dbb3433489512adc817506ad8ca71fb247db4a89dbf4bc1c895fb864e1764cba

Analysis

max time kernel
139s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06e4cd8a03812c36813ba3d08852c31d.html
Size

20KB
MD5

06e4cd8a03812c36813ba3d08852c31d
SHA1

6c962f3553c1175014e5c2935be567d707dc04be
SHA256

dbb3433489512adc817506ad8ca71fb247db4a89dbf4bc1c895fb864e1764cba
SHA512

9ef61eb9628fb58c386e928dee48765448588f3f8b95d6fc9a8d6e87f61acb96e2914e0f089da31d0ae8b2138a82dce21f9fa6070c586c87335d3810d533e9ab
SSDEEP

384:4+QfPFd9QZBC7mOdMwiuKfpC5IgSnbmFe7AcyP6RUHuPd:Zcd9QZBC7mOdMwIpC5I9nC4OuPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{320BCAD1-A2C6-11EE-A1FE-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000001ad03e900ed4d66505996e3004cd1247a004d8894d1dbbaea2bf4a9331a5c2c000000000e8000000002000020000000cbe914b20c54562b509f60bcc8e9f401a0f95f21f805b71c3be8fdd7c119f5be2000000050797f6e2c5dfcdaba4b61068cf784dd04d50e332a6024d2789865866a92a8b340000000e92d0be065a94c02f197e7dd0c29c535d133037011611bcdc2ef7fc10136d11601f343d6f8d12e63de1f65b30e39da008e5ee4b0689eaad3f139da1ed161128f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409630138"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004e9bf2fdbab48416344f02870d1eefe9b8fe27a8c9d6863a585295d7aa4dad60000000000e8000000002000020000000fa5551aa1bb7fc13970b3428207539c7c9d9429f88fceb8a146df055e4bc1d6b90000000ed04d182f8f4e52873dd48dfcc527952e6358b78e872e2a8813908abbd6849c5095bb0e13ba57aee131a2c1cd7916413c35ff1efef11d7af3e7d034ee89633a0bf1083468b4a86dd1f19cbf027601fbf2a575722e7316d30c94fbeca36882b8ef5fb7f92646cca0ef38df7299dca33c1b5b925365dbe103bc8f1230dc4dd68294e2bb308d81981e24d1bf02cfa6e844840000000a8125003bfecc9a0dc72dd7fa816275971f9038d66a688d52f8a4b87909dc3d5685877e7b3b15d556fcdb7c1a4a2365cfdcd23613c00034919cf91567e466fb9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0bff90ad336da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2360	1676	iexplore.exe	28
PID 1676 wrote to memory of 2360	1676	iexplore.exe	28
PID 1676 wrote to memory of 2360	1676	iexplore.exe	28
PID 1676 wrote to memory of 2360	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06e4cd8a03812c36813ba3d08852c31d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40c0a29ed14da940a1d8e31fd8bb76a3

SHA1
8a17d540b22b1f363e72156c036f3953e55f47b6

SHA256
4e6fea636df1476c9c13b0f0f0a7a29843862a46ac85c162ece7945384682344

SHA512
ac8084f0a09dd9b065b525c2bea7ad7ca2a916de6f18fb511871444ef5d6a5c8ee54c1362b9afc1348cd6a772ba7495f79c0e29436bd216250261c15ae68d52a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c2057f408fb70a9d018ac9f3de13e08

SHA1
2bac83104d61e87c8f3e67a65d9301f356de6d8b

SHA256
cd19e5af5c427c718c6833fa4fc186e43efda653684f4a2ec9e9e8f383ccdaf5

SHA512
6af3a6f3ffa5c5f42115462e0adf7659fc495de63f41fe2b334d1fc3c286d589e338d7a062c40197ed5068b0a95cabb381ad6c45ec57ff794c6d500a2cd98f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b55ce3db95d9438f8d62e4878485aa7d

SHA1
e368de10af1743dd2eff55f8535a8ad6875f5013

SHA256
0aa8e2829f2d4a896ab5c41aad76b6da42192673ee1af6f366e34603f71cbb08

SHA512
8ac662e69d85bc2627ea8fd31ff6f9749ac8e828350bdaf74d809522ad1098cefa8dcc6b188e87847764c069da8381cbe1ba60b7941bba3287139ee9e7599921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08058989904d336f14895b1f43ef8b79

SHA1
873e4c12d376547a6fcf589e3682629185b6ad76

SHA256
cbda879441b9d7a9f725388813bb529470e148d936c60878e8f809e2e5595465

SHA512
738c5a382efb310c93b2e07f7043782b93ec3889e3a51e071a602cb6527ae8e39814e477efa9db69cf11b20fb6c52fbf593f94a9bca36470a63d85d7b024ccfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C73.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D31.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit