a7e62a6f80c379981994c6cf6f7d04effe1cb295006e4c0ad60683b59ecf13a9

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c404f7a33f673febb18d1dc9ff75dcd.html
Size

842B
MD5

6c404f7a33f673febb18d1dc9ff75dcd
SHA1

1a26423ae472afaee21b97454d8f8a73d9ba188f
SHA256

a7e62a6f80c379981994c6cf6f7d04effe1cb295006e4c0ad60683b59ecf13a9
SHA512

0481c656127e4de205d8dd0235a487c7f34f5836b2a9772785803f1c61c7503593ec4b935ea2bf4cb955533236d7f9e854f8a9dda0785e84eca668796d5cea49

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000fcc62b9670138c2753426512c88cd8de4ccd34834de23903505da4b46d641824000000000e8000000002000020000000c9b2160b5320a3f0c90c7e069f6fba94c61a3629edcfd6ed56c72b08d08de8f2200000006976e49ef42f1bd97d87ad0c73842df278a30860c422ec39c47c6b0c1999f70f400000002267408cde4cd184b421d8b86eccf09c5609d029ffcd12404626d84a4391288a9762277573f47bbe5ce874caf181f0e64e6901dde28af6b72c416e5e05d8ca5e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607cdd9a8535da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409486959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D72A9E51-A178-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000cf23eaced4ec167ba873151a2009811c62f290aba3c8045e1692499b0d13d587000000000e80000000020000200000003cc8651e47910366009ed85ad3a32b3d637b94d451fbb0ab7f0668aa64f60813900000009163cac20f2972de2ce3ae30e9001b0c672a168f29438a74da063332a177479da8c0a61804fec6b7b7f79e5a4dc41fe41ef0be52ee1e8635c5b15ba064c78feb4bd1fec8046c46ec4e9ff1e5382724c73e0ac944ad6f638f8bf74cf0311225944436b9d475fb1192945a7ed61ac0f0be6e0ef5bf69a980333fb84e2305d0fdd07352779c72c362f9a58407ced381267f4000000007bb4029615eae82854f9e75916656d6af149100917d6b69ee10071d3173000c76d3ab4c4ca5850addc1633eafc2b5b4c11fa382bdd59b6487b70757c1c2b94e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1252	1960	iexplore.exe	25
PID 1960 wrote to memory of 1252	1960	iexplore.exe	25
PID 1960 wrote to memory of 1252	1960	iexplore.exe	25
PID 1960 wrote to memory of 1252	1960	iexplore.exe	25

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c404f7a33f673febb18d1dc9ff75dcd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee4e63205e82d0e305bb0858e8964919

SHA1
e9c7c36a22ec6cef570f60cc0f3c1b996777988c

SHA256
953b7b7f08cf50892d9237bf45827e2dfc3e256be1272f66b76e3b4088c1b4dc

SHA512
202fcc03ed871bc8269c6a6d9d601274caf1193c7268c9ada0ffbf659e498903800aef404f791631154b8a9cfe265a9c8fd07c27ed55b4dfc4f89289c53af404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
788e1ce4307aaa8a607f76e1b75613e3

SHA1
d46260cc0326aea7e1e3267efe3d987e9378469b

SHA256
4da9e922c951894b731d805725d3ceab9a6311c634c0f2e745e6bbcbf4c6a5f3

SHA512
3c46cfe545748648760f6d7662e95fdd9e60d76376cb41bc1be45b0baa7f5f154a9b9796b1fda3be224b659a82f33d947e2ff6819675663897cbd70667b3498d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1060eb5214abc596975f74d4eb860461

SHA1
875f85a7d01aa7a719bdfc6fa7d74ad4c9719112

SHA256
c1c16e7707d330e84a9afc805a77c8266334242766815fa0d1729344b38fa931

SHA512
d8a2e49c4ddd2e8faac08dc98dbfbd7caff687161719477092caee1cae0bdc2ef02f56c607e7ec2cae6a07f3c628544491ae938b114c775065e3d95ee0fa9624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd3504be0fafb3a30d01452ff319093

SHA1
7be3c319243bf03663ff5c96b5bf2ea9f0d2315c

SHA256
f414320828b2d3bdd4c9dba9f333c26ed7d9e7a0dc8be30fe32dfd58309d00f2

SHA512
398604cd14e3a9d6863710e40b71dd2143e1ee70a57300638e4955ccbca7218f51a373f3a4ce5ad98644a4c10c6a591b095fe6d7394e7412d3e3877edfef5721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a41f5b53abbc4a56435be1904ee921f2

SHA1
d020015400ddfca1f56565d5af18c23c7079d3f3

SHA256
2ddb347007822cec765d05844d231143081b4991a8e61fd25b6c8ac1944288f0

SHA512
012126899f052d6363e651c790d83427c48613bc5140d63fc082728c8e4abfb838684600646b4318d39415582caffa6f618b46687640e82237f1d8f95cc6adaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8798ca8f28c8a4df23986e2423c5903

SHA1
ea80db58f8e226b77fcab51639ae8b356c1abb86

SHA256
fafe034898e090f8a2788b43d9686ef54a9b78adc5e4d0932d73bb683de55ff4

SHA512
42eb609640f18235eb813c205a1c04d6ad8efd6a1a5012fdb589a2b26f4dc9f474a81b030b0638387b7425ffba504fe50afe870e4a40315213c2a0e657462ffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5ddb90cbb96f6df681a208e8d7785cc

SHA1
951c2c0f0117304abef870ed13a821aa22ae2abc

SHA256
2b502fd4af0f6f85d191941791f1c6267775323fee0f91e3fd145d65bc9d7424

SHA512
c0d281b15d913ade85ba416bf3577ac8c31684bf2510f5f0cad410a75ec9b2dd12c150c03a5c0db52e6253bfd1decde90ad5fbf36d59f2e9c11ca3b8530e9cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36831820074258f934cea397d216f64

SHA1
251370c942469d0aa4a3c10ae42f10f45a5d10ed

SHA256
19ee6e4a11859a65b519b5e611675b30fca2af75ea2a4643e73707c9926360d0

SHA512
788d2ab589dff1100939844fd2b5fa7025abc4f79cd46e1ba4074cae3cc945fa9ac5f9df5aaf14de2952d3ef6c070097a203447c02d7230ba9314eeca175035b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a516d7ea5574ec55837701e1b5774888

SHA1
639ad450672156b614d8e2bf22ac3c3271dea94e

SHA256
c9d1dcbf568b317410e6a8491561ac23bed9b8dd908b9995ba2c4937f2341e1c

SHA512
1bb9f797f4d12817a441b3caccf966a6fdabe3d2c70ec638f2883214d572e467fcebe3853e80f7e72ea57821e73547355293587f5e4e8175a290d7746b04eab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
255933d59575f78428623f336df8d412

SHA1
640eed0faece61c621c448df2e7e72659d9e2e29

SHA256
f18dd1e372be90a5611b7072b5bb76ef5f74e9490039f71d6dde2d0551e82092

SHA512
2c579cbbc121d5074082e7e9b4bc2f3717ef265dd18055f364099291a31faf45471d1a55fdd2298108c74ed1fb97e929576c79bcae284cc2ae9fd70417ca4065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bbda368944d43a74460a4697384031e

SHA1
2c1b1a9e8cbc9bdf9e002d9c29297234f6e09506

SHA256
5abfb349302ea28731e2464c11eb3e4a9e233a82aa123517970978ec7e16fa8a

SHA512
1e1fbb1cdc54d519f0c76fb796bf53dc7cd2107d9552130619ab7a52dcbb94fc1cf482ed97deea89051d2ff44fd13c35bfc4fc3314f9320f71669163a92102f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FE2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2081.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit