a0b1ec9a75a2a4f10d4a493828199a7257773812a3ad7a23dfdc1abd5eadd49b

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

606251f0869484955a237cb73634ebe9.html
Size

1KB
MD5

606251f0869484955a237cb73634ebe9
SHA1

d642dadf346acadf9b73136dc3ffacf6b5e1a7be
SHA256

a0b1ec9a75a2a4f10d4a493828199a7257773812a3ad7a23dfdc1abd5eadd49b
SHA512

76fbfda868d761440c5c8ccfcaa661c1c2796053aca47a9b7af447ef554022bb3f0e509cb5429dcb62204883c2712e122eaf6edea9fa8222b4a0f950f0311b82

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6B39B31-A166-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000054f55c5d05a6d6af6ff8cce1da89b0c4e09db775738e15b01cc0218d846a3872000000000e8000000002000020000000b0954a4125a9aecab57e0a12664962cd82287965ee45d883889a20f2ef5d83d9900000004bc1bebc0ea3efb9746d97fe8e58e6e12c7021886f1ee065d8d23ec815f0bad9876c51f97f226ff1f58670a107efac5be780ed5877a7870dcfb7d8dfe9ddb52612915f5cd0a5b2df544730ead071dc3a4ae1cdcd3f895deef477930a818aadb08e650084336c8e32cf0abf1ecd38f23d2aca3b29f5932be747589454d9a1b83f14081dae6ec66d5c9009bdc901556d87400000008ebaf79b6d0801862ed79f3aa474cf5f0c73df9cea491ac17095510aff864c3c84a0c9a4d6e1361de264b3ec26ebbb24db7ed0e50804386510a5767947f68b1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000397f1b3eb74ae9b27d7388366a0ec3e72c23390754cf5895928cbaaab1d50b70000000000e8000000002000020000000fee45db5d3abda7e21ad153e8325d0b15ebc12ab92ea67a6d73d59e694b22b75200000004ff00f20c51b1857df2e62aed738e2a17c158a070448b8cbfd2aa3a93fbf193440000000c6b86f0b670b5cc19a8ad94941051487c55b7f17f67fd64fcfa6afb35a9befb6223733967f0eddb0f58fcec13feefc4cd68f5cd4006262a1a528bcbbb3e2cbda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3058d0bd7335da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409479279"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2576	1712	iexplore.exe	16
PID 1712 wrote to memory of 2576	1712	iexplore.exe	16
PID 1712 wrote to memory of 2576	1712	iexplore.exe	16
PID 1712 wrote to memory of 2576	1712	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\606251f0869484955a237cb73634ebe9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4268c04326e53860887d69d8b5908d64

SHA1
b65a781b165f48bc3c5f69622ecac57371a86e72

SHA256
459247048a991115f5bf8bc7e3da901c71f1f2245ae5cbe4e192527efada4065

SHA512
37cc52e3c15dddea3138b820ebc04074b665d9e8135748dbb0f68849eebbb56724c14e4b5e1554a967fc39dcfaea46eecfb90556c9cceed64bd60c6802b593b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5ad9d3733e876e7554f702dc81ce9c5

SHA1
2a55279f47a34c390940740aedda95a168258820

SHA256
73a432e258add73a5a38d561b0a4036c5eee5d4f5a6bed674847958178083eb9

SHA512
14216969bf52d3e401dfa738c8b951038aa49b105a33e073c26d9725825a67cfde2cdf31e373311567898dcaf2073fe6a1df7d4e48252a2981b2afbf85736d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab2d67de5ee98f46653343869dc7e066

SHA1
efec572e2afd9569351e17344e4ed3972c2dfad6

SHA256
970786aac712b2083234c75aeeede245b1ab78f27a22617c38f4ec57e7b0465d

SHA512
0431b2ca037ba214ff7de817dfd9535d435da1e8932d24d45e7f3c9c2981d8b3c26512d0233e30e258eebdda1185c1803b3c4c6cb3aba29aef406f1793f1e23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de3b33a72b6dff4c02dafff792bf7586

SHA1
f186fa9f449a0cdfb81d203b53b4e37e0f7c457b

SHA256
af3ec853e0742b17ce972b32ed7456addca719e699191b277d4e21d97e13b541

SHA512
f5c32f8eec9f93d53b982fd17aa04db8ae60c5fec4c21e96bb3394007cd2ce422d49f59eff0a68eb8776e5cc5189c4173d75ae6e69aa11d9f0c75d838b593908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a33cdf8fe277057d00258e4d228fee

SHA1
855e5f8662354f2e297039e6b606db481633940f

SHA256
3650fa276b8c9828cb7a1d6bedb97b044407f4a619521ec6daffb9df0c6abdf3

SHA512
2e948d24f3b22c95de3f05bc42a3d713a9def8b20605c245877df216352907ec59965bd9f3e375915da6124c2723406fcd177c4b1b7e9cf01d71e316ed2f9625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0981797fd6559d4c7598b218b9493cad

SHA1
011e030be423071892dfa8babf10baa65935dad7

SHA256
62f9641b3a92979efd7270de40a7660ffe28ff063dbacb529cafccfc1554b65c

SHA512
a2f94630ad6ad11640cd8217aa1554a7892733654c585ed81c94313cff1b201e4512c2f487daa837c089b7257ee10dbe98bb457ecbeb4e01df0b6ee4d2b7dcda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3e505d55af0d12f7fbc063e28a6a78c

SHA1
f9a742ea3237eedcdc0418878175b4b8c579495f

SHA256
005a3b72f2d4f5acc6a3537d10cd7e02896500ca74c6f3352671203957f05e49

SHA512
9b95b89a771ad2c8700a9a13df3ae1d2e97f0f7f309ed118638285a59f7691ecc2528d357d21d76cb728f655b3585d1180e057e03dd7a59709edf37b580854c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96efe9b3eda48db83c119902334cd744

SHA1
a8219c5b3baf6d2b411ac344c56b4bdcce46ef05

SHA256
574699594c316f7bf1882f149a559be99bafdb2b70d5c4c97817ffdf52918f7b

SHA512
d74a26952e69f843f1065ba4aa661017de823f2fedcdd43f36b7be9c232342a8fb5f62edaf6a4914055573677c0d4535118a92d8b3143373ee30332243d0be02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b944f3b67358f16506d91b9f9c07f45a

SHA1
014a7a5e193c57c007bcb56df13969b5c695eeec

SHA256
f0a7d49f7e24811c6e8a47356365c7b575e4cecb20f5008ff6d9591bbdab8a0f

SHA512
421d5b1c3c42a710aa6e7826d51b708e3680f1c12d0cf333483c1fad4d57d8d8f4455cd08ad1372130fd4fd6a0a540f23f721ac30179b700a61f3301dad8fe4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88917925ef426d8786e8b57004cf8b0e

SHA1
ae83880f1be52317c0b661e1700561e719ef53a8

SHA256
448924a70b2659dafd3373d727c559f9fffe79b10c5ef0555e88c0e26aded5b5

SHA512
7b80498591cf2651fa2a9b17c2b660ea1877ca5adaeb7583464810d52d70fa82f886f48cae8b959f7324ec2eeac7542e9a7d18fc78247dded71376b4739a548d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2760.tmp

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2936.tmp

Filesize
1KB

MD5
3e10a2d4bdc445f00a4ed377e2767dd4

SHA1
b3f492082651fe2b50429be102d9042772cef9d1

SHA256
e8db6a99a831be151954aae5f61ac500ccc4d8f12490fc848e63bb7311cc9409

SHA512
8fe0d980216a14ed6a38cef711778268268667a0a6541967d400642b35b92ef7657d3f889c88705cab102992a93cf45a15f6b7e2e39871b6fa9314526ba916da

Download Submit