e6419cf5c5ffb8eed6edf7ecb24b3067a298d122cf75a481248c39358c38af87

Analysis

max time kernel
128s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6269d4e6629b306e443c1cef22de2f6d.html
Size

11KB
MD5

6269d4e6629b306e443c1cef22de2f6d
SHA1

6aa690a92556a48a5febe378931b83395143d26b
SHA256

e6419cf5c5ffb8eed6edf7ecb24b3067a298d122cf75a481248c39358c38af87
SHA512

b06682b678f501f05858bc9838b274ab9fb6bb9dfc93a46636eb8e9dc406fcaada08cc2077bc42bb238c2e7b177c5eb3aed55ad5b331357f9460b4a9a3f7d3d4
SSDEEP

192:2ValIsr0r57M4jxaST8IN/w1wvqLkt1e6uBuLbdU8d:salIcIQ4jxakN/gqe6guLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409852751"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83E22681-A4CC-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1944	2208	iexplore.exe	28
PID 2208 wrote to memory of 1944	2208	iexplore.exe	28
PID 2208 wrote to memory of 1944	2208	iexplore.exe	28
PID 2208 wrote to memory of 1944	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6269d4e6629b306e443c1cef22de2f6d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ebf2028cde0ac844eabbfa1e3cd009c

SHA1
954f1d8171ed4aa2c262fc44c06c537f1ea69de7

SHA256
f2002695600f73e613060cb16311f82f3fb46d38d31cc9da36612fe1ae40092b

SHA512
ffa683efd6668581961ce336e6f1efb81cf8f66605980b21791fda9856ef0908a5f93ada9fc6937ba0732f8bb2d15973bb625c760e94b809098794f275b10890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54b960f15b014f0375d85143d28e7c43

SHA1
cbc9eb1ba30d6cf824fd2b5de2fd221a63580697

SHA256
bb4240d02b25ac41f6ecf894acfd6b8c7a429f30fe5362ddb837410b4bc01dbe

SHA512
19d44fbe494bdd3e04df2a4214d6fe549d1fd6064cb3636fab45dd628fa2492b54bf997e272e4a985c08791f15e0727fdbd4a3751d7f45e0d923690f0f7e9185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee319f2a4f2157736e3a8e1c2b581139

SHA1
c9d4d1d34189d3b7705d6c9ab415ca0f83e7787f

SHA256
990c6cc8bb7345a55bcbabe9c84ae14922cfb2f141feb4028f4feafb47ce059f

SHA512
c6fed9413b45f9e2ccac85fa38ee29f12f63676cc52c8aeb39f87fdbf2aa7ea375da254066821bb4693ae111e2d707af67400268d8d54c9c2ba2e5a256fc6de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fbb498105caa1a2c3880869070e0478

SHA1
38f7c48d8ae6244e48a08224d196742c6f107ba3

SHA256
08efda333a473c6aa22e76bc4335022b1848d322a50a9ad810acecb4859a3f2d

SHA512
940fabcd433529fe7c99a9afb1019a2578297b2a263f319244ea99fae8d88e366bffdbc10617f9a07c4e234cc4739530d7cc775b798ae4d5f810473485167e3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f312d5f07d9c7ed3de6db3d55c79e15

SHA1
dadf34e250d15ab58b257d32b982304e0e30df57

SHA256
dca227f670d7c08ea8cc342a15a7605f8f140906cbb12a45e7ab1f58fe63500b

SHA512
999422e0cd5cdf981e2b842aab1c082e50cbad688f5c538ea4af8a8aa03f1887ddd2eaf7ec00e48997d5261b8fc3324e991541493c60e0f56167ca790801b79e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f3dfa61524f49fbedf8fccc2748832

SHA1
9319531a8776e5eebaf1be5bdbc96449897e1a01

SHA256
85e6380cec598ffe1d62a024c0c03a7903324d216fbcda4db0d2ebb6f5dfd8c5

SHA512
f2279e62cff9ff4eca4cb8de5161f19502686b281e1ca4f33e8e50f9892e155d644e1006f24fee48878854cdca3bbd0ad2af68a5dd358da9b95dabab9a8a5b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8574b838fecd51e6878e1a00717659c

SHA1
062d273fdbdf5daf56b189f3d35b937f9f39c9df

SHA256
ccfda1c85e202b436c4abd530978a2d3f9bc631c7c74cb800ded8584a4b0db39

SHA512
829bda4a023f82fe96ee7d5c071334ed3c1c9019bfbe549e313a806b9c63ee4c9b660e48105b216cf2b35a060a545edc786205f90fdda7bdc4a2a8c326b291ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2149111be6100630dab21223690d050

SHA1
6960adf93281a9c3d169a2c7621358495938ff91

SHA256
3672d390ae56ddba248851b32c0930063edc1942d1da0854d1db61e24a7b6b6e

SHA512
67dddb11f9298995c97675634a9beb83a1dc364c7a2621a1051cca128b3335699a175c85b08693135c81dde66ecae2a0be7abe620728733a9b0cddd43a5f9909

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D92.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E42.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit