6b5cfe1691b522aa500a5e78ff0f9ee3bd0c109ddea6291a4a2abc6982f522d2

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06bc666322f0a6cdc99ce30115250bb6.html
Size

94KB
MD5

06bc666322f0a6cdc99ce30115250bb6
SHA1

ac55f9fc1ebae5724c4d23374e28444ac8817596
SHA256

6b5cfe1691b522aa500a5e78ff0f9ee3bd0c109ddea6291a4a2abc6982f522d2
SHA512

d62e60d1e32b62408126277a8027fb06cc56f4a6b157bb1bf8cb165e7b8852d580537d17b0df3081d22c97b4c0c9a2ce816ba030744a84349fc9857cb3c262cc
SSDEEP

1536:/LEspD36qdobTieeMBwCJvLHdvLH4dxkGRJrS:jEspD36GoVBwCJvLHdvLH4dxDRJrS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2484121-A337-11EE-ADCE-5E44E0CFDD1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409678915"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3012	2536	iexplore.exe	17
PID 2536 wrote to memory of 3012	2536	iexplore.exe	17
PID 2536 wrote to memory of 3012	2536	iexplore.exe	17
PID 2536 wrote to memory of 3012	2536	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06bc666322f0a6cdc99ce30115250bb6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
d4fa6d2a84fa78d11b875ea5cd30eba8

SHA1
992b2a18b5dce24b924086e93cd37a4463256c56

SHA256
4f5e1f270a70f3ad6f5de2661bb2577b8706b9a7f3c62e1eb73c38b29dadcc48

SHA512
a54f8208e37833c4ad89f751071a8912199198c8ce0aeec5cef9eadf11f2be24c6f436b8b0c13eb00080cea574c139e818b69026e72e9fc29719b85b04eac8ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

Filesize
889B

MD5
3e455215095192e1b75d379fb187298a

SHA1
b1bc968bd4f49d622aa89a81f2150152a41d829c

SHA256
ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

SHA512
54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9abfa73a8b79ab7f66b9970e9df68397

SHA1
a5f73dc160c9949450e8b721412761db5c137d96

SHA256
c068a9910efc4697ff9dc0c7df115fb25f51747bc4ad919eff049ee080a4d085

SHA512
2d050293bcd369932e49ac27d491da46f91269d64bff9ce7c7a4894ab3a56c2a24d8c19e3d9b827f794da4b08dfe5eee27cf7f43bfbb12394f6ffa1e95858cf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24

Filesize
176B

MD5
fe09dc7ac11cc5f927393daabb0e5be4

SHA1
78f55ce9c83128c2e93134a695adb7b434b327d1

SHA256
6e8c6bb4b1a1c0bcea99cf949ad9a739dcdb7820115c6e93dae92e425a0baba6

SHA512
81e91fde7c6e46a989fe65cb22f65e76489e0498f08478d82df047111ae324998060b3b125033950f39125b28ad579a4e672bd34f418df5340f58a199bc295db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f161d3cf98600fbdcb5210ab6b04006

SHA1
d1304e4821b31f567573f60a5e5d977f32149d81

SHA256
274c952cb561b16548ddaf043a4ff8609ef8b05280d836fc931bc4cb9ccf9b84

SHA512
4645844afc3d08c0264eb0ab8396caa09f35cd97e694ac4bbd1baf5570ccbb049d4da998897156ed947851a645133d764c8d872b40b5df7e08401695cd43b6dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96faa597b87d96f6a18f5b5500997db6

SHA1
7a3cfab048b88dcd001c45a656c3f63e8fc04d29

SHA256
9c5ce97666da30a9fd9af65c1c9bf73616907d50fdaaf6c7d9fd345a03bd1c59

SHA512
58c1e1972a4a47b025f1f773cbc9877cce68c76f1595279fc1ca9682da2668718b2108837fed035ef8b6092495b42c52487578bf90b1a50e98c565c2afd6515c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f5af2e9cbc4fec15ae81101036aed6

SHA1
a58f2ae174ba1cc7aaec4c71a1bce346a90e30fb

SHA256
47098751779401f117e63ed71f92a169fef9509b5b4880cdae2da91632d3c793

SHA512
8cfdd8107459bd8e6cb326df84b4a561226e0897ce98b81b5b8091f9d45ca359510a6fb7daf9dd0c70da83acc57f2f20a748fc84be600f5086dcedc41b9a1193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f071f1cf99939532a22626ba9636c3a

SHA1
7771632f323732e71daccec409d4ff6e127bb265

SHA256
7cf521eb9f32089c7053d116647b8372c55a56141c9d3c897a153b096605eded

SHA512
e9f06e01f29339c65a340973e43e0e18d486138a3bd3ad75acc0e503d84f2b007884a6a3c637c6281687c024e00d87742a306d1e24cb92c39b3a6df0b9b953ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832e1b3e37bf641a64bc0c54e18ccaa8

SHA1
b2809ab88d95018d01b4951f241a082661f4ea88

SHA256
74c306d88d3cb9606094a3a32c2e5c02e8d5c52ab18fbbf4b12a624ffb918103

SHA512
6ce373bf42fd01a134bfb5d9f87de414dc2ac8666f88054891792f1eae5cdd769e4d2f4f98238662f2995a7b4997344ced1fb0d5884f1f6a3ac5e000d6839256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9e89eed5ad5cd5ec4f2f7971bd322444

SHA1
c77b932e51dd6433fe1b2016fd6c26015fbccbe2

SHA256
1796125eae3bffdc81814819430dd01e241b81c70900c30381b25c4a48d3ff45

SHA512
0eb7587081b38708888494431a837bae9cbaf04c11bca17ea0549503e03e821daeaeb0c3d0ad25b312906c52d917776a72e62f55ef8d77449492303e813b1f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QKMSAHSO\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SY5O5RM3\cb=gapi[2].js

Filesize
92KB

MD5
fcf76747239621183414cf07cfa8bcbe

SHA1
ef270ffa13a231917d60baad5eb1aa91ba50e823

SHA256
4cc7a652fa7cb39e6f00d8d4fb4bb6bb2d8aafd3f29b0a93f3181673ea6fd367

SHA512
492b3da39d90bcd4f5b0455ba3e1ee711e661f49e03fee72a1c7c4b784c29424d48b7df73ef13bdc6a2448b31eaed0831cf80b55e030776defe76af4b28325d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAEE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit