c26d25f69d605620af081731ab1177a105a5757653576bd52ed208fa2ad0cd3a

Analysis

max time kernel
0s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6925b7f31ac3aef31a3209bb95d96944.html
Size

852B
MD5

6925b7f31ac3aef31a3209bb95d96944
SHA1

98636798e0aff4fe693aeed660d8cb92ac622c0b
SHA256

c26d25f69d605620af081731ab1177a105a5757653576bd52ed208fa2ad0cd3a
SHA512

ee5c3613eaa79c02e4174afcd42deb1e626f7a34fabc63ce8aa3496c92679d35a522b299d1605e37d5b083b8e6f10dfdf0a18b34407155e9f93a6dcfc79db058

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A0FFC91-A173-11EE-88A2-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2652	2060	iexplore.exe	17
PID 2060 wrote to memory of 2652	2060	iexplore.exe	17
PID 2060 wrote to memory of 2652	2060	iexplore.exe	17
PID 2060 wrote to memory of 2652	2060	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6925b7f31ac3aef31a3209bb95d96944.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8131c417703135665e6df90c97b20128

SHA1
19c551342053d5a5de6cc2b4d9e7c13194daeefa

SHA256
d0d7e98bd2e609e264f7d1defaa0329d4f8dd71a9c6b8a11b98ce9f053887dbe

SHA512
01bd2702afca7f3548ea4201e21e2424f0567d6bd62b23b5220adffebe4f47c13a6e509fd66acf05165a6d3f444f659af85c1b0b387f76ba5401fd5b8ac70df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d5f1046c1bb04b13773b9020c00b8c3

SHA1
b3c1dbb999e908fcf3c2d45c80caab8fe4d8598a

SHA256
42a06258269366e50c54fe4a66f2b145c67305bb2db5f0e5100bad4a06c8e59b

SHA512
f454ccf675ce8f1eb79e7b40aef56808b49887a746a2ff2833b00db98abe6ca111f3dc2e18861c24fd5756366e58f97435a6efcd2ca36852b99958407ba3fe19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67e8005b6fd02fcd383941d03ba080d9

SHA1
80dd9a7681174953ab06cf01821baec8b4a4485c

SHA256
3aeb25a37987c6d83d4b6b521134794090acffe2470710691bf3476f610199aa

SHA512
013d6e7ed50b4197c382cf323b1dfd04e0459ff1e29e62716eaf2429b764c6ce2bd3e4b50bfe3ebad45d4c748e88e159e2c8b885d2b0a1b69cd5c1813bd95c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b474056bdd9215a4d5227b756d8204

SHA1
2159527fa1f2010d7bcc1b9531203343dd9862ef

SHA256
24f92e277a04fc13433f36eaa14871f885a91bae178ffa65586e761d7469300f

SHA512
f35b208cb7b3eb56be29ee9b528eef195cf4f047aa5271d39db4b027791be1296cd7a681328d9eaf66103fe522a3fc1a88cecc4681b1ee9bb0e736e5ec6937d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfab952a8cd3bd31bea1d070e36b5a9a

SHA1
fd69e2b2c600731c402f4181f43c9d412bf72d26

SHA256
4173f6b728600ad85901120e505d5ce8fe6a92f66ca6dfd64051b2aeab0a3107

SHA512
64ac8faf19b40c52c62a3ead4f0e417bbd5d18d5d10ed44fc2f091c9993db330417a8066f6740fdfb660b23cf0e3ee7b9ff6206d163fc76e35e2d6c69a1eb04b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffbc854a598c1fba84660adc6d4c3aa5

SHA1
c26c0d4ed7ad2d4c08f5859071bf99f2379a35d0

SHA256
5b5ce292c4722f1e72bc202149a1d2d0130ba79bd71c4e1bcbdb68654b48d3f5

SHA512
b796d6f217e663b389ef197b8975fe8679b5f9300735cdd64428325cc32254e2f7cb2a7413347261a7a0557d4231eb6e135072dc28e8b7a2a0ade62aad258993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e868c24421cf2c9fe1be7c5ee7465d6d

SHA1
a23e1eacda0c652b4104d7acf8a18b32e96cf560

SHA256
ce79b2a1fe9d1cbed0d6c8a925b6fc702c153cf245a88736b9e4674cf1885dc7

SHA512
21b30d7b2fe5c18ccb42149b414fa4b8c6f13cb7fe126f402e98961d8b83fedf8fac5b8ff2123d8fdf4ac4ce88d3feab84c7e97eb51ece8b7ec4a1aadb4ffd9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f211c0c55bb3171d79d1411ab67254

SHA1
534f7c5684e9c49d9e8496e6fff05c76d188a829

SHA256
2fe8ca8940be618b4a1f85852b8b8df6f9f3c38b853d1f7ba70136635058015d

SHA512
36fb7fff61c2424d84c3c56d5b3bbb3fc7f40c8486356c43e62718b9a8c618d950a1cd3f4d95fd3fd80ea5e2a89b7657b6f5fab860b2dbb32231544881fd0be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3e052af4fd4a9f8ed60178e8e2bc09a

SHA1
9a5df3ac148412ab258f5c8bcd67237c10f89db4

SHA256
ef3660c6eeae9fab44d6679a759bc546932cf37a2cca0a7c64308510a9c29d6c

SHA512
57e6f18bffdceea818da94d9d48e5679f5f3b88b932318d481af900389f12d65a837c6d7ac9d534f658446e1ca15f19956b166048bdf7ca0cee1e175c3c43328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3f5146beee117061e57e712b11919f5

SHA1
595e9f34ab16f3744684a5e5735eec08f0286db6

SHA256
9f643f979c1db57ee74b4761265b85db2d708e360cba269df2a8ff4a1e65cbdc

SHA512
722a94bd51cffa876b335a56aeddd7aeee93011eccf4ced04c124854a9b63de4a7eca71380bb3247d32604b10c80734047d6e0b2b17c2baf04f1f12179442b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf2e0248fefeb22dcbd05a3ea9e3a99

SHA1
5f184326fd4f4ceb7037c2ee4130112c469edde2

SHA256
e5257b19308f6e1c37e3a90388e2affdfae976b402b97aa0abcf3b5b5662f07e

SHA512
5118d5c1c06fbe8829eeb71efd7deb59f595335da124a337824b9042fba9d1aef40fce0b4688451e405e8f7ebcc2b2ba609cffc297652a6d682c10a698e54fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb025a8ce8c1390fe4e4efd315523b34

SHA1
681a0ed64d6c44cee3e559757f048b69f707c0a5

SHA256
83ec54a02456d6415d12f551850c6c83d55ff6ffba21a656e880f402fe09eaaf

SHA512
22fe8da2bef9799705abdd7b2deff9a8fbc2123f79cde70c7370a8d42540a0a5552ee1017d3d77419a75f8b4d0574f17384657bc648f0f0b97a3d49de3639562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07b757cf05700d8071f5ad7ef2466219

SHA1
ce8477c8f381d597d9b28a91d326b1f970b0eecd

SHA256
4e2a53b0955f39b52f7c621efb2301ae62ebb12a877d0f6f4c79483bdd36b34e

SHA512
889dbbf052c0cb7b90b153539fc39149d88aac9f8ad9337d2fb48977558fea2286e22b9906aee4102e6b1f71285dd052118508369977885962cc0f43ff15d5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
034d8cfdcf503a515d2ab54c03a902ff

SHA1
ce7cce75848ceb8e6fc04a4c8aeb8644def811d9

SHA256
cf8cf38c59a40ac6ac67f512db36e3ea22eb060880c95bb5f193b082d38d334f

SHA512
db796ed7d687160ebc39ced1eab4bd6f72ba9685e510547e27a66e46faf7069482eaa3ed2ff3a2d955779317dce05813d24132e4c37d27a45d735ae493895a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
993a8e922e4117fa22adca193abef71e

SHA1
23dd1f05781098c3059152274fce8b34c74f980f

SHA256
7fc82146683614c9c91ced54ef9424c6148f95e839bfc40a970d0f1b39a5d900

SHA512
f7c1a0daea062adab7f85a930e3097eded0101404df7882b1df46d007172cba8eb38114c83bcfcab8f59fd26b6db4008693f1aa7de712336e1b8af048ddc3e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f23f0974475aadaf6c3291547b566dd

SHA1
a927bdad0c68ba4f60a21aedd4b4c9db4e573bfd

SHA256
2dc3161e3a8b935801d3149af16f5de7f1e40aa031d25b3f9974579dd07758d0

SHA512
177651e6b9f327c02590021a64834c5b315e49c3ab16d4da1ae8fa7df86f13ae54a2718fc906ae58ee8673be7e40b209e94087b93e57cbc0e6f0bf10f99e3429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab194D.tmp

Filesize
63KB

MD5
ec13f710a513e155ecc5113be9086181

SHA1
4e1bcd29f06ade2975eca94ddf803d1e024c384a

SHA256
476d9bd2f32ccde1ebcdd75b61f5004ae6d118b73a96d6e854884b628da9653f

SHA512
991dfc1f28008f824afb25cb1e13ee89a0e43c003e31221dda5ff314197ea45f098639802790998eda391f2c2ec4eea4890e72afa92351c252b57b1dceb59b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19DC.tmp

Filesize
58KB

MD5
6a038a6f922510f68b0dccb0727253c6

SHA1
0329afb177f6d32aaec19327319fc55019c37aa3

SHA256
7930c421d714b19d6b75fa97538121e5252e1d6a8f33a12a5a48a204a2882056

SHA512
8c3674515d69e8c6bad4ada6a9522025eb4073fbc4f2442e53d1c29f1aa5ca082d2170aba356716d3cbdc5f965ce08ebcf1687ee6e90cedd5113f23da5e25516

Download Submit