62a22fbc2493a85326d517557f994de9fe24704eb81bd27056994210b8684dcb

Analysis

max time kernel
118s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6567ba69aa117b9574180570a55e8434.html
Size

14KB
MD5

6567ba69aa117b9574180570a55e8434
SHA1

c2d811c9a9501f47dd49e5208702a82a97c38d19
SHA256

62a22fbc2493a85326d517557f994de9fe24704eb81bd27056994210b8684dcb
SHA512

563e7199e0de60043b759a4a95f45bba2245a46e7405d88ac7d8c0ca916885251cabd4dc74f216b3a8773d2f7b1b91fdb5fb0febe658eafb8ce323630d56e5d0
SSDEEP

192:ktUpdKFSuSKA6UetCAJfpDzAlu177El5ZrHOUl+OGu7EUvx26inccX:UUpQFSuSrez3zAlu174B1NjWX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000352020b6b57a9eb7edcee29ed22df74578fafb66bb2a5473d8fc4fda66760d76000000000e8000000002000020000000fe6bd41ed87ebf5206236fec0d44274713b07a74e43f3f75b0bc2cd98e623e362000000056f69674210b118e964606ab58d87e4cbd60832c050962e98a8bac205a8b8410400000007d8ca48240838431fc1de6812d8963ec0b5788af42455ab7f35e277f27b89aa42a9a9b03287edeb2d2ff6a07d7ec012dc9aaba94d6e7775dfd0d62c23f500637	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006e1c873f8dd8b0141b53d87ab9f9cbcb55f0b8057199d3489c4a3841a9bfd60d000000000e8000000002000020000000c487fe5d80eeb5cf82ee3823d8e6d33bf75cdcc76808f2d383a92872e2e1661a90000000f03a23024e9254e7973f488e332adb9a6754870af45c3a31c023297243135e0afdc3d448263b5aeebd6dfd8e1787925b2d4323841f898101be5d3ac8ae092cf289e57628c5c3825a0f45e263e02a1c4781958b1ae861a651358fcad0c46eedff8b021be886437a41da4aaf8fcd3eb18e4d61476c2ee774ae6b1a75e47d10533cc160b34fcf011e960a20b70e3eaeae1d4000000033845f7a97e83e243c134dfacb5c96e3cbe3e579c3ca6ec45253ff1ec1b03f4cd7e38a1a5d5c286322a9590df475a7ffd12720e5cb087c773c12b0363df314b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409858212"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AFE2A10-A4D9-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009f5718e638da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1456	iexplore.exe
1456	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2748	1456	iexplore.exe	28
PID 1456 wrote to memory of 2748	1456	iexplore.exe	28
PID 1456 wrote to memory of 2748	1456	iexplore.exe	28
PID 1456 wrote to memory of 2748	1456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6567ba69aa117b9574180570a55e8434.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bf348c8313fb06a3f53e5e66aabf389

SHA1
1c4a042300ee05720e7658b3630fd4123a545a52

SHA256
67ff38045abf419f33777f4beb088c4c55247f8a97c579cc5fe6e391958590f7

SHA512
6cef835b56a3f9b6eaa60e90b64f38d68198da84a6b42cb9e8ce6d3c4a7ba450a88646ef2456423a79035b36cf2951b5dda2e3ba5718af5c5ebb405d193cd8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e5b375b79a03494e64abc6125b7a2e

SHA1
0218ff5208765d173a97b3b955591f8edb70ee84

SHA256
1cc0d3ad82cdd58555f80c88982a9db851d71710e82170b05b1da44319ca62ce

SHA512
d579fb308a440c4f55dd489fd60763eedeabdd660383e7584e842ca8732e7d81050ca2e4f71da110c4bab7f41f2d7fbc477edd306fe23383a2e2d0cde966225e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21e105c4210cf9036a666195823dd488

SHA1
5e941b810a766dac4b3c51050c4245c40eb70224

SHA256
16b6016b87880da33a32aba9e7e8215b494aa4a15fa5d6005dd35d85050df354

SHA512
df88e4c364bc9530243b9fe1b5996a01b8437d69672816e72230fc87c3e1ec72abdc114c94bbdd1c129815e54762273ea940bd35b329170a5422a5f40116a96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a173821695f9697bf28793cb494f485b

SHA1
0b15c05cf7085cff20e1c76011916df18f8de17a

SHA256
867efcd5a8abff46aed790b0b921d0fdf8df830496983ee58a6c6ac4a9301715

SHA512
e253157db216dec52c1f0a889daf47436ad82dbfc10230fb2b7c6d87d82550f934c0fabccf92effc67dc5aec6a82df9cf765b82704540ef7661ea2f20250fe33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97fcaa176fdc089c532e5cc94927d433

SHA1
212a0695013b84990f8b47c4f8c1c0ff6e68cd37

SHA256
c0227cf29db684962abdb21934722822117cc65259f6363da08c88c1311f4ade

SHA512
4c8d2854d14879668b413dfad0b4a93c654e8d9836d7db63640e500f0d4385e9cf1b6d8cdddbaecac467428244115915b722ed9792851b6bc089788cdc80d128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1882b16c73d5c81094d1a7d3f5f81595

SHA1
7ae86fcc03506e50bbd3868e494654722fe1aecf

SHA256
752bcb99eaeb978105d6ebb9e173c854baac6dbac4e9b8abe06870d9ae3ab8f2

SHA512
29ab0aaa37955b256e7bc6b27cfdd914df4832c23ed50d12c2eb03ac7972d724d21e87d7f68088c2c7c9f18d99d3391fc0eec6b5c7f1452bfedd237865514e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c843044831803951340b93f5f403f545

SHA1
72d1dfecdc3d00a827118d67f2eacb47d0ab931f

SHA256
f16f690ba4e778bbe660ac1af782ae2ba7ed7ef2d0037c9bb45b8e40cbe31f56

SHA512
2a668643aa6eaa498df2882841874f034fea416f7f3b34470745ea3ef412dc02751452732749f7a78c30a29d2da8cab4c240b2612649c9e5613a550d21eb8c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1334bcc3a5727f0d5422bd139e68ef1f

SHA1
6f6a0b16f26cea619a2e84ac641d103460b05e68

SHA256
0ca4e24cacdaf03153aa3738a49ba120d895716ef601e071b10c28d096696f2d

SHA512
64913ea51b697cda0009639065c80ad2b1feb0b1640d67bf3e13829f0d7ac7e39499a7becd90e85eea72aa87a1a354ab0d28ff0494c06495c58c7eadee89313b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eda6917184189b8e833055949cf43c2

SHA1
7b7459ed1ae8c512faed0e393386e5709c3ce006

SHA256
15dde4db1c4c2ba912e2000954cba91af1625a8c9b3cf6a8976f57066f291572

SHA512
495cea6dcf300a6b2226d7be98e8b0c54ed3c750d03998389abbf60c2e09c550d5c4cfcc8922e12c87be1b0ddb6d44ce783471d6fd22760b1b4b0eeab365b6bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1d9d8bd5a91a742223bdae1a3b93970

SHA1
55f62e6533ed0c05f5e2a3e4cfb9bc121492d669

SHA256
0998df5c9e51304774b3f097f5972e5db881067cb9d303ae6e1bc3d8bb43d903

SHA512
4d769adde36c4a19730a8a47b918dacb008d5c8a417185d8bd756dcc4ca94ed114e409e2d1b322497d8fc17883bb950708874ba6a725619a7a761bae6af299bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4773d2aacd8f5d698ad37ab48c7142

SHA1
c59ae38ba684d4005099f627a5e4fdbce7310d44

SHA256
6d702d38db87cadaefc3727e26de2f9bb34f650d6d39c8a9c8a23d7946f1fe3f

SHA512
7793ea607dff34f3d18deebe279067a8c97d83c09f35585868c191fd6b2cdb5146ea389a7f299d99fc674be5cf58746e34c92bacfe48445d9f1bd198f1e1d148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b9b89f2b150f343696a163c8a85adb

SHA1
581673219977f1e33743bc1aa6a6af261a9f55fc

SHA256
388f76cdec952b8cdb22dd83b6b79e521a924589f0a56c51492225fa7ffd7c4a

SHA512
8881124fe965444306a67aca7216a8463d85008a0b398b8ef1a82d8bf78a0afe1b4187a157f38ef648dab803401ad2c8287774d5c484650ef7331db95a05e1b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29e0007e4dfff3af59fba59538ce7ab3

SHA1
35edf1fbc958c2a5d65c5f14e1c9d3d1751f9433

SHA256
9083fd42e69eae0d3b7b4939e5b1c723d12e6d32dfd1dde6c2e353bcc1699850

SHA512
9bf68bfa23fffa0e28d2a73cfc0191fa5bdfca97163097c3857fcb7815a9130ea05ab96347512b2af3a9cefc711437bed3d44a4ba68d935b5b755451720b7f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d2a805140c9ff54f380fd1cabce88c2

SHA1
68743551012382debd08a077e7ffca4f71c17d33

SHA256
783678880fa833923a9761a31a8a1c11c684048894b8601b3c63e4eb2c58db1b

SHA512
3e7e1039301d52bd4914ce0ad265f06e0fa2694c4ed69560297a2eb477dba5d7f244cd4a39c5f39014546e1f4a162c9d61f3eabe594433448f0914913c00913c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12576a447a49811076948131d081160c

SHA1
da67da4a9353004131ddf1adeea549780783437c

SHA256
064790113b7a660b8c7a911f887733fab884522d1ea9a3ca42ad5028805ad0b3

SHA512
2ad8203b868123151d162aa7bbce938c1920933ac13840b53e3d5890db935a776864b073f824df3258d0b6d643e7a6fc57ab69c474ad5c0e146523a6f60b5e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8eda5e694566f70ec39ce85daa1e68f

SHA1
33c57d9717523b46ee2d63f14e8acc1de64f42df

SHA256
099ca66780a103c290aa60abcf20ac64004cb85f219a4eb06a97d1603db208c0

SHA512
2489a5575c30618e37f85c01c5c2f25aedd92e8babb726a8e8259bbaed2b539164fc853f3e0e8ab7773075a07e40ccec5ffe822685b1de4e1055c22b62e9eda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D99.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DEA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit