23421d5681bfd3aa75d1a00bb418d9df40c9a915f7b4e70e3877d5d204e7d537

Resubmissions

13/03/2024, 16:53

240313-vd8bpsab6w 1

13/03/2024, 16:52

13/03/2024, 16:52

13/03/2024, 16:51

13/03/2024, 16:51

13/03/2024, 16:50

13/03/2024, 16:50

Analysis

max time kernel
1566s
max time network
1573s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mjjjj.html
Size

15.8MB
MD5

5d82050346045d3c2ff2677436e8182b
SHA1

14034ec0db53f3c11cb11dc095398453d6fb95c7
SHA256

23421d5681bfd3aa75d1a00bb418d9df40c9a915f7b4e70e3877d5d204e7d537
SHA512

c9221f7aab9b1d37c89ed61340f606d219835fc4080a45d5d50b1f3679d981a61e2cb5547060ff4ca88bd9f80d4e9440f49c4b8119b540de8d1eac57777dbbbc
SSDEEP

49152:fmDz4cz3oSrcBRlyqYGxGK4xsmgrFsomEArSBU2vIzhd1vGSlz7m+1iIAT9dCHc9:TurinDiUxUYhH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF3791E1-E39B-11EE-ACBC-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000f87bc6e552ffcb43d2966a0ae496cad65494f30daf348d294822d66fea515bf8000000000e8000000002000020000000f5039cef4174f12b62386b8e9a1c38d2c661f8f64e1eb046d3d466e3b21239809000000077baa70f6461600df7a942034406a49a3d99ce50bcd9bba698bcf9a8bffb573779de62c1d1c95dcdb0ebfa72380e322715ad2a2c16b4af6af0af69e8cbe5a4a5c45a4d4a035fb01551cf146a5f371e83844ffecf533f5df597359b22f773a08656d5e7a454ee326011a5ba3844b1c87dd59df85ce86ca6a6e5b56fe21b18ecb371478a29f1f104b2417c807cc8b4cb1f40000000bc43ee159f69b413bb27f11048227140d16e61a0a130a39f9f57ab69e7777bf71adbcca4202881a76d1816b1c4176e5b72578d5e7df7ddd761feadee9553a6c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416758835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000071080cc59949573171a31c6c6067ac5d7242ad08757da0d19b8f075b5f5004d9000000000e800000000200002000000095c790bdf2aa7785536118b7531d00885605bc81cc1872fbbc3ca897b0e81593200000008cd2a6eaf89acaf62bc5fa76f54454f25d8a8107e98b872a55f8ffc510b8446f40000000c11000e136d227ed60e3677ea6cfa05d9131afad2e76d0afc057f4a4ae1ae960c4bdb02f826509a79b41e2b276303513ee3edbb7ad31989b55cb77d7958046cc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001f0fd5a877da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2684	2096	iexplore.exe	28
PID 2096 wrote to memory of 2684	2096	iexplore.exe	28
PID 2096 wrote to memory of 2684	2096	iexplore.exe	28
PID 2096 wrote to memory of 2684	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\mjjjj.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8585dbec89173e46fdf9be01b79a638

SHA1
a80d12a71d4492a607a63976b866acc286b939b2

SHA256
beb52011ff13019a6e7fa9fa7032f5ccee4ec07a33243f1caeb31c9d676089cc

SHA512
6b52e9e3ede61f0471cc24079208a00e6cdb24f000ec11969ec5ab60ec656f3891aa6adfa0e2d35d9a4d66019c546cd2b1d5a9f8d90e157cc1b0855183d7a141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b182a8d428fdf2555b207f755c99952

SHA1
3ce200fc9870c07adefbd9a5ca97435e13994850

SHA256
15d1d19c9808adaa689ee2740f18f86fd849f3472f38572526428132b494b43a

SHA512
073f3aa71c58f49992350e7740e2bb9a3382e46b1b52e8afe977561a2f030614a70c836093860e9a690a50ec7bb46d843e5c57ed78409bdb37cfa3f8efc2c53d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3656b4ece79c3524cda333207e9e5bb

SHA1
2164bac4bf5f69a295d6b2f531bc8722e68bc970

SHA256
be81774d430c7fb614e13c38f9764e6e0d9b18bd45c89e8624dbdd206a24c73a

SHA512
e6d4dd4d5b0c5e1ff2c4c7e60ea96266ba866e7357fe4b1a4db04f4192f8a9d017ea730674cee5b87e00e31c2e8ccb03288b8894183cfdaef0470a6a1230c0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1d818ece3fdd4bb331371d5965dd18

SHA1
2e2fd4047eb58c17ddc4138f214892900315b429

SHA256
3056d519cb6d1694f3c1ce22b3a123583e37f263964f87b16d913907cc659b6a

SHA512
03198eadce40f9fc5394415f49600f14d5b192bed1bf28d02c59d94274b117ec1b0916db879c24d9665ad93231f729976be1dd734b9b190e6d6a2627bdb724a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec8b21b7dcdf06b955d77f726c58387d

SHA1
d215fc630877c51b6f701b8aad576c1829aa8164

SHA256
e06b682bf449912bff0ce29e75c956c5643e6b95a9e31bc1c32da49921aae83d

SHA512
1945c7052924d23a51e52b50336e0da28deb212410a1591dfb9f6a44529e9cc1797235b6c27a9a2b57ec0126a5ade8c8ed4eda13b3026e06ab5ae1b4cd6dcbd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba50f0e5418e2d2ad8f167a5418d4a9

SHA1
02b5d57d14697de41b602606dc94628d05825b3e

SHA256
fc278fa21fab1c91ff75e90782fff9f835fc9fe45ef1e87a37af1d0d8764a0be

SHA512
ec2a8a2cf1a5fbe5f3d6170ac754a37d79ec52543cd619eaf86c7204133be2c74023e5b62c64c15af53f7256bcb3cc8b7b0513db2488bfd1b127d4462dc782c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb044d8987a53005ac4fc4e095789be8

SHA1
47a31fb02e659dec40ff647b9579b84b25a0f077

SHA256
c137f72ef83fda01d1a4545997e4b0888b4231f18cd43027746f1e4cbc6cb0f1

SHA512
dcac2b5487ef61cb18f34983926d531c66ceda3fc3ab38e195daf8bd7d1e273e75f035f2cda22e67010acc03c953c444996f2eec5129f46e40445fb7fc2098c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bc4408db505a9dc758fd47251f05a02

SHA1
c644a7415226fa486e577e65cc86903cd10305dc

SHA256
a353e70c188c142783007b1d869921b0b7a9ebe8d7be3de840506b8838f75df0

SHA512
aa994eb5aca0c5494c19dc7949ec10711217d7042923d12e796afcd05d65c0ad966727298bedfa7382fc266b777886a0de4030753ee93f6bb331f5b9b53a68ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d528df870ebabde6176cef5c98046f7

SHA1
4ff37b8614c8855c637d1e9ac732c8a9d0b05504

SHA256
d890e4e0f6ad3a15dd9d4ca3efdc2283d6aa580838f3e72167b3c84c0d8a0f6d

SHA512
a2dee6f2fb1c242e39fce872ca799135b4d5d37d83b9814ee08ba55720af1e66aa511ca1391140c5cc1c943febb3f6309d0070d8042774a82541148f2841107e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dacb714371a0082e301378f8fecccc38

SHA1
961b122725c2334de826e93aef02d147edeb3163

SHA256
e55407b3e179e680b405765a899b2b631d26db8f5dacb887f5b816baae26627d

SHA512
0347bbebd52978bb48932717854da54439f36a6c101bf6bc562229282126a769259330fc80c012767229762668cc304055783707aae9090c6d0cbc63b9344c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d810307917abd421b93cc347b43ad92

SHA1
9dc16801263c6ef3c7a63e3f64ce0ef9f167c4a8

SHA256
dc75db2c5e78e58b8a2fe2833096b0139a0d02d2eafcc994f14ee86c5c39af02

SHA512
9aa6a15e4211345a970ca9294309f3ba4bcfc375f089c1907e59e41efa12957987fa683ed2e14cce04bd8262495c913b9835136ceadd4eaf3b724b6f92a9e770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d596b9e3bb0f595cc6e5018950947b0

SHA1
e14de0c497e94a0aa92ca5d404029971500b82ac

SHA256
1a3bbf1d1b796bebaa260c733c24d16aebac8495d873c4d7a7ebd1b60fb5a149

SHA512
d6ed66332a98e433c47915539656b294ac93fadd687a1d19ed3b2a8240b5e43b1f4b40c5a68626777f7d50939ea60809431dcec32a10b16bcf6e15e474381c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1c05a785ea540d8913b28686933acb6

SHA1
14f13a436962b3cd7f44a4b60c7ba1c04d8ed886

SHA256
c3c9b29f317f62c364b2f65276e98ac8bd9a0fdb11eb0dc4cae9a4109b234034

SHA512
deb42bc643fb5386cb1de3b5d655f7ed4b8b30fc292c0e558cf364824f35c7a4a4d4f53a18561cdd4e88368b76788e2d6f72ea2f086cceddc82b1593abbd5f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90A6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit