6daa065ccb97432dbf15dfc6b70942c6eb7beb9347433392e91ce6cd253990a5

Analysis

max time kernel
0s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da2375585ab1da54daafd9c09fffd18c.html
Size

14KB
MD5

da2375585ab1da54daafd9c09fffd18c
SHA1

b4423158411774c4264a92ffd3eb6f4e4d080b5f
SHA256

6daa065ccb97432dbf15dfc6b70942c6eb7beb9347433392e91ce6cd253990a5
SHA512

8b9cdc7ff704c2c502eda92e73f96abd1c49f50e904409cf5fe8f83d3d0c8a8d12401335a2b76a2aa65bbc6468ef95ea464bbadcce175a96c576164d29a951a1
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1v3mlKt6DvE:aioWD/ZmXg8SZQamlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE539A71-A105-11EE-930F-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2572	iexplore.exe
2572	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1416	2572	iexplore.exe	15
PID 2572 wrote to memory of 1416	2572	iexplore.exe	15
PID 2572 wrote to memory of 1416	2572	iexplore.exe	15
PID 2572 wrote to memory of 1416	2572	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da2375585ab1da54daafd9c09fffd18c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb073e48dddb5b8e07369dc72e0bc8a

SHA1
02d5af1c0a9cc0a8e7774fe26d0bc8239961d130

SHA256
ac6572d73062e0272fcfa0e6a6221d2496f0efa1a8ec4330134721bc357f56df

SHA512
ca053469ca367c797435327929026f5a572dcffb5bf2ebdbd3c72c261e6e59f5b4ab6d3117d21024e7b27cfb06bd5e1fa35ed6ab2d720ee7fcedfe59df82ccbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54b05d8dc8637405055bb5c93beaa5f1

SHA1
05a7f8c034ba71aa2b9254ade45d43ded6e2fcc5

SHA256
217b3de2d3bab48f86d29710f166d0ac8693f45f7c020f9348a04fd47ff5eae0

SHA512
bada89d1ebd554f2287e7a486e80e72b197675b045a552fbe83e46154ac362906ef8364f5afedcccb42bb709b8d600662cd88d86a31979a294f5bc55faf10f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1050363a68f0f7a9e99cda6d75ee424c

SHA1
8ac3cd9d7d39914df98db3c1ef7aaa7ee091cf46

SHA256
74984ae2d875e4e173e74e271bf119459ff60194fd27a8917aa3dcd4a0e419dc

SHA512
648841c2556a7d7e7eaa11b8dcb8df18436d4ef6a2c655df32e41b00cb7a212e143476251a7d537e8380f1dbb7cb467bf8909c272877c7ec1a36bfc0187a4b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
577cd77d4e6bb84dc74ae6849c3bf9f2

SHA1
df7f56d4fcc47cf9bf320f689cf7e359c5961953

SHA256
e9dd78bfeac30eef28fc8b3ad6d663d59c5f65c6b154d4bd8b6843725e4e36ea

SHA512
03c662752f18d150d47024c1373c64a0ccd33fe49d08ab626da9a902d872d66009cd4d9ba7bc010e1d902ffa5562c4bb50c8d146fe26d7a6225cb2a79cdfc63f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58cc9be07a9b2dd1488eee7086f785d9

SHA1
4741fd8694cecdb0d023cad76a3980d31affc24e

SHA256
8c5b580218eb824842c5a333af097cb969c7b4eec99adf4b8edb8f03f6c01ea2

SHA512
035f9116db1aeb3533b48ec412ad4cb738bb072a3c2f80b4217737a27a9e46d8424904f671801b10c1d5ee7caf023835cb5185609a3c7b71991b170be8c16c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c03589c76601163f3428fc7f2e102132

SHA1
238c2c1fb66ea7ccfe674a66a1ef07254e6551ef

SHA256
d150d0abc7b1753f0a0d13855c2a8de8361b3a07ca656d9cc978d60adcb14d1e

SHA512
fab455bf78dd74ba8b056335270227ccc38a35978e6eddaaddffc4d821be952b1a73667e177fff0538bc785663b0e6e7c222cea545abc579e1061670bccdd81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcbbfd44cbca165c068122c5630536cc

SHA1
915f9401e087331c755103af89a37df7ed6eca78

SHA256
b429ffcd45773cf813ba73609648ef54b2c5846b268ab4cfac0f13843374750e

SHA512
3ced5423b278bf7c13d83d7e9dd8fe0b64f1f313a43bc7bb1a8d4f4e943711f517cf8224f73f96341d7696973621ee98c5069b9977e9bb9a437d0c71a6b44c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc07b1c68afb35b3918931007b04b3e3

SHA1
47ea335ea54ab9e69b7203f3ca28dd5656b3c459

SHA256
6eb1fafd410d3cf25a3f6c9fc76d8f853e31166fcd4e750432d0ff80242cda75

SHA512
44146b1fd063d48000941d1c682eff8c101ea5a9a01b0c37e1fc03478f50376c2b8bb98590983bad91b690940c94d400ed9b7d19d3fd500740381ff004c90c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab285A.tmp

Filesize
28KB

MD5
b8b47840acc8b16576988432ade7c2df

SHA1
d1cb1ea40d75199ef16c526f9992abd74acc2957

SHA256
5e565ce6a451a45836b02e0df120c2dfc20ba9ee17c6fcce9b760e594dedf519

SHA512
3400ea87cd1a1f4537439641936762884caf5f7f3c0b0a176d53b1e33d3d0c718d62e42d71a0b45f169e69597931dfbb0e71b458cc3a1969cdfa017063b2c953

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar350B.tmp

Filesize
6KB

MD5
8192ea7a65360aa867d0897e4b0c66b2

SHA1
b151f6f53e243fa8dd95921b9fab3756989ebcac

SHA256
02b12a951f65366f0dc5420dda95a7bff0e29bd12bce2bc365ec858833cc6a35

SHA512
a7676f611b4ec6241321e35e45cc116559f36bbec1cdc512743f41b5a935a20dd3e37654f2ff17f8c2e6ee973dd5d75d373b5ffdff02012a53ad0e35d0db10c8

Download Submit