5bde48d95456e60f25bb4536e598dede35a9cffeeca95eb9f9823c9623664b60

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06179ae9c4f119886df549e8dbf50c7f.html
Size

31KB
MD5

06179ae9c4f119886df549e8dbf50c7f
SHA1

a5d5141e98902a444dd42caa9f7d1a21783122b9
SHA256

5bde48d95456e60f25bb4536e598dede35a9cffeeca95eb9f9823c9623664b60
SHA512

9ce5731048fa1e3ee443ad5ced3c8ad8d9d4c687d983d64c74b4ecfeb27d26894ed00724b5d313862685b3e91e56394d70890dbffa7f619de64204a4b562e6cc
SSDEEP

384:SkEIZBEtJuCnCHQOEUBU3Ba8G75IGa8Bt7O:SQBEtJuJwOEBI7WB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB72E941-A2BC-11EE-8EEA-EE2F313809B4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a051efd8c936da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409626151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000b60ee7bb52a9fe7170da96304967e22f141d4d4470b5a6d09d089add79ef3655000000000e80000000020000200000000497087aa0522b92a8a9fd4ee51779457638f82788fe55aaeace1401e3014ae02000000089a1e1b0d4d3ba4dee2e69f19424296e7d85ef1f07fb64600064e02738471f3f4000000044802fdc1502894b8c5bce455666f61a8097279f135e90fcd0da674efebb297fdc87e7e707380fe7e17cc89b24ede866f52ce05f79c9637d5b593da4683996ce	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000003670960df06e7488fdab4752af479f4033d0bef320a9d650b9d803eead82ad16000000000e8000000002000020000000d745b43fcde79ab20faf598496217e8e5474de14f534686524deb25d3d92b5439000000099470548f11455e88ba7e3a80c31415d573af2f2ee673d172f8ec668cfed1aa3999e70ec7b721ada3c9a9f2a6688ed1ad3dec0e35dad6463c261e79f6b8da00af73b8b4732112cb68f8cd3caefa053a8fb3bf3941fea26de88ab05146a823fadc10fe471eefa71aebf3d00a2b99e01558ed5ca6bbe6f5325e1908ea697c1003228559ae1c396dbb0722198fb2e7beebe4000000018f41f93b04652b6b82faebfec37f9330a7d6d891743ece5174a184c01007a48a9f87e8598b7e8340e4c73a3ae0918a7d715754665cf098943150acfe3ef9730	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
848	iexplore.exe
848	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2268	848	iexplore.exe	16
PID 848 wrote to memory of 2268	848	iexplore.exe	16
PID 848 wrote to memory of 2268	848	iexplore.exe	16
PID 848 wrote to memory of 2268	848	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06179ae9c4f119886df549e8dbf50c7f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
3KB

MD5
3cf41502da54b33178ed9ac9c1da22f6

SHA1
16893202463329dadf8f1b16a85a6337bd9020a0

SHA256
7765a579ee425b8d04acd62c9af7354f820d2626aab461a4313f2ca94ba74a26

SHA512
7e81227fb11daba0e24a7bddab6e588df0df9aa01c38723c8f8c1f90f6e3d8dd3aa07eff1fd288e8121eb9a8f5236db753a96960664a5d6c2d4f83861fb777d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
93B

MD5
f65ea9baeeeb2d995a3e2e0f3d3e9a82

SHA1
ab412b7347d2f27bcefcc898015c30b267a93672

SHA256
3a18593cb99130df840e4c9f1d391787c5bba7d4c4161c0e0663075c6a151619

SHA512
3ddc2363d420ce116a4cb4b62ec85dd1ae7b03bc6cdf34a58911e8b7940292a1fa051642d204b137e3671608ee75dcf5e1fdb777c0eb53f682184dfc249e1aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cd1ff86fb59403ffac9fb79bc03b8ef8

SHA1
9e1ed01b528af6029b105f78c8fdd6ea8d6b2826

SHA256
54161762594e5c3883b9cec6f3a7c5e0b07aefa0931502d32c6f479a94a05a99

SHA512
08d2dec3543c93b6eecf4c47699777092ddd0950b75215539e374c615eb90237e8b919e51357b21edd3be66e1ab40b6a217c8b65e2702aa674f2982b7b2d7c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6101774e063dea757cd621cb1bcaca9

SHA1
e5b8aed4b3bec137d23609b399684859674f3fc0

SHA256
c49065be0db625c5725e0e7125eaff743584282bbd0ddb7fe68dffdfacd6aede

SHA512
13b4381467b65530314d6a93cee27a25da0c5d369211bf8a0ce5555af9590b2c2b1c162ed21f804259b19a0e52ab29956c013e46942cd7dcf61b7851484e1f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3e8b70c054a4a75c2e921a1c1deb896

SHA1
ffdce87d0fbab2166dc380ab623fc459f4f6b39a

SHA256
4eec7b8e708ad38c03e4388b531c04f9ecf09d75a4f83e75c7c2518ae13a2283

SHA512
91aa6bf3dbe9a050b08b6edc8b5d9705d896b2aece252a9f5e6a94c3e7f4d09109889d03e934d947385b9f876518730407ad9896dd6a6a6429f1a87200c68bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f001f7e40648c81f1fab478922bb4f

SHA1
05305f05e2d50e09f856097cb53b663054dce060

SHA256
50a2aeb749cb54959f9a7f5dbe105a459a26327de0cc1687837a75f39bdb1277

SHA512
971ec3b6fd9ddde560f09734e3f735e49794572a68b082b60cd5e64bf9afac5d3a37e6047da569de08f8331e1b66f5fc5d612bb751931410a92deeb9c284c855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dea71ef71c1bf76d316b388e706a207f

SHA1
fd1c4facd664c2548a9ce038727c1a9828f1f7d8

SHA256
e80c46dc669667f7c97a940fc6a57f01f2329a8eaa9d7e592eb3a9aecd6c7c48

SHA512
cbeef0455952072e7b39184861d65281595bff42deaf7287436e5124c4be8b9e86ac424b1b68a3b49697065f78f747304b27bed8711a29a1ff671d51251b5fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB67.tmp

Filesize
3KB

MD5
c015cd8b4fa4127473870a8281d6bcfc

SHA1
dd0e7cfcca2974ec30db514fbd961dd6358deed7

SHA256
8bcd8ffce61f5cd370234db06cc97b581dcf2d1587386821472db06b41c4307e

SHA512
d0eb72b34968c7da57464f5bf9c64b9f490a28fa00bc5cbeb30c0c893c2159e5424b60255386f9c75629922d782f15434604cfed39299d1e808162b1c2d2deca

Download Submit