f3502e473c7f7991403583644dd36e74068059c1ce5abc84d6d5ba70728bf922

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aff694e3228706cb5914cf383a5f9a1.html
Size

842B
MD5

6aff694e3228706cb5914cf383a5f9a1
SHA1

122311b5d00707a6097fae8b6d83658ed04ee87b
SHA256

f3502e473c7f7991403583644dd36e74068059c1ce5abc84d6d5ba70728bf922
SHA512

ecde5564053acae06b14b1623d83c43d68dbaf6f10423425a563261a7d4515fb2278564170b5b39d44fd30f4c2451e6c7d689919b57ebb5f0a89369792bb4f9d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009e6f1cc1080a235011de7134c0e3fcee7662a134129ce437cd5d66e15b741137000000000e8000000002000020000000b23a0ae4e261dfc72301c6f12f5b4cb98459da86305d9460a625568a7b14d4032000000084aa3c7a316d3e008a9bf954231f1730027c6eb9c467653b25e22c730a1b7bf64000000069efef99a96e6ce6b5fce37a70978988f8fbd29cbf41027a267ab61a0db0501575c29fd9d6652ac2a6b99021712897742c34f723480f88067e3411ed809c3b79	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409485897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ae6bb4a44f4de456dc06929ed8603499caa835d92f8565bfe2d3b4b421f0d6b4000000000e80000000020000200000000f6a838840012563761426c2ad82cea431fbf3b26f19ad47cf8bdc83750bca2890000000d1bff42d084a2718acb238176eaee52cf932183b1a524c2fc0a4e94bf1a72ec2076c9c2102acebb4953f56e9456d4060015432ff49afeb2000ef527065a76544709ac9d2ba2a22faf45789984a93a384a6add987bd70e2f8d7c0ce6988e464ccd145754c7ebb13dd4b519d328b1fc9e41e33885ab1354f43203020583fbbd09a117e9f47926ff9716841a7501aa489a0400000002b09f20dd3c5456589c5f4ab95cf27f52770b5a5beea87c66d1001634c748f776d61349fff4aecf5a12e0bcd6c4039bab6ee4dfc107359d1c9b04121525da5db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59D8F661-A176-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06fe71f8335da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2740	2220	iexplore.exe	28
PID 2220 wrote to memory of 2740	2220	iexplore.exe	28
PID 2220 wrote to memory of 2740	2220	iexplore.exe	28
PID 2220 wrote to memory of 2740	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6aff694e3228706cb5914cf383a5f9a1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c4134e06c784954e888272be811572e

SHA1
56dd63584c31c1c674a8e315d6b557d8908bcb38

SHA256
5c8f5e4a5ae3fc312c7f5ab46e40d93ca9e8379527933abe43cb09942ee72f83

SHA512
70580f4a078097f0db6ecaf1dd24e865eb459a4b09b843b30141514acdb6e58ef178d2a5a018b7a5c85861a07044deb8f9f29c4e44fc84dc3bc43bd1ec2cf786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581ef7a7c33749a0c830f69b03877f82

SHA1
baa144d5f0d25883fb3eca13e1194d44177c39c5

SHA256
06e682d214bf8573f18be054973680c32730105cccaba3f5327b3878c50d33d4

SHA512
72709328920a84c00301b8ebeef60396705a9b3a4ed5c7c69eb980194913a0826108002fb4ce2900bbf3a3cee183824f6d3348dd440021370c0c5d57e3538ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
909ab332a36abe8ee369b5705ee03614

SHA1
47bd35799087e490b39f8500c102ab4ad49e2cd6

SHA256
a9d7b13cac9e432d91a99f8742b5f1ae2f0b48b7a4fff8c65ee279b0e9f513eb

SHA512
fb2ced55fb4d45f58a911ca4fc78496c006fd398d9a21944f2deedd1a83b830c5e740f8ebbab05cb4d0e5cc8257c9b223b7cb882d2fcfde93c35f0bc685c8a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60603705c51de55552f3dd3db054f347

SHA1
5f4a79a7ce15ea21386da1998113a1b936af1b95

SHA256
fb631f22b3b53072cc8f0e5a1ee233452c244638c6d2cbcba0a2b7ce78e1eab7

SHA512
49dac07958822658f10f41a2e5d638b657967cc5230e2c2520ecbdddaf9bdea25c6f862de385b17504064d151ec7ddf98d7b83ae975bb04ee18553b8af98f378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c295cb993502a191069ff341e8c3e0

SHA1
7a5a0620f194065acb8b9a864b39b963e3e77767

SHA256
61d92f62d771e3d3da1af1fdfcfa20d03e98b0f19d80c2cb101307a43d5427e5

SHA512
3a5912afa6a1ffe1f1ec5639ee28fe18d52f15015eaee5daf065bafe379aa691976e4c7148a5a58c3738d8e4718e9d48967f6ea7a4bf0b96be5f492ee4afd86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4552a547854b15bedbcb76911d9075c

SHA1
18e7323d3c9d2582ba0a9dbb6eb71c181bdb8d36

SHA256
b108f61fe267b58bcbfda03168c2fb71645a84123a863b797a8d05474aa6b75c

SHA512
d938a1fe0940356cb93a276ce6c1e4297a28715d151b44edbded0423fd01acb448eee2bfd24d3cbe4875851b5281de2ee15d5388261eb0ac9a1984e10f26f454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a13ee260dfc6780b276cf93ba600425

SHA1
a85dcc485390ea46b02ecb025650b0bcf7e3d40e

SHA256
c5ee85a4b12d7967ebcd1224eb956743922a3cc0abd66895012a3828fcafdc30

SHA512
003f74445255deccd8db7384131694d02909ea153bc1b1e05f71cab0fd1fd63f8251358e4971a3f51ea97608a1d7d6535710054a6a50d3924eda505edf0584a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98adcdd0dcdfdf4c87b49af3c1bf0864

SHA1
688cc1b96ce90ab0205a7a5026b5675f517939f9

SHA256
a703bb89fa5abd5a01d73c3841bb01c18aa79c6bdc3b233d66950c6def03175a

SHA512
c9d605bf6fb252dd81a751a61498318dbd3da0f8aa7046d58621cf23200ee7646624fbb71f2599734fa9743dc54b96160a8d518653e6d08c22a3f9db23d1e6d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
991e13cbe98c4335fb28cb7f44598bfe

SHA1
f54c198ae34e106e8763a9a04610cdcb22acc535

SHA256
86adb6f5a84db694bf456c71c1cb79bb5bf4276b03127e40bebd385dec8be0a3

SHA512
de3e2ea57417f048e0f6ea8f4938951631950277ac862a504bc926758f11290fead8765812404274a930830b45e86aa183ad58478854745499a40cbd3e9824f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be983a76e8637ea443b7084be917162

SHA1
56d7921b9258e3fa6f03134febaea84c5f6b3e85

SHA256
4aee6322c0319fde7287defdcfe1b5284d27aa3936bbacae3ec8e17556866821

SHA512
be4833f2cb36a0749bdc3e3036dadfe9a30da8eb67513306b1800502aaca4a73b5ebb736245c3e76165f5085f6f68c59644e0d618ccfe2802a15aed34539628e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
110ca2461893d7d24c610c2c9c9144e2

SHA1
fa53d7523143c167cd06cd0ecc10cd4631432897

SHA256
eef1c579d71a1edd7824be37b5bc84c773258eecd164a1f4065b2662159d3169

SHA512
cfca887eb2754c0278e55e19294f95251713bff7b8f336527bda3f24a6401ccf64853445143116cbecce3a4ef25b26a25d1c718c1b17af37b67b6f6a7b5ab65c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd1fd6b5e7cd7866b54c7a318c537ef

SHA1
2c1666f4e22f6eb33d2018b37e307f8ebca76889

SHA256
2ff49e8372e4d684af0f95194a76965900edbb13eae64d6fcf5c35ce1151ed1b

SHA512
15e5c574db39a72561da6c6ed9d726c6cdd4e986f5a536cb9cf9ad4d0d621468e6e5a5b94c67e8e4cbf26848ab955735e93b47b19cfa4ae7d534bf5d03be9d13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be0a84d2cb8f9873fda279f642e4aca4

SHA1
19e8be60856246086a2e761395d8cd57814d703c

SHA256
2c09d7ae0e33b53bd205b140954ba53eebf2ff3e287706d82faaa89e8cdee9f0

SHA512
1ab001807305e172f730ef4661a5d65a0ea12b8a81b8de21ed6692e0d02ce8976f1c043aa3e01e064b0eff23f49b2c84239e845056e1dca1ffee55b9f070e511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ebeb5dd57903a1327e8f5557767dfbf

SHA1
85dcd822906bd532e7527efa68222891edeee438

SHA256
013ddafd8a0c91577c8719fb2e31d8a57eb082d997e4975b1ed86788f7d9b665

SHA512
067b599a94a2787ac90391872ccf0fe456cd6f5deddce2fc71bb6ec65bb88fabd922d770c55c9e906438089add08cee36a50cd1b0e698a1d28d27b86b94046be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA89F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA98D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit