cfeabd14d8127b80bb6be5e6599244ee19c507c8efd125a55d1ff0d37215c5e1

Analysis

max time kernel
136s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

006135c323226b424bc9e20a3675d974.html
Size

12KB
MD5

006135c323226b424bc9e20a3675d974
SHA1

82df060fb96368fee878c7f31c886da921d550de
SHA256

cfeabd14d8127b80bb6be5e6599244ee19c507c8efd125a55d1ff0d37215c5e1
SHA512

05ee50313edc0766a1fb4e106eb96b40712009827db0543a41ca749c38e05dc10e8be2ba7444edc68ae76cbe559799e7d79be5eb7c9017711bfb1632c5cb88e2
SSDEEP

384:Qcqtmgsa0mWaLOrRCSRcBXgHGnPDyhwMDpahJDKTRi0:VgTqlCSgnPDyhjDpah4Ni0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1807B481-A269-11EE-AA09-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000087882ce3b0d69de24f15c60e2ae197eb7782605966782a2002c6b1bb60a5bcca000000000e8000000002000020000000e8763836ee97f91bdafa87e19488237eda8e50f4df51d134bcfd0ae5eecbf30a2000000068cdf4e77b04ca6df603489465819cb4d0489d728e20a88e2751d991bda4814840000000d696c64ccf37e6cf070aee96171c127563a03556af859f8d6526873e3f5614d937d0f1ba7dce4101feeb08431e4380f9d90a7bcdf14a4e22b0ecdd572b3be52f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00685fec7536da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000116bffe7052b6056387a747bba298a0dd478e816c7ee9432561a744f112d5f41000000000e80000000020000200000002e38e595a81a2ac1b2d08887bee24cbc1eaf0b42917ff27cd5195b449d9a4f0890000000cbe85240c7d114e066c777912d96dc3d7b68356a2efb5c45dc9f0e244db966d6fb2c08f96e8b966b9c43b7e56d6578375b483e7baf617b284d766c097599f3ccfe3c341d12e7093d9c5414adc2bdfceecaef8c715ac4a4cfe58eef405a997e49bfb711801d0b545783c219352b67beb51d0f85ca2a95b8d29fe9b615063d534a6eb1d2e10df2a3421f3826d2f8795c30400000009779f820df8ccc66915cd6b6490dbeea776e6b00033b0aaa72b49080da361d966e8233d3aaf74009e750177d4c8c014c37ec94109fe35bc3b4bf9be3c3d949a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409590145"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2996	2396	iexplore.exe	21
PID 2396 wrote to memory of 2996	2396	iexplore.exe	21
PID 2396 wrote to memory of 2996	2396	iexplore.exe	21
PID 2396 wrote to memory of 2996	2396	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\006135c323226b424bc9e20a3675d974.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
56dbaad5b406f5ea403b5cf9118f5138

SHA1
47916f18a1d29f88d34d60cbea0fca596c53d692

SHA256
25dc0edac4b6cfe98385e6cdd443a489a1cfc4379db921eb82970f02204efb18

SHA512
87283fc9f8cd83b58f4cd05cf0baf811ed6c011e33bd6acc83a2b6bba91f4a02123fddd0e242c95962a76f8979eb50e5eb9c00975a0937055f3c3681c03de26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8588f74782975321a0dad221ad1e0a12

SHA1
620f17ecbda69963dde3027189d89625a17ead85

SHA256
a0ae50b690a83bfa82b104051e812cd4c80fb7f5761645310a062e30cb2ff3e8

SHA512
20826bc9e1a361aef298e2f793f7742eca2e84f8e7099619629de57df5544fc314f36921887620e0f62ff21b7f3f47270063d4976132870d815f5727848f4387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e26ea8ed1e3e8ed46862ce1d480ec1fd

SHA1
cda24d265f9003d791362e476803a20183fd47d5

SHA256
e17be4f4937a158cc88f42627e69eacda7f14641660eec493922cab5fcd96599

SHA512
39597ee276f93d3396590e6ef2007817ce16c8be3692ef06bf3d684e686418ea42f20871c4bd41f05ccc61641bc5d7520f9d7168b3bae2c385906e0df54e5e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8be69a924c73f12be425212444a3778

SHA1
a5aa85c9e413e3e443f0cbe725bc8324409dac9b

SHA256
745e83c288ae3433b82fa351c1cc6a320ac5b624bc6c24f7d45ecd2357d6441f

SHA512
2a269099c7ff6b223b14ee2c0e7832b9c0d3df250fb62f5ae431ab0f41ab62dc8aeb48b5d182256c634557b1087a6d690f68def8b5002f46ba63e929f5fc15bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17d8878c14e2ae9f0fcc7a65d54d56fd

SHA1
83bb1a37e5e752f44622c605272c0d054249b627

SHA256
e0c9d119b693eba35e03b3b0761b3fa8fb19eba6e25244d55a2234e6a4319668

SHA512
0b5cd08dfc54b18018b7b3bc26a4d2074a4a967706303f6e92f92ef12285f658d7a8e6298117ad7c8e857e8392d78cdc1278017302a307657dda06dc4d86d110

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55d1be710dbe2492a9f313adff601eb

SHA1
9e021045a56abae06a6a6d52ff8a216c5ee7fadb

SHA256
ea9989ded2b8f85c4ec9b3fe62399f6cf8a980feb4a1958d8c1bb3e5911b914a

SHA512
b2b0d10dd6b4186cff63b4d5dce69d623fed0b1312c47f03123c5f0ddb6f7d6496403f35b7f35cd02420fefd2bd7c11548d54a6f6bf916f4d7038d46d1f3fa11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c96c97bbdf7ab75f1d1eb8076668162

SHA1
5d522debc696f61350b3fcca5fa4f0009505287b

SHA256
2fa82c512918993df019bb7e00fb7bb4b2d2571df2050e918f9d728a7bbbfc22

SHA512
4ec9540acabd1063c56e068725af722d44408e311297345680e7eb4b98be2da114778e46df2a9cf0e3e311e875a25a3d5c51ea02a1c5516d864baffd8a393810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c8dd95f06ad2838b8177bc39767d3b5

SHA1
0c0efff295ae13e8fa86e24e24f5ba8260a63145

SHA256
d804fc82c56949872209535f1ef12fe3de8c93bbb7594eeac733dead8962d601

SHA512
64f19be49a3aa8bf5c4c419931d2b8c08016114bcaff0eaeec9a6822c235e03d823640b32b9b77f179edd68c122d7734a4c1b27ce739f776ea59333051753a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af6c13c3f997022846cde8c03b3fc58f

SHA1
e94deea60ccac6d6b8a5de4dc6baca9d231e41d2

SHA256
a9e5bdf79a097eedae73eeee93df4d140cf8d6ab507582899f0ed17b9d59b8f5

SHA512
2839e2afe61f85b5876707619b02c53ffb7a27196f3dfbaee42503fa85876ca135d6eac0734b1bc3c27bd73095045e162c7ef045e59d7612d2506783df02479b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
be8d9a0c482fd62ff50f2241a9752bbf

SHA1
dfba2b92bfecb612e74ad3a72834e4f8183d21f9

SHA256
d3615d30da79651d6a726e0f4cbeafda8ac4cc7d1b6e10f6578776174dca1a89

SHA512
656440037cb5f7fa5712f78e2428176d4f58bafeae67103b45466b824dddf505d2a418539aac5cad60a606f224ef13ff6c14415f0130b39601c86e9fc55002b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F41.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit