dd9bbaf79cb620fb513f49202c409d16c7449ed03dd1c64d548fb7e4b0382735

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06e4c8ec6d152d012c21db246382c88b.html
Size

51KB
MD5

06e4c8ec6d152d012c21db246382c88b
SHA1

53f3bba5f24f3f80c0b6ecfbe531a56c98c38178
SHA256

dd9bbaf79cb620fb513f49202c409d16c7449ed03dd1c64d548fb7e4b0382735
SHA512

16de8cc442ee9144971e6e24d53165cd933e990c101e28354ad1807cb336dc539d27f9d3be5a26d15c23202dcbf30292f73d23d62da0d205310d20774bad0162
SSDEEP

768:dNkCA1t9n2yKwb2g4jUJPDXiWetM7QbaV1z/3+7CMu38+3hmw:dNkR92yKwb2g4jcPDXiWetM7Qu3Tf3+w

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c6b44f7438da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000186d6518feb54719430698982711ec5d13b29b8db088ba9279760a4fae4400e6000000000e8000000002000020000000905356f81f625836997cae80a57b919232ce03f475c38730fb7de6467d96dd6c2000000085b1b676e4703ebd7d5f64055cb89678db8d59f12e41132f14c91bf413339ab4400000007078b41901b4aa361dffd48b52a878e21c8d1629e9f5e62b19d7f3b165bfa6fa4b37b8f9ee560648cf5c4eb3483d056ff058b68a1720c2cee7d4c987e4614835	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409809340"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72FE0971-A467-11EE-91A3-4AE60EE50717} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d510eddfe0f7ed094e3e905c9207d4a887d729405c5b56943c664114d3305b3a000000000e800000000200002000000066d7027da0a925420ab704f01cf63b228e35bced0d98de69a79f760a017e606090000000141cb3d7444ef9792dba3c51992875aea9223353431a2569c5303a95c090ff2013014105706aa8ab10ca645578d6dbd7f92b30cd07199bd576d0f98f059aca7ee6a485e9f67d13b672b3bfa523c3e770ea0525d93f83038a12778abc611387f1d0f120c8d16dfbbca8579a021271db1dc3dafc5767e90fb588225177a9b1425c275019403097eda5b0ef466e1eaf2b514000000049d4603a4613dd4a4093ffeb782e8772c1c21f5df42635a6d87ee548e29ae97fdad67adb091a4d04194e6307c3f56e54c638f0db9c0b682abbd36e28301987ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2448	1792	iexplore.exe	28
PID 1792 wrote to memory of 2448	1792	iexplore.exe	28
PID 1792 wrote to memory of 2448	1792	iexplore.exe	28
PID 1792 wrote to memory of 2448	1792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06e4c8ec6d152d012c21db246382c88b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f04c01c103edd1d59ce2a89c4beaba52

SHA1
76b4bd4e4c7ca65777dc61ab40f3bc8221099b23

SHA256
95ef4ef27deb9dcd573e34b6cd71d58a125fc490a7228beb9492295f014189b8

SHA512
10797bae5a0fbade8915310bc6660ec28ab0e47e2d832a4820fe2709391854f581cd7abe8a5a7a9058fe88aef03f3b86dc969f4d671b6249b9d7fcf3e6e03438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
056ebcf459be267591d070cbb201f85c

SHA1
6d13d0a4376d6a81e18895943168b54a60c57e79

SHA256
fdc7f74325720eeb85da18be474f3cdea0f6e7d3b3434894a1288d4bf326cf08

SHA512
b931b6546337b7185ea26d6c65bd17821ec91bba2383f80407fcc6bcb277c5164020bafbc98cbbee872d05d84c1c07c259ac56daf3ee9dd61be6e35fd90d701a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92a467fc75bb878d7f7e90f13cd027c7

SHA1
5653321a2ce7fda60032787cf4c18daed30b818a

SHA256
1be497224be9ac8efcbdb055c5eceffeb5f90c173eb4af422a6a6ea5bfe6845a

SHA512
bd1318f5e21ff421247ff68e06a76a624e7e92b832d037c9b318c8ae15ed2347d902cfcbf70910b76411899a4704658082ce9b877c750a265d5eb6fddb63d87d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b1268b187434992c7d2e1af07d4cf0a

SHA1
887c384d3ec0b9149810d6e5c5d3f23de580dff1

SHA256
612cc88276e2ee2c8fb71523af965bc66ff2a2e545dfb56917ba829808af4b6f

SHA512
a39d44a6813e36f4efcb04c194a09a8dfeffbf434a6817534775d86eeb1afa896eebd176188c1c7aa8fa8d1972467c0dbdd21a8493368592a69cf6ef754d20f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53c13b1f734bade1f1c6b188c0ca8035

SHA1
13cdefb421a4cc10a59bb1a22920973a6884b50d

SHA256
35d623822117ae960afc56f3f837dbc26e414939e1f068af69ccf8a9d3a87e0e

SHA512
599170abfda432dbf13ea2c13db9415ddb1bc8f581745747f8ac5d5c1c5be614876c18792453fc7d989be65313671233a420938ad5396ec37651c53c04454092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3659d2a0c64f2c3039da0fffd835c81d

SHA1
ec3801ea3a8600860e99eae14c49e173bc14232f

SHA256
c8716b839133176818e87f64cafd4f3b899dde71a9cbe1b0b341b1783c8183b4

SHA512
fa50af3fb50ad03e9ba16dbc119bdf897e4daaa6420249762a89d151cef5995ad0ad564acffaea75d6761b80cbfc7d2c3314f30cb3e19f57d1266c32cf94abff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d8c9bd12212f04cda1eacb4a92989f6

SHA1
68431b471bca5316c382f52326c43c3901affdf5

SHA256
dff558c44663281f52ad4dcaba23f30185eead37c72c39e088dcbcb421bdf045

SHA512
2c98daf96648129b6230fe51402373f1f49990899e17d3fc86487b49f488ec0ed6c51cbcbf091f74f50fb8a2800aad834ffed9f7de7eba9b8cc5120be531d9c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
032b9e03dad9013ae6a93669923a36ed

SHA1
e3c2acc2b662d7b75902ee3138d052a5422122f8

SHA256
4c1af129268290e25150a7255f88fdf53c0639feebfec97686119611ba2f85cd

SHA512
a8aa5299388479511dc21a18bfcafa3cbda15ee3338dcfcea3f2daebd9305f71b596b717d6308852d8c0c64b9a547276e2614b45a8e97b0fd83fdea8add857e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d109fafc7aed910c22aa3c59494375

SHA1
cf87fdd4b56fd4ef704bb3cdcf83b2832560302d

SHA256
99d60ef3cc71b254ee85611d48d525eaf52545fbfa870012568a0fc867871855

SHA512
550d6bc35c5f7377134b1f2a4de1d3283817af4db022c661662e9d04c730ae766a33f30071d4a485b0cb8bc3934ca949de8ce206d4a59c517711d7e55c29e097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
370e8b3b30d8fff439c515b9d0953a6c

SHA1
abb76faa53c4ea82eda6eef240795653515fe2bd

SHA256
28d79b99f702ce3cc2f08f323262516e4b945ada39177b72ae50bb6af5d056a7

SHA512
a083ed61b1c8f4249e9e95e8fcf600093abfb8b923a04568268bf744af66c78b4dbad5267787af469d01898c26319e0e6d2d9d1d5c7f36e1b456755fcb7adf68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
257f58560e7862725f596c16633575e1

SHA1
7913edc16a5a6b765a4a9c407814c9c843fbe46f

SHA256
63de912ec958db02e51d44aa3af4fbf94605962031df741665beed3bebd0c88a

SHA512
10decb664761db6b1224ff04b6086bddc2847b57e9ad94cde089164c2da89bdf032d96b86ac5e401f72b1d53c436fde04f728b52fda5391541bb4de2106b15ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef6a34748d848ddcc553ccf1251ad529

SHA1
9a6b0da5a9c4ce6bcded2d155de5ced2a8fb9e93

SHA256
927c39b08d0579f50930ae1311894e12cd20df62dba71ffc80dd18f255321d4e

SHA512
e1bfea8489b3add554b625b052dc4f6dd69ab5c559d63f2b355602d1f48218a8384bd969a10deff0ae1c1cb428784260a5dc7e5f1dcf071c1e911dfad757f149

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6568.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69DE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit