5ec9a4c209f1612ba800683afaa4b5c71e38e5a2dc153c5e24d5180073f46051

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6288ef3a2f945561d04053169aa7e76e.html
Size

81KB
MD5

6288ef3a2f945561d04053169aa7e76e
SHA1

c2b517a1b7df9c27f911a6d07ce2949af30044a3
SHA256

5ec9a4c209f1612ba800683afaa4b5c71e38e5a2dc153c5e24d5180073f46051
SHA512

a59667870745116efb8dff64bef3b1f5f895fd5a876fc6a82aef2df0958417fed0d4ace33a55164f3312e44f86e668834ba4f31f30f8a7aca2d4937a453e20f0
SSDEEP

1536:yh1ldRTyLv5/5q5H5Z5e5e5T5y5N5OKMa:yhXdRTcv5/5q5H5Z5e5e5T5y5N5Ow

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2528A641-A4CD-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409853046"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0595103da38da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002b87937eb6dc6ad086b91c3efcdb64611f771636944088d28611aa5755dad016000000000e80000000020000200000005ad09be5be1a1c29fdc404c960c2847e328286464cbf5d9b76445ed74061b41990000000e23338446d91861d9577ec63340b2a7d617ced5069b4da0bf941443111b459b65777b5d41d8983dee7ef9b2a954065b81f84cb2b986500e34fedd8b6be39e3ee1a0eac6ee6dbe159f93cdc49d32e176912c69e946f5651aed9910d12bb1f1e97c1f403975e44b229b276d0c60b2225591a3a0f73c79d09b10b28452933f3759a87853c81981db566407b20fb24c9c38d40000000cb7347a96773efbfd1f5ad1dc1061560cbcd6bf5a331d34f6a2e4ceb31ed6bb1e086e5cd5b80c4ba7798360b715c443c1570176a2040f8c27930020186237f17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b95f79e923a3f1855e67b56f255167800d22770246a2624f226310c58ee1ae20000000000e8000000002000020000000a08e835de468ff707d85ea970ad73c64d3b4f869edf1a9e6db8aa19aa128a69520000000ed8da095f6e72387bb65dbafd8780a2844cd9c12d17823cd0a7882f45e313e1740000000fdd22bdc16fc1b0d6d038e5d7dfa7e6fef5d31360064a6a8bc6d5eb97930f1109b74d7f2a7b2a57576e76d50d9ea63f6bd8d09bc114d624f18ce6e4b35b59bf7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1632	2296	iexplore.exe	28
PID 2296 wrote to memory of 1632	2296	iexplore.exe	28
PID 2296 wrote to memory of 1632	2296	iexplore.exe	28
PID 2296 wrote to memory of 1632	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6288ef3a2f945561d04053169aa7e76e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307048f91542756bf82ac5eb42edecc1

SHA1
3497d2fff9ec50ac8b035ca6a5615e741a40a788

SHA256
3b516526abf6f7e76e6ec32ef5da2589415ad94b2191931913205e3b280a79ea

SHA512
cdd43495f0ba33b513b536ad06aa67af21862cde478ba8631b3bdf98ac296736a897f68bde369af94e69ce63ef5fa7646bef9280d9786c7c969e13489ac1a053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c207f3bab645facb83e21251abd2924d

SHA1
2324b4065cdc45508a04ca202c5bcb037aa980ac

SHA256
13185f04f256fe22fe6835258e9faacf576c494359689baa744752745b488412

SHA512
87acdcbb4f2872b92669841ac77fa46cc7021cb166e0137218f186f7618ccc29e21d243c870a01077683f5d5671f59561b95fe567355133b7792559cb628c98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef45b0d3223c97398b0e3cc61ca9c9ef

SHA1
15bd67ce8f2a14daa631c70b2830e1e5ae52d99f

SHA256
bb704192ca5ab8e4c4985091458f0560c6a3a1c6d9d89deb97b6f2999353b344

SHA512
d6a57f2884f01ed8c6b3393fb206dd2b757f21dd46980e92f46a3da6e511aae6893e46289de5b79b0ba8113e7cb31094997e8c98db91659be0c0c45e61a67cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23dc6f143bbd79b53ad8b8c19d1de9b8

SHA1
c9f6462d0695db2229c532604f2b9800fe891ee7

SHA256
70d398e6f1076e97f806904400161ad45b9fd419479a1403b6f37bfc38d6be43

SHA512
5c4f6153d36f5bec6767dad6731281a163412712e3a065d884ee74c4bb139d31690edb5c96cdd36e1f1077e3f977bc7a8f87228a9226730dbdef17548754f2c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25b635851304a3e8b50ce119a3f0e6e

SHA1
269ad0980734c9a88b9b60ef5eb61c87f0032453

SHA256
7c55a39d1f5fb83fdcc31f5b1358bd47e7b27373cc32c8253dc6c78490c494f1

SHA512
3ed9633789421c80356408dba6bbd78591e4b644fb41697df4191d3f9f3c8e0e230b6947200a0f7da6665367b9632f25abccda3fdd0d950b1cea0fce0e69f850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deb5d442cac46286607328fbf284ffee

SHA1
cd75d2bc665ef01c65763bcb85cc51d44362266b

SHA256
143d2c6c086d42ef37e253df373d0125a0b011723d8eb43c78dea7ceea545d6c

SHA512
c846a35095a5cf6661b63aff98fbb9f6549699819d8c8d92fc73d4e5399b2c35d484de9e386ceb4c12ac857546a23684a2971491164358b70f67610afc4835f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C17.tmp

Filesize
91KB

MD5
62fb6771959d6b061ef7a4bee3459b89

SHA1
d918ff7bb088f92f5e93377fbd82de86afefbe95

SHA256
fd9f3da55ef6c09f3f3c9eb272e1477489887e98bd7835e4a0196b131f05a334

SHA512
6ae8d4b85c5bb6d7e368ee806000ce7570e6b80cf1433856d92f001263da8700b279f5f5da8c4aefc41cfe75c332935bae313b9e00edeb703629d2015a42b32d

Download Submit