6e69650204c64376d94a0ffb3291e1a0553a75dca9c00e22cdb0f796e63cfee2

Analysis

max time kernel
138s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afe8ed99ccd5fca4cc366ab8dfad9855.html
Size

41KB
MD5

afe8ed99ccd5fca4cc366ab8dfad9855
SHA1

6cf15a0ea10105e3afeb5f70d802776e1bee5e88
SHA256

6e69650204c64376d94a0ffb3291e1a0553a75dca9c00e22cdb0f796e63cfee2
SHA512

17c1d899394b440b534af6528f49630fb4581ae0f2aedc1814bc3f933cf1d0d0e176950bafd17596969cec89e6c13cffa5d5fac590b7ef51112eeb4766177aa5
SSDEEP

768:65WFt2VOzeTlipC0xdnmsWZkVZiS9fJfff0DbDcDCD7DPD3DdDODn5v17ZQUx:65WFt2VOPC0xdnmsWZkVsS9fJfff0Dbk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409261245"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50F51C71-9F6B-11EE-8024-6E556AB52A45} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2408	2024	iexplore.exe	28
PID 2024 wrote to memory of 2408	2024	iexplore.exe	28
PID 2024 wrote to memory of 2408	2024	iexplore.exe	28
PID 2024 wrote to memory of 2408	2024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\afe8ed99ccd5fca4cc366ab8dfad9855.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffccfc013fa4fd7d4b42e5066a43843e

SHA1
9394525ab35b2bc5c8739d198cdafbad198e1f1a

SHA256
0f761b507973721c6f4cbf45266176dd44cf4c1e643e062620deab0e44a8eba2

SHA512
1beb3a7e77e313293d6b90b8975e3290702ff773725db77084e55bfc6ad65eeab608bb7b6eed836e49e130f2d92ab85c315eac33f61f4daaf2a23e14abb5bd07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a7c29917a884f6992e671188be8eac

SHA1
d4732e78639ed32dbc59f0190e5d91ebf32f00f4

SHA256
d5f9ec9994546192a55194085f4faf90c702baecf17f5563d96875105a65ca0c

SHA512
7658196eea0bde2bb959edca38b40e530096868389cce48f65bbec9213662042e2b9f58a7427ea1acd60adcedc01a039e42f3af57702d32d3ec05768a5bbaf5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d52b85dcbcd864d0ae1bcac2b8315ba

SHA1
b42affb63948291fee7cdc98ce959cbbc5515101

SHA256
4bb78e89430b9f5fe9cab6601160c313f9ca1c44321b96396c8032e0ae1dd35f

SHA512
879bf19d62d3ef6bde62bbaea351461562769b90028feaa4f275f29a5636f8ee97f868c298036e91084d422fba087386ec05b0bf67aa019a09b9714766d46010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18b57c8953f908a62fa58a132afb6d9d

SHA1
28b96c16423d391ebafcbe88a69cbb551553a468

SHA256
144a4ab5a607d698d3ed74e850d48ea8d2f68ed5d350ab5f1dc90b4b0b4cee71

SHA512
7c36d9247716db703e532c57b29d08a90595efc5678d10c86caba199bdc69e990698a28633fff6480d71cd71aa5319866eb770883c5bbe57e668f63308e40da4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2abbf5471b4e58e0d35adc527a82a80

SHA1
4f337289e7ca2115715da96a7826b4a8d56452eb

SHA256
aef500060ecbaf74e2d48f8e067c270d96e7d481ed008cb600bcd3344aa4b004

SHA512
2832c63d6e535bbba7662959e9effaebd7d1ecc53cc9b6b49b96152ffc5706f395ba1889dc27e5712153538cdb29bf2fbf279717f47cd119d8915ccf276cf57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4252372ac73de7b4da83631a187cda09

SHA1
37bd4b34d95e6ca970173e937589a0e02c08edb5

SHA256
099caef2aec560ed4299ecef56dce88144f6b2f0a1ebab65c5af153d5da29cf3

SHA512
7fbb9839620d24310d39e278b337ec246f581fcc790145508535a568630338798c9616806be25ec2e5883170c5b72e6b643297807f69363f37ed9d8d1e7f7b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f3777726d6fb50ab051b55d113c9f3

SHA1
026a640fc8c50f52f06375962f870d982a951462

SHA256
a540e382c56f1f79738c43c2f60a1d6859f0f6144668ed5ac82d16daf0991b0c

SHA512
35b80b6d9c8259ef3b3b55dbe62cf23ab95af5bfa029670aba8d77fc2066252d785c39d7158c448d86835e4d363008ac8b93177c3a6b523c5c3182774aa15a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46984317c0bbcf03ea881ba3d04d1e1f

SHA1
c80b6fb721369b8ed97d550af357e76ad9e823c3

SHA256
d6b1adf769d2a00b0a26e7eb795602976b450a670bfe11876683361ea1647872

SHA512
cf0667c5de116a1ff9074e667932da1489e40fa350670bf5f9bbf63b852874b60fcee07e5acb47696ade38d3fcf6fff58b998b19c3323139742a05b6e8e32447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b195c344821d20e0a401b938a2ae6aad

SHA1
17a1ce30f7b3c037236cb14bdbca26f77c768fe0

SHA256
22ba26a04be4639b47ba8f1e52bb9634869854ae485d3fca27a437513fbde164

SHA512
8c2883a90e71850f6a14741300268e5c6c9755927d1e5cc9220a5ca0121bec9f67501410f79acc4577ea9a64c958061c43eebc6b2b27d8eb75fa97d1dca8bd58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
390d8d1e9825ac44d44462d3f1c4023f

SHA1
dc96dc0f4c4615ccddb54a016f2bc40682edb6ac

SHA256
2b48650541fa15cebd326cff0c0df2d5753ec82878e1ac1dadf294a29cec1839

SHA512
344d8a7eeebafba206639333aa23a043b2ce3c94df61d85c4c87c58d6f8d48d0f08c021532907ef2379cd6f6804d353a7f2ec365c5babe07fe2ab991a8aa34f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A35.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AF3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit