e02651cc027d45c0a285e7edf6d1c67111e8b6ed2169e0e7335b2c0901deead4

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d5820334c890d806f7cbfe16717faa.html
Size

53KB
MD5

06d5820334c890d806f7cbfe16717faa
SHA1

b055d2b7aa52dbeccba69c12ebbe360925f31923
SHA256

e02651cc027d45c0a285e7edf6d1c67111e8b6ed2169e0e7335b2c0901deead4
SHA512

6fab607bdb71a0242187fbc045ef0da6ae81029ab2c683eaf2f34695fc0d893af6bca9a9ed061d9636ba496f0bdbf12e6ffd3cc47b029090a6b7cc681bc6cb1e
SSDEEP

1536:CkgUiIakTqGivi+PyURrunlYk63Nj+q5VyvR0w2AzTICbb9o1/t9M/dNwIUEDmDG:CkgUiIakTqGivi+PyURrunlYk63Nj+q0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000035053c2d956f30d86630b9c7a8d5cf22b3df14fa895911935fe0f9397c9a8daf000000000e8000000002000020000000642c4eea2f2413fb51e6c67f409af3b9e65111f591aaeaeb044963746ea794ca900000009e91f85788af3f77b0b0727142f50e6399ec82da11a407341963ca8d7c0c6abd98b6bd06740d38df471a670152aaa264d9b267182d80bee5708a644d5d31a620dae1389d3f8f748ae0c5d45a43c98587eddaaba60a25b86e09fa8b43db517cdef0d42a9b03e9e54e6bc44e6a7e7567ba595aa81a51ae005356628930bbd6a7a07db75d8ca31d64ba8b005ad8fc250d5740000000abace5bc265ff5b841b0ec595e63720bfa187dababf3472a45f88e75b4effb353bc8a44255dc5e2a1698d7293ad00d47c293d18244f16b4c7b839430d5e30c31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007bc6f7da787ddeff7cc51212250ef2f836c4a6edb6b0e95479b43b11e5d1abda000000000e8000000002000020000000bbbe19d9988dc11c5cff4bd6262c675a052ca20a7af2bc8708a8f498ae96d1c920000000a50244ad842fb00bde8d01081b4d17ba7bcdcd2dfacb365fe1eddc43657c9c314000000080d88ee8e8734904c0dcb7bb38e525d9fb3d868e186980ac01c65e2639af161132dd8afbbe8c64ec85ec25f0baa1ff0f236dc4bd72df5b41a8613cf29a7a0e45	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307ae1697338da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{839DA431-A466-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409808941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2700	2176	iexplore.exe	28
PID 2176 wrote to memory of 2700	2176	iexplore.exe	28
PID 2176 wrote to memory of 2700	2176	iexplore.exe	28
PID 2176 wrote to memory of 2700	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06d5820334c890d806f7cbfe16717faa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33b0d9098f055f872f88573a9d353198

SHA1
8c628b3c55ab3af331325f2977eb943ddad96f5e

SHA256
140229c2958776256e5cb5c233c7d6ce75f27ed623cc061e0abbdb6700f7253a

SHA512
ecd78ac68ad4131f9e9ff99894b19c0ef5f2f48bbfffdee307f0ba40ad6565e29d9d985dc81e86b82bf968d8eafde8c6227204df7ef9b10d49a5d7c37d9e561a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
707474e9fd3525769ed60b00277d784e

SHA1
a55dcfaef2f3244acc79961e2b7e530a768d704b

SHA256
ced576ad152315a48789a05948df27f05440509dfff201a9010d603a17aaef4c

SHA512
4c3ee9da259ed480037d9f7596158cf72c2aceee3a15ef4e055b18eef86ea23d41282f1de709163a22a6d8a49eb0a1aa78ed2c2d77d21d93a536f9f8e6380be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a75332e2445682473e6fdaa02b91df9

SHA1
2d8b3e0bb95e3e4a34061f397a2306ce7844140c

SHA256
9a729576383976be8c130f5089948f654a15646ec0057783c37b54afc38afd6d

SHA512
0918369e041ca28057cd2f58429806a62415c0d725278d037247e0f661bdc23a5344cd12728c2ea26f18d541c719dfc94021e5452c574f1532bcdbde0457048f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8daf57937e1ff55cfe50aa73415e8a3d

SHA1
8c5e9506157ddfff59b0510da5003c7b95f453a5

SHA256
f284d44e034af4e54405eb3a17c0d884cf48778adbcc89f69fba29660d13a42e

SHA512
7f5052ac523a1d57d964ac1c0698bd23eddf49720b74291c9ee0def9d31c5839173a16a9392c2d37765ca94295ccca288662b77dceecf5c74efc82d742fca08a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93c13851b4878725a456bec58d61efb9

SHA1
a7b5de4a9ead6437f377ddb96fb2111b3f771935

SHA256
8515a4ec21088cd00afeb7db618b88301d0c5714ba083778207ee89f952defc3

SHA512
aad2e2fbbb8455f3350737b602d264fb54fe59dbc1d9b45f3fe8e0fc0e859adda88b0a5cedad3d15669f38369916921ddecbcb1621ae981d252a2edc54f38ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7acc3b4a638fe8c20a8ede266ce8ad01

SHA1
e2fc56a02218f3ec3ac40b3df5d71fbb116cdc8e

SHA256
63d64554123267b744ff9f9d74dbcc9c5715ac7d5a0961edf76596e3c9c4dabc

SHA512
8531ae58d7ff4b7ba1f6a67f54dd1933bdec61be49f97be75b3d2d5e23aab6cb943a0e8cd4b83f8dac9e3e49a2b9e000a95dd9606411b9713e7ccfb0f2844089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb65155c3471a1a8faa429eb70a0dae

SHA1
3c88629f49b783c897a1f656ce56c06f2f61eed6

SHA256
8ee1f61bb5304b321fcd533f4019c68f15851f5faaa96fd300db203ad9434d61

SHA512
2039073b4f8bfd77b552d3cb698bd0616b4b7314d1afed492bcc0199d8375db3991bd6c10cdeeee9df8eb0d45328cdfac8009e64b86088c10d82e5d90f58c0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9485325088b98ed6320996bc9ac48828

SHA1
acdd197c5cc8682e1f8ee25e8aefc5b42624c009

SHA256
a6f65600a34678f1c0a0e8009b99b9cb7a5f0015a73ea1ff10e080858c2e80c5

SHA512
a99c0b522e3dc57cb9eae3c7c51a973a1f119320c8c827d73ab5a41a0252f6e7f1f065c1070ab7cbdf76ca3ad6a5c903fa637d7de1a8b34ef6a53d9f252a412d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF92F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit