6fb1c66d3c1538f07e10aaea2e953d59722fa6da71973a4b1e230513aa05b43b

Analysis

max time kernel
143s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62536f1173a012d7844d114f6682ea15.html
Size

1KB
MD5

62536f1173a012d7844d114f6682ea15
SHA1

1bfaf419bd717a2481f54a73c719dacab21bf42b
SHA256

6fb1c66d3c1538f07e10aaea2e953d59722fa6da71973a4b1e230513aa05b43b
SHA512

074dbd52b4d170b7d39e242c460e1314398b92cc63fa1aa5f01d4ad0c452214572a1246ddd6e7756eb0deb6828df9e9a32eef6138c0b8c4c9d779669cf3667bd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409480565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F19D4D01-A169-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000aeaa90444c87b91fa52f4aea14a5e07e0d9dccbfe5b2893c9de37c1234534a3f000000000e80000000020000200000000cbef77d3495b6f72710033facc470569d90e181c4e024ed084c9ba6049b2f0e2000000056bd3cc028fe06cae1aca0da8e5ab4336bf57571e9cc27dadae13bd5fb0720f740000000a23e5ae2a4f47ec0b96227d35ccaa443947b717f991322f24dc0979aeb3ff1cf2eaf3d9ebad38ccb2de4cf3c4dbe8c314df0b4d91ea03a037a1de2291776a8d4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e56bcb7635da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000033f31c893899056b57d7c362d2b0f0780f6548164a052d45322807e3863311d2000000000e8000000002000020000000fb99dec67cff478db3c648ae844c9994e8db614162ecd427c21e29cff7f3779f90000000ee9f7acb8eb17c11f629a6549cc26df8d11f6eaa46a2f8cdb408309618868d14dd09d44a8c1742f92a618ae3c2182c6e1546ce63184baea2eda6c0102d817cd96f3fa0708a9946f344e002bdf66f07770e73ee480e0050af66d4e2e238b90fe4f0c153cb6c3efd10780d5edfb12dc788f9323841a7cebce10f6a4dc053aec5e5ba16f156f0501ace4042add3a392b5ee400000006c3f0516010b9430b59a4943a55a6eafe0af046585a232077c15e5477f9f310fdbe55d257893d9776df23c0e4c837c0fd8d04516326adc1eb42adf290e46199d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1664	iexplore.exe
1664	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28
PID 1664 wrote to memory of 2840	1664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62536f1173a012d7844d114f6682ea15.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2414b6a104d32d35ed9ba426c1fca7ec

SHA1
86d6099616f3fbed086c7b773147be19e385bb75

SHA256
c8720878222a3d01e50fd88257c7691fe6fd043048eb5b8ee2664b7e426ba53e

SHA512
373f00fd27cf8bd1776b0d1eecdd6575760df0bda2565136681d18a5f39d003d8aeca827af27e43c04146dcaebb79d99440221c46771d0d6b78adf06ce17c09f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4855c7f6d0a04d2bf9e8e7ebf3514d22

SHA1
f66b07be9d4f4cee4e9d74b75843001070ac2f77

SHA256
416acea24dfa7bce04d83bd9e41f727f8ac0a47d3553705611fdc89b73e25165

SHA512
e824b2b80cbb51b86522e7cd2ea88cd78a294eff2d097c6b54b2605cafeb98075f8104d40860b25b9d54f8ed4410ec3e2f1853242579edf3186ea533747f5f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8997e281288e6613739b00d82d2c9e7

SHA1
49e423e07631499a1009398da55690e3c1ec8213

SHA256
fd57b0c1d1228e8be5333b9878a636c8da541911f2109293e998b087dfd8775c

SHA512
7d860063f9217208b2750c2e2db593ce9a31248990fb325904e04b668cc68d391a511e313a0ca83657e8cc3006edfd05a91c6fe49b214f5e16f046afeb0c7548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af2028a97c0c76f7b54d6802408fe6a3

SHA1
78bbbe97321e70c0ac4f8d0e52d4c4fcbc85f8b0

SHA256
6af762e412e6db0c14a6080198a828a9eb0f60da577cb04d58e80e205fa1b33a

SHA512
d5fcdd09486e3c7c598d75b45be81e9cd62d0ab897298ab673dba953be01dfbbe0deb70ae4e6754a8f1769c50d0c7a6458f3b6f08c001bf73a2a32113ac5d37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec57c53158b0597be35c95c439fe49de

SHA1
053a579dc4633686b1ffff94398bb0f78774ec80

SHA256
aa836f533926e3d524510af1161e1a655be16af5e5f936564008b96b6f839412

SHA512
81ec16e8710eb8a64bf380c45f3f9d89bffa93d73dddfac2fb6f61e4f19a0aa9abba719d3640c905f5bbab8c26e3bc012cf73966cee65d17de7a7112f92e0538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7309b351ce0d1a7de2ecd4b9deeb8f19

SHA1
5a1bf88a3245f2ed568f0ad0936bdd97646ab376

SHA256
2efd177bd6a44fe186d972aba5e36c33766f49a5a4bd8edc0fac09e6fbbfdcdd

SHA512
0915b903f98497cef8e8b58def2934546d24bfaf43aecdccdc9bfb519d3211ec11234816a0109ce5764024872d19c2c4ce38c9fbc4b1237160fda447803dd386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c05f4052412c4ac7e80049f7c94b73f6

SHA1
2b76fd6601b971f312969aabc48b9c597b699136

SHA256
2e45befe50b3422232bcaebea1a40606f6c2e877c70ec12b4652590ac04e099a

SHA512
3da8a7f4ff8fe9a8393b1ad246761fbc3b566a971241f6586e435d620c2861b4049d49d0a465ef72222ee3852844147dfcad4273ae3192aaf78d195418b4d698

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB24.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD0C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit