83c7209228d457d62efd75f50f8a2a2da8b64ade55a351343edee89a24087866

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6da496ada2670f884dbfee0d52074c0.html
Size

3KB
MD5

b6da496ada2670f884dbfee0d52074c0
SHA1

1449d5977dfc17d7eaff48cfb345ff4842193d70
SHA256

83c7209228d457d62efd75f50f8a2a2da8b64ade55a351343edee89a24087866
SHA512

54db7bde221a4d2184f0552e2575eaa0d0d3e6bda5f441069d80b3b12c9316e3dab745e42c8d0dcc13508d2739bbb25461b572d4adb686b7e1ee45330149329b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007439145207d4ebc50545f0fe4283ab5ddfac9a317c4fe101d63c1bef2e2fe2be000000000e8000000002000020000000f01905e35b9f3d8d9f385625a14d9c271f26e7486511c95356b2c4b3d8f6c8df9000000036267790ea4a70ad66817b20ffefa956ff7b986f5e736c5a0d326806b924e32540569ae2c52ba88daeb0ac58df85bcfddf9e0f87002cdd07b6a8dfc6d3a57f5d5192cb7b32e242fe478be5428212254a35f6486d1f052dfcf0bbacead3043afb6ffc6b8424aed95770c44363b0dcf413d202d16b3bfacefc269efe62b334fa6f8c61cb8a22ebd7cebb98991192674bc2400000005fbe598aa795074302ad2526a2aed848f768a83917f76d481b605749ac3584355a409916a706222dae3b065fc7dbe09f2d86e13d8974f8a4274987a17eb4c5d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409529814"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000057c1e2dfb96baa3d53972bb76fb05b87b12adf3529d66baf861b902fa434054000000000e80000000020000200000008f0aa665bcbf6ea556adb1643f3ea34fea922e2382374ca87e651be0ad4c674b2000000063fee500cf15cbc5baa0864b83dbc1617274f0c76c24a551252185bb2002e58840000000b6eb3ff3b545600bfc3df030bfdb69e72df4f16b3134b1cd414490afccc825cb86dfd0292cee64e2668864aae3e0e9365fe8f5b54512c338ff9a7d23634f341e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902fad74e935da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FFC57C1-A1DC-11EE-B930-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2160	2848	iexplore.exe	28
PID 2848 wrote to memory of 2160	2848	iexplore.exe	28
PID 2848 wrote to memory of 2160	2848	iexplore.exe	28
PID 2848 wrote to memory of 2160	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6da496ada2670f884dbfee0d52074c0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaad6a80bce2b6cc993aa2487cd1f27d

SHA1
b5c9577499147958deafa7717782a007ff943484

SHA256
393c949aae105296370d66a8dbae08ce50a7069434a0e7af69199bc7b329f97f

SHA512
893fbe1a43fdd85a6645f2b0550b5536b5971f2ea598efe5b80f9c72e88627ae519ebc9f6d582d9903440bdd1f316abf02d6b6465d86040a1aee53b7e7f7f9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05a02db0c89f35dce5cae7d59efaeab

SHA1
3ea47db4b72bfa7544c53585096a2fee4a3a961f

SHA256
d846572b327f043d6a6cee389abf750c37b8c308e73421994cba515e28d05de1

SHA512
e284ac53f3564dfdca39665b5feee54dfc9bbe7c8711f260e2370f1a29993d65130d548babe30fcfb60731db605dae08b70573aae1ac3c2106086c04131ec5d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a14fac681b58129a689c5c1c0fabd10b

SHA1
de838a5971d662d4fac99bd4dc92cf993ed133f0

SHA256
d158ce40cb9dbad11d4beb1e1b8c165d48f2453195e3e1649fccf53a33278330

SHA512
ea198e730d3ebc7c92c5e9a27e9802e29c3f766b89cf17d1218cf714055c0c2ee16ab16db174c964e306828d09184211e7762328b3845c71ee6da997a1f830cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
654cba90ec881692c9b3c21c2a98912f

SHA1
b2ca5e7229ed7aace66af716f9d830ef259d7048

SHA256
84095a92cdb2161e283c41942479251aa0d94a22109f951539e4c47866cd2ee8

SHA512
6da6ef2c2af63f889c2a0bb680cf678225bd4e0730258e1dffbf6dd8feecb54e37ac4459c1fc4c394f1b99d83a811ee3482622c139f8de68cef59a5a47154c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119065969fdc41f3158f1e3b72a74652

SHA1
26b51d354fcfaf50c0f19498ec41106d4be13974

SHA256
6114c5d70cdde393b6d02218901f7902631809718d0b42313c7a7b972071fc52

SHA512
b6f4ca389f5f6b9b4d4eb5a40f389f13cba9e82aca4ceeda2b06dc6ec2e7420d9f826b6af882f6f57ab717be51417a37414628720ed3b0f40315cc30d9526565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc079f86b6e31b564df235e8c4075f61

SHA1
f62bf7e4ca3b0e90b8a0b9cc78ea7d32e5a936d5

SHA256
62057b38908769ddc3cd59d25b3fe83524f52fb52fe6df6c31688fcc4f24a2ab

SHA512
a5bf96ed4ee06c220b3b235d1601705bf2f071ffc1b4033ef5137f82540a4e0ccb7cfaa40ba983e2d8f753f2924ca629b9f9e9b4206d7fa13064cd51edd6f824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
161c23cc5a62ca5bbcf7d4b2ef0e8dd7

SHA1
8b23a5ede04604ed5f3fe01fffefa31323c73fe7

SHA256
13ff237c0d38695b557962818a987abb29289ea633bf2cd6d42f8d753c79f94d

SHA512
d9f653180fefc14d1a1f58daf98e723504f0d41da47f84bcc506d33108c5737a86ba3337106ff64506dcb90906dc06c81c2f34ef23c9beb1a8ff0d94470209da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91e240de5f79f3121f1a82b00db11824

SHA1
f285b9c2a797a2efe095a287d96b8d25b76a6b45

SHA256
da877318671a4710732b40bf9b9352ac5733f3f44f853e90a862773e4156997c

SHA512
2409abc0f624bfcb88b4ddcf992d02b6424b27443e64d1c97b14eda369972caf67195651b62741b9c636009d8880280a4142a306bb4e2275bbfb140aac4e0762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0527e340bfbf5337944e4a6cc1bbdad1

SHA1
198c9631e1cccfac666d6eea6e6e8877cff9dda2

SHA256
44e6791e70d38b4cefe43cc42335226881ec688759da97df790f6c77f6cac82c

SHA512
9c96fc03a745567bfcbc438741bb16e3dfb44191e92c93c2651ab1b0e7f9352edfa095e6ce0e131e20619f5b4fa681483d139f3344e6874042bacd1565fdbb10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d0ea1cb910e277e310d04920246b9fc

SHA1
b51bce3c0b9137969730969a09b8ae8e95e0a016

SHA256
756990adbdd0c5f62908d65af06c5dd94d6f4c88c564f0831dcabd268c23508c

SHA512
2986cdd4401f2377d229602d7eab2bdcdb99fcd997f5847d05fe112ca6a818203e6370eb03149620a64867dac93d66441410d3ea76f11514e4c24256550ab800

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab766B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7719.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit