7d5e83861e190822ee47c540499332c9c6daec47bcea4beaa8b6678b639ba90a

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b90ed12ea8abd39769dc252038bfb33f.html
Size

3.5MB
MD5

b90ed12ea8abd39769dc252038bfb33f
SHA1

e4c673cfe391b0a49fe3035fafdc0437b58765ef
SHA256

7d5e83861e190822ee47c540499332c9c6daec47bcea4beaa8b6678b639ba90a
SHA512

12ca67f263a512a29f7a5af585805c3323bcabfe0ed6e8070b6b2479c1aca306956cf702410a283718451afacbd93b2dc75b4abc2637298564fa79e36b04e19f
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NID:jvpjte4tT6eD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415986947"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE11E361-DC96-11EE-B7A3-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000dda715713655b4c426496b72e735cfa1cd56f8c70007f435f019d314182c06fa000000000e8000000002000020000000c5280f63d75bc32d7ac6502c6169a17f821b99152721d4da0bc475c3f4d3c70320000000757af7031be37d49189bf4ea7206b37af0604eef32e21d0e281921c672545c65400000008198f41e13ceda33a7b3b4d8664898b5c20dc9a1b1e96ee691d68ee03e90baab3dea69d6e278dfeb60d9c151f0a14ec7325e4d242cb2650ea9469944069ca21a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000009c1a79e3e464eaf491f77cf1771cb1da99c4252036effa008d96521d3e9db1ef000000000e8000000002000020000000755f4fe15bf51c864b49a02451d63654150e66699009a42d5e913b79e90c9bb690000000a554d31f43fdda0f764758ba3a0234b1c19fd611ca341aabe10b291d06e27ddaa24c4cb3ca178d61bcb419f57ba1e0626ac1f8419aa9983b600734e7e6c66e439f9417e18d956da395c6770001ea1bb0bf4bf6bb4fdc26c69bd2f800631e0a1529aa25a67b85b322076ecc3113439940492ebd69556413a9be96e24d52dea1cc0c7a3c0d184d79d3876ee769f88e81f840000000e39d1266444eca5c1cf16402085c0c349a653bccc798550fcb8b238a7a6567d59c5ed44195e52016b0d8197ca762ab93867df0acc421732e5d14e8b60b619c89	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e978cba370da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1416	1948	iexplore.exe	28
PID 1948 wrote to memory of 1416	1948	iexplore.exe	28
PID 1948 wrote to memory of 1416	1948	iexplore.exe	28
PID 1948 wrote to memory of 1416	1948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b90ed12ea8abd39769dc252038bfb33f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f13417e60fbd5e641c0e46d5f7fdbf

SHA1
a2fed8e91992426e0604829c2a52d00dc78f3f03

SHA256
6546dce226323f9000e491568cd922d56fe5c3e93b0e622e846213ac702e8bb5

SHA512
4475b474f18a9d4a5d61913e7eb81e147239e17e8290cca993ff9829d07f6779fc41f50488f4836a89b4dd2c1c0180f4ed9dbc7c2273ad7f393c076d0fb25829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee1a92ed13de17412a53af914c0a67d

SHA1
daadc4620255d00e1beba1324db70a6aea45bb0f

SHA256
76120ef0cf60d4902e3539d4bb11c7b253901eb64647ac4d7f576f1239ac404d

SHA512
5c3649d932e7c18d8fe80cbda024dca460a426fb1d264de2a160dd3f23577b295bf5cca98f7a6752cbd6309711eed6d351d6d8253484bcecd93bbfad4e385536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc46666211439859d0b8e0ffac5fa98

SHA1
f9cf8f858ea6fee1b900887545276764757a3578

SHA256
9e24330b373cf7b4a3c3260208557be94833018709d0b4dfff18ee7d520ab380

SHA512
4a7142010d07b317cf5514d86a46e798d97c6a3b4c0f30f836e018b92b3f348eb62227687538e2bfa7d5a5d12b882225a678db228e7db789a2c016339c170379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d86b788a01d34166ceb4a08db429333

SHA1
394b1c7eff9dd98d3da11da5f90e9b85d314d326

SHA256
252c15f300dcc919813a47741a65915b45f41b6dafa27c8b32254d41953b981d

SHA512
58fd47101d3ec642c4787a0a403b933b5b01772c339c4c5ed45b583a0ee1bf179b874c45a9f0da9fd18071762735ad12b314cd7bd26546b47ef6634c4e6b4647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc37e73e2817ba0c6e5ef05e80f9f89

SHA1
860e1d1c9461ee20138e2794a88b67c2e9aea7ed

SHA256
353724fe894ce54a031ac854519da32100f7b71147a9ea8f93a2679945d7f9e4

SHA512
f3897447d650c37bffbb65a124f18d6353182699946e679c0a76e0cd0bc70bde70b8c7e531d5b90e8783724fbc602661b4efd938e8af1b6a5a73dc7b2461db00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a23eb2375800483f34a4ddd3df46f2c9

SHA1
c9479160a115a05214606b4e12ae53bf575936c4

SHA256
19ab90ec6de93d7b727805031cab741651e859766cba482109d2d0ed91f62bb6

SHA512
e5863532a34d04680fe6c8ae2199b5edd1674e55d3021bce86dcdd58f6add7e7ad5dafe4ead7eb8f690361dea230a387206f500624e3b75f2c494145ab1a90b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ecc8e814e72ab57df16c9a73e08f26

SHA1
53a2ea1efe030ba4e4737ff06e4500959d72aab8

SHA256
0b447e8337960c8a63527713bf7ce82cd14fe993a39b582c4d04ed1521dd5eea

SHA512
b567fb3a5417c1df5285586aaff791e3ca40d4c335ca9af202b1dada46f60e7579e915b4552b59c017f2e023401a1aaa5e419f7baf9eab2148ce3471d5fd6112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b080b5ce834994e4998781a71ae82448

SHA1
48587cb7af64847914c93fbd6d621165aa4393d4

SHA256
1eee0ce1dfcb7de0aaa560466599b0ab1d977b6be85b2eae13af344b788700fb

SHA512
5e65604836019807c06243ca00edd58f8e746179bc4f067946d7c048268b63472d83cc7397220a43466de855e3739cba90b5f9f2ef83b52d13f8cb89875537cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3113101e2bc270f85320d6c5601b6c31

SHA1
617d5ec9e13abb3d39937682305310fda74e071b

SHA256
7c2e13b11f7fbd073c9e69a928e18e679e563e7ad1b290a7d2b8b8d7c4204790

SHA512
6c0aa967ce7ca4f560f8555144266c2101f8d379f9163e223f374f2e9505a65d07696456256e6cf1fb3c339270a8f57e0dd6dffa1d550a924b57298fef9080f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c22d6d6b6d21075546a0f34b06be770

SHA1
ff3f752cafe27d4c488129fc986b4c6d5b6544d1

SHA256
1572d741eef25a79ee394c7805dd2b4cb731bde66b36e621ba6f406a63d445b4

SHA512
857d2f08d7d9f1edc18b2b16619a537f9747e01044922fcdcffa3dfc310245b1ce9abed8bb4d04c0b7ab9cb26349c32c830a2579366a5992ed09dd582496b07f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d2818ddda75af2da7f59ab63f6b503

SHA1
316256d87f26d59ea37f88b8007ca83fa9229a94

SHA256
5da951ebf1c39bf1922910299ce95c3c79c578b45185a7d4fc4d2c9cdcd6dcb5

SHA512
97919bf6d7ac020a102846cdf6bb167d0ad87233c116b65b137ee98b43adbf8cef720f4124833ee2f2a9d117728cb0b9b93138b60bf4388cf766ab30ac16ed2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23EIUNT7\beacon.min[1].js

Filesize
19KB

MD5
dd1d068fdb5fe90b6c05a5b3940e088c

SHA1
0d96f9df8772633a9df4c81cf323a4ef8998ba59

SHA256
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

SHA512
7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQQVSTWU\jquery.min[1].js

Filesize
83KB

MD5
2f6b11a7e914718e0290410e85366fe9

SHA1
69bb69e25ca7d5ef0935317584e6153f3fd9a88c

SHA256
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

SHA512
0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ0RD6PK\jquery-3.1.1.min[1].js

Filesize
84KB

MD5
e071abda8fe61194711cfc2ab99fe104

SHA1
f647a6d37dc4ca055ced3cf64bbc1f490070acba

SHA256
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

SHA512
53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92EF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9594.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit