e8f901206ac88eef28cb166b6f494bcdcfbb5f3b9f47be42ac56cf04e44567ea

Analysis

max time kernel
136s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b6cd46f0f4e6bede0278547b9b34979.html
Size

16KB
MD5

2b6cd46f0f4e6bede0278547b9b34979
SHA1

d3b78a5d9f9e53c758e2b4eda7a07084b1cfed77
SHA256

e8f901206ac88eef28cb166b6f494bcdcfbb5f3b9f47be42ac56cf04e44567ea
SHA512

21f4070b399e8c74e513a1fd85e6d8e0dca8050fe5ab355a6862c830902607a098cfebeb3f027e9b4649a5d2787d3a6a7f2d66b2cfcb670985cf9fa418c55c61
SSDEEP

384:sUANYh2E2T+OPOReChRqUk1C6kDjHGRJKI9JRUUnp:szREBOOReCn81CnDGRJKI9/p

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000054124f3ff313f46f5d74a124284b38dc9ed3023998d9ef2330d718cddc44f880000000000e80000000020000200000007e17c1e03d5fba2ec0c31bf2385386db94422309c8fee48305991aec08bcc25920000000933f934f5d9d13797357d02fe1f68db121979cc288baa14cad70458c6657f7cd4000000049b0e9774a8ae0e808f5d0f6fb309b1a2ac6b606cf4c7a0b7320c797d24fa9449bd0b1af2765dccf15a7ab3993e655ee37a87343920c185384bade324fddd76d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0418c90d139da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409959354"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ecaa019bfd860b2d1389835fba5998c836b4b98421af671d16541793be39155c000000000e8000000002000020000000edeafc11980ab298e85e89e6065b65a5b44ae1ba164b01f436401a00d6e0b46290000000cd060c2fe1288df23c45990383208872ae11db5909f67fa02d20df38b82d3e26a3ff88786764e8561a76cd8c8ffd432dd2802ca04cf69cd34f00f1ff33734fa133d3912e4e858feb8568e8d87d33a678b521a939b593e26ae178776ccf522852f9e943b2b1bb5532ef404677783b8c49ddfa8950df49863a6c0f916a0e1f8bc8702e33204b164631cb2b88fc7edcfa2c4000000012c5461219f0c6756a45d2e5bf6017c0a2c93c91c6ecb59df40e46dc9dda4c71ce1d1dc407197592e4d623d9d43cb51e771cccbcdcc87c89954216f3711a1ecd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B93C3D91-A5C4-11EE-91A3-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2080	1796	iexplore.exe	28
PID 1796 wrote to memory of 2080	1796	iexplore.exe	28
PID 1796 wrote to memory of 2080	1796	iexplore.exe	28
PID 1796 wrote to memory of 2080	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b6cd46f0f4e6bede0278547b9b34979.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88902d74624b30e32d600f23467fb1b0

SHA1
513f49b59bf59360ced31dc412dce3439b272bba

SHA256
2659ad6316095ef859610f95b1b55ffedb060a0db346bce88e3ef7a640797153

SHA512
1fe2a1d5a5eb8e2867e1802734a7b109086e5744a88f588d8262c4e2d7d5c1453f76c861454c672a4fb9015e65909eec4e5fb29946f138a0ede55b65a3a10901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b573de60f544e71ddb5e95934e03019e

SHA1
a97b3a942c3745b6a6b14e9abacf13dc1e72aa4d

SHA256
97bc720a76c1ea163c44d4c9d74c14019141178d2bafee1071df9d892b82f32b

SHA512
6c6679d961a1fee5f7548787c874ac9d15123e4f85e5adc37dd9674ca7d8d4432b00f0d7de55bbcc76a09c5c9c125e6bcab76e1eb463778a16f0b73354c814fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca35d7e28c6290eabbc164e2d29d287

SHA1
0b02d27dc2e683e03dd90d793da924581bde8722

SHA256
ca4df5716cba81389cf188bdcb8bbbdd5de705a97a51ddd6bed69eeabc7b9a30

SHA512
c34992875235f910a4050702b55b49aa1880a114046c3cc5b5e7d973320dba577a06e18a3dc6f8eb56b91d78d932acc2441fa3be11757cca14061ee72beb8d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7d18e6e2ae91d8d216d01a9a56993b2

SHA1
f7cf17c71cd38bc62e8eb839bfec49f34631d282

SHA256
4677d4bdb0e2eb2591fe3b242c40c88db4a0071848c3de62c4ba744c73382094

SHA512
398ba6dccfdc2d8daaa01f6c81354c492a85c028c38e64f6c8d150958e6c8425576764c4f7e5f340c8e5432fa3b34f5282acab7190870f1aecb6f061f778e7b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e01c4fd7f48f27c2e32e4f5ea4eaace1

SHA1
e51b02a508a14b0fdf0cac5c5814f66235cbc058

SHA256
4861f10fef575b701853c88d9595e288999eed95eb839733ed4e7ba950b4b144

SHA512
66adacfd3fa0d8599b491b6dd192a808020da822cf5b60243f987ecd50729367489e8c137ee2afca70041a28f0d260283c9f82edcd59d84e65d8ee97cba9f261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d08d80d8bfca7698f95a27f4c37d3ea

SHA1
1d35b83a1e7cbc86bf22e516dc2d20e5b7c62887

SHA256
8b342108b21381ef2719ba16dde0e1969873d917e6517f35647d6cc1e5e158b1

SHA512
bf55721f634bb341a3ded591592da0f5ad5e67cb2380586b0575800ad284e771b7f7f9690fbf8166d78ff893ad8197544a43183b12880a1167957e9d6c89b1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec1b76862df7a7b49ada210d68c03154

SHA1
05d8cd82592a2cca60d59a936bff6b3a58f0a8ae

SHA256
11aa048b8806e9ccd881c5c97428bc516518c79667f910074e0a183880222a9f

SHA512
bd6680bd11805bbda21b1018f67b51080cdb81165fd88db9f8c5c6a6a793ef39ae3845a8dcc83204596d1a6f621d968546feda5aecdee5f77720d37a67763d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db419ebd041ed4e355ee36fa96469781

SHA1
2212f14ab8f41ad51addb76723c477f550f7e3f4

SHA256
92b2144bce92a4e11634c05882ccf9cb6b515e569f8af0fc0a04273f81a221af

SHA512
62cf2d2b9fe4e56680d96ea3dca7891a2abc1da622787364f29d4f6c20b0454b87d0242d840513fb12f263e14483a55ab4f0d4de9a075d0213a364b0edbf27e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7207d72be5e17e803aec2d495c7d11b2

SHA1
f005be06cae6c4382d81f060a49fdd316f7ed223

SHA256
7f74b881e0d676c0128fa095883004e86326e6b441d568b16089cd0a45c4e172

SHA512
be2bc611743ea0bdabbb7d3e95c7451fc0081f47fd6992e470b8f116bead94f4f7bcdec827b81035e4c977c65520a5fb93bd119926a39103390b4ed6a2b42180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06571a8b471f75ae995e7e49cc22c21b

SHA1
f1f73d4e078ce37b97497e76267acd142e435116

SHA256
a01463e99b11bb58911a40add74f0ae949bd6f5fac6a6ab84dbfeb521d1d9e87

SHA512
54356df7829e5d1dfb501de1953dfd6b29e3860bf2f41773e5a09e07c095d3ad12dcf62cbb95d6fbd0233d1f564c04595e96c2a43b2dff2c0663ad3aedb73b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2fc5ab51b80d5eb0e395c30139dd33d

SHA1
8fd0da0fca225ff4d2ed05d00e8617158d1f1f24

SHA256
657336b00c250b08461bca5ab51782c9f681b7577811252f1dcf3babdb8340a6

SHA512
19a4c3a78e16fb2ed3235984499228e44b9f3eed75e0e022fbe7686850d92535b249dee37482d539d6a8df535a446023a70af6884b4e23361ea9969852cba58b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f6bac0f5b97fb67d30f48e98b806ff6

SHA1
0798d13b69d0059d85799b4ef629318f25c19f93

SHA256
62a99a265b984372ce1573b0ed2e601935adc9552d0e3f509d63b6b033e8a21d

SHA512
e24ac988a9b1003bdc1959a8815e1124984e615da3687d2e24ac294e29f24ff86ca6931c0e39f9223d3dfbefa3e9a76cf12d21f1469b41dd07975fe7e13762d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab457C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45EC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit