f9c6029216b00d5d1997c8da373900dd798602ea7b1b1f1d99140536d4cf2e44

Analysis

max time kernel
156s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56f96e25f8a08536323497787caaca7f.html
Size

21KB
MD5

56f96e25f8a08536323497787caaca7f
SHA1

7972120aa625ca2a396d2093aa52f20336659289
SHA256

f9c6029216b00d5d1997c8da373900dd798602ea7b1b1f1d99140536d4cf2e44
SHA512

f88d0405e1c7e19c2553682f99ece3e77070436683d81187d3cf410ebb34e7e0bd3ce4c872dec88092614476e4384a660280920dd61204c02b591212da759951
SSDEEP

384:811bnSh97eXgxRDa1t5R9OIhii42MTpbp/sSk:8PbneJeqRuZR9OIhiirMTpbp/sSk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f2a8d12c40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ce22e3397045e83c8253942fd3ce9f8d8106029b7af781c2e639e79b2e08cd62000000000e8000000002000020000000e32dc7e842d09d3e7f7ab2805ec5fbb1f59bc340cdbde1054f811b6bad50edf420000000ccf0439e0ad65293e3819fa2c9f181da1371555bba51cec9b0f7d6e3f92fbd0b40000000c3f66f197edfedf6c8d35497f9a49d08fad3f64390847f0c5426d8c0c88b8cd1cf05036a09b749cc60379208e77913d5c8753aac3981539d292c6604bf95537a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410658234"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDF47A51-AC1F-11EE-ADCA-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000009532f74a9695b8a8900601bf611b9cc587c5b1500b537e7c12f665c4ba2582cb000000000e800000000200002000000053ecee367a223890a0b0e9bb63c42d65bf41b3b79e104407b81c52629e80df2a9000000025dd476733925376ca5d740f2a32c0cc89294d42c894a7c650b6b64b47fefc6bbec8a21394bba492cefe589c60b22957f6235ace86b6036ff26397bfe10508f9fa3441f20ec791f4752d27692ad63238aa8a881153a7ced4163f420f68052d20e9dfbfcfb6545774ab1b5595feeed0e41fc9cdc53ecb15c9048754c6c85eb24442ce3d67dac8b45c3e32e257c6aeadb340000000df31336a74e5b6eadd4cbb9cd330c6fa2b7692806777920e3b31ea401daa1aef6613c128a3c4469bf5fd5b94be236232fe8e96840c1ddba45b7ee86940b18eb6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2772	2796	iexplore.exe	28
PID 2796 wrote to memory of 2772	2796	iexplore.exe	28
PID 2796 wrote to memory of 2772	2796	iexplore.exe	28
PID 2796 wrote to memory of 2772	2796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\56f96e25f8a08536323497787caaca7f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd517ecb53baed3c9952b5e51ff31788

SHA1
0d5dec7295f10c0fb149ecae580a5ea7251975f3

SHA256
040ad86c20065eb950d454102bc5344bb4f23c2bbbed1eef7c81ea02f4588465

SHA512
df658d99ae6d515113e73302a837dd76ba4ff1521475a1ec3371103b318f2da343d37492fb7e5ecc0d1069af585576e9858d6f05709aa3dacd6d1701f61ffdae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20fe2c439bb558918ae7d3a873ada20b

SHA1
02d74ce9cc3b3c69f4ccfa8ee345ff97e6d2bd2b

SHA256
a6157bf1274136b6e1217827890a5c35bc32c4592850f06fe2e3fc06b710a4c5

SHA512
acf7ff4c2f2591bc42e2a21b75d248af1d27df853597dcd2971870c9030790bc9b62f37e7a1325974e8a7540da141ee3e8c0813f8f936f08d1d45c33e0cf8da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aed8dd212dd3f94b8e244d5ad199b786

SHA1
bd9492846e874d5916af4e221cfdb02d4b59c43f

SHA256
4cf3f9ece75ac451991f8703657f7ee679280426e75c0c80dcfb2127d114f5e9

SHA512
6250d7ede8dacad36baae13b47c9a822c4bff158607d05734a2d0cd3fad56b377fc13aa76748146e6752b3d62617ed74c54c56e5b5d9b67078989f0afdadcfd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7680abf4b166b0bbeb0bc1210cea74c

SHA1
4e1a1367309505473e48e4dba7e50be4f4e5c180

SHA256
66508589de0098b690ff24526751683a079cbc600097507c8e3f267e97feb825

SHA512
1128cf9e88a2ff24bb032c52155931bdb2d9f0812020abaccdaeef530f421d3e146f666f4867e4487c8912cdfc9f34c393598c969d204a3b55c379d2e00dd4e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8ae96379295b03429b5bec0ceafcd4d

SHA1
1a9e000365b4d43a0fdd6e990dbbb5bbe5e5c8f0

SHA256
c9943734f049a56da42fdf58c52c00381efe5d83cbb5c7ddcbd047ea899cb871

SHA512
ddce0be882fc6d7f16195ec2e662b6bc0af1f5ac19fe176397bf9652be7d1bd2b5e90b9e06e84f7c08e623f90259acd0ddbbe36feb1d45b72d205b98ef7d32aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f38196a3ae1c8ecea586ef454eb9a236

SHA1
5b06cc7e3c4c0ebad8a092c9693c1bea01476afd

SHA256
f9ee0f862290944eae96fb7fd2eadfd5c50d3f1e1ec22f0e1973dea974919948

SHA512
2875a0686ec3c116e70fe4138574a24a1903fd0d7dcd87730770903b6a72d6dd0ecae5a143e5c99b3bf9d76214766d123c00288c2932b1ed39fecce9ab27d525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a224a65f79065af70a4f9d6012d10d5

SHA1
9e934944a59dc7a338d355a59898fe9dc0a39d9d

SHA256
267fbae36e28f2a82b5783f763c1cf6ddc73cae787449ff543d38a3a627d7bbe

SHA512
86bae68b5dc20b954ba96542e91de3a65d391f6fd7b4a9d8c978fcf2b58ab0e51f3f60672e8c02150955891b1e7aa1005f26cb11118e13273ee10c0ba209380e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4db5cf3d1ecae4d3b7dc4c8ce3071467

SHA1
e46e6caaa2af24ab96a2e88e3416acc9dca076b4

SHA256
153d841e80df29328b28cdc4d695e6e996b9636c8981740011838edfcfb071fd

SHA512
e1d70abe63b455974fc6123ce029d80466828332d9585fb858644b5545b0a8cb33be1cd2658f03c3716a2791678e5bb8145a68ec67b3634561f281923fbfa3ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1191790610204e5769ce7145f77ddf54

SHA1
0cb37cabed445cc5ab8458aa53aefb370db1a514

SHA256
633ae33c0de0b1bbdd7e7e844e68605a77a0bce6ace235bb413f2a89ba38e309

SHA512
8df6c5685dedf74a4d2949a82ccdb812f35baa298e0f50e75a57c71a24d17b94713ee2168b69af78b6a56bab5944f0d018c7a8b9efdd25b333724ec14615c07f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c44fb3b83228d39e8dad5808f08c7989

SHA1
350044af98c4d5db0e49a41815e45dd4cceb074e

SHA256
661dfd6ada4f6d9a984e981aef5b8a5eb246f1c2fbdb27c5ced1b9c36554c3c0

SHA512
b1d2c6818400536fe910e117b46a8fe7d6f8d7022d03c22a4e513e4c096d60c49680e9853b4367b3bbcca517ea4990c5624ecee68462f5aa979aca2812cd966a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9171c4e1c8680f3719536e3f0a94ac8

SHA1
b01cba595f4790ca3780bfd2e5a951878e716b27

SHA256
2d31af40bd8cc9dbf4917151180f27d807283800823c005c9879c46a7c599b1b

SHA512
9f8cd2b387280c5fb98fdd599e34220d9beec836252546e195f8845cf799518fafd5d96a695e31dd585b7da8d8d4c378e69731c080724e2a84cafe544b9e4e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3110.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3602.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit