SHA256

          a719efd2104e000d3b8216c56104774f63f87c4947847f74aaa276efd013250c

          SHA512

          f4ccd43af5384052758c8ada5c3b9ed74080866565059d8dec831aff60c7d27dde9afaaf58cd3d8aafdbdc7db82291bb7757730ce6a5b985155c308eaa54af7b

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\script[1].js

          Filesize

          1KB

          MD5

          eff7ffd351a0f968d74296e5a3e0bd6c

          SHA1

          f369f0abdfade012552191a9f3b7b016d80c111d

          SHA256

          89a0588240f17c54478ebbc947f24267e4b918c04598325d0b42ffcd7c8bf68c

          SHA512

          6fb13146f5446677431a38ba3293c3bf34ef0c8996aaeec59ca72a80c1b134c1e436e605c98ae1f33db8a2d7388b2543542fbdac3bed5f3795c3dd86f6042667

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\httpErrorPagesScripts[1]

          Filesize

          11KB

          MD5

          9234071287e637f85d721463c488704c

          SHA1

          cca09b1e0fba38ba29d3972ed8dcecefdef8c152

          SHA256

          65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

          SHA512

          87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\iframebazdidkonande[1].js

          Filesize

          411B

          MD5

          0130cd6af5c3da110d19e7916f69cc4e

          SHA1

          5c4966c3aba1b2d582de8eb9bda33c0cc1f8bf5e

          SHA256

          aa8f5ad198acda4f0a5226ec1e2214d645077b0afabae18b8348f509b1d4450c

          SHA512

          02383aa80191ee6dfa41cdbee77bcde5719a5f14043ae1756df6764dc95ca89bb16647c47f650707ee66a7fa1327023b2fff58a0168c4ca25751d00e54d9e3fa

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\iframesenderipnumberrequest[1].js

          Filesize

          21KB

          MD5

          de4d2600013deb4d94ded6f13cc7ab8e

          SHA1

          ed499cb0d755f8eee2424a48b59df3ded7228e7e

          SHA256

          db853e781d637f7c2a805cf8c07eebc7e52a58efc42c1eaec1164f9c95cac27f

          SHA512

          8b8f3739544156777cf8d319c7600aaaf85cad956f95592e4767512ab7acb4398eb08b6246cfb25c1347f055e53cacefeeb5faa7ea225a230791f13bb06e3114

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\ify[1].js

          Filesize

          236B

          MD5

          b69349813aad88df51f8eb8a49b078de

          SHA1

          c79dfdd9cad764c48eb1d7ec3e8bfd6931ab27ba

          SHA256

          06de491b7a092ef53277331634ae40c6fe64793c53a603fb5a1cb8b811c15e00

          SHA512

          fb2971fa4f470fcf5367291bc2d130acbd4f461267218361fccf8d9a56786bbaf526194114e3fe749476c8540e65e706c634bf426ea001493e77f6036a7436aa

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\muljob_goup_jquery.min[1].js

          Filesize

          55KB

          MD5

          e452caa2700affbd796a4a168c12fdba

          SHA1

          36d2f754db8b0d0061a4ee85d6c5abb5ca11b7e1

          SHA256

          ccbc0cebc181970fbf9493bfa695327f486f177de32f00313b3015666630102b

          SHA512

          e65a6dcbec056af4fe017691435732341ec70549d0d3deb6ad4605a2ab19c95788e83ef94fe6a0229b98b99d85e3bfcaaea75654e64ce8c245976f9b832d272d

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\multijobunderlinkaltandtitlestyletip[1].js

          Filesize

          2KB

          MD5

          8298456080be54ef57c5ba1d6ddd2f9f

          SHA1

          1beec4172f4c1ff54129a4a0c23032e08dca2eb2

          SHA256

          39f7a144d81c746eff74b6e36318d06da91f0e5846b87e1579857922848034eb

          SHA512

          41533fc058c6e302fb194f3eabcd647f54a7f587ca6537a0b71dd1154cf52eafd8796d5e24850900626255629c2ff34ec415b7681cd57f999523255815de5ae0

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\scrollgoupcontrol[1].js

          Filesize

          3KB

          MD5

          31ed93bb0a346c1b09c6bfd97accb1e5

          SHA1

          284fa3bd71e978eb2d4551387d269f9086bcafb9

          SHA256

          20422bc978ca92890c71013462f8c96fb1dded0a3af8525676acd8d942af17bb

          SHA512

          11034592edb7166075b37a38168f63ba6b98f723dcd144684796315c12f7ca9aa9e820cf189ed61254736767d56e27cc076b839f454a2614fda35946e5cc3bbd

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\sendipiniframetootherssource[1].js

          Filesize

          298B

          MD5

          df4a3fad800703d4018cecdfcf0cb61f

          SHA1

          f1335bc4391fb0fd89cd3bcdfe0fe252889e1ad0

          SHA256

          1e3ca1b8f68c1bb118bba7e088aae10b752273294bb9d53e04a7899e9a540f31

          SHA512

          3f2ef94f69fc0a9aae34628ed0f708cb74b7fbe2543e947e1b50781cf455a92d2eb442e8ed36abdca0b4454f44099d1169208a1c8d076f2532a50890f0cd7624

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K44LV95Q\iframemultijob[1].js

          Filesize

          353B

          MD5

          0417667ab3855c62be88b5af02f9d137

          SHA1

          88aff0812f11c74941734aad8c5f4348c13d0935

          SHA256

          84c9aeaf8f7ab5e5e2263fa9e90b1f6e7ccda4dfa4a778c7f87102577245990f

          SHA512

          6c211bc02941480bd57fb92e384e4f0283afc9c43163a071f37d58766d8da50ffb86018aaf665c171579a4442b75d772526eb50bbd025a176846c7265ca9b54a

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K44LV95Q\irmoviedl-banner-relation-to-othes-pid2232256[1].htm

          Filesize

          242B

          MD5

          4f46b2784fdeb0b8df08b6529adeb7d3

          SHA1

          84b285d5553bc708be6405c145e275b31ee615bf

          SHA256

          4486bf20efcbb524f243c4aa9d149750043f8cd925f5b52352622692931bc45c

          SHA512

          b5c2fe14e9db0e641df249363a1bb6fd6da1f6046a7a8153d909889307548d44a6cd5d0b7cc9d3f698a320c724154760a7e44cd0ebea36e1d528ff351b181b4e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K44LV95Q\popcontrolofmultijobjsmodel1[1].js

          Filesize

          2KB

          MD5

          56727985cb20df7d558f5b6f2006c1cd

          SHA1

          81693e9bfb609325f6d203ed4c92851f28133e1c

          SHA256

          b15cd3f4980c6c156d7883c4630666d14670989b5b98cfa850057887d6bb3fcc

          SHA512

          5350fd58ea6c7cddd38f29365438a5e76f096cfc324b0685fe9df2c919d8366fc3d94653df58c2911e720aab51bc5c58a2fb78751579b2477ece2fc934e6446e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K44LV95Q\rozblog_ajax[1].css

          Filesize

          2KB

          MD5

          89be587009b55097a4d4187f7224bfd3

          SHA1

          e9a859a0113305fb38008cc0bd660cba2cf80fac

          SHA256

          c10114f28ca104f1da8bd78083af97c731fdd3d49b9c062eb6f9d4430d5c5596

          SHA512

          26170899882c202709773af3762626bdc053eb3273d88a4b88ed2b3d616c315c8f57026b7b89b124f7dde2774aa9a1731f2cf47e0f29f5bb035016de316f5ab0