dbc315bdf6fb25d32e03a2c5dbe1b0266d495daa775774d082c8ca3475de57bb

Analysis

max time kernel
187s
max time network
218s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

699c430c0ffa25de15d813f44fd7036a.html
Size

19KB
MD5

699c430c0ffa25de15d813f44fd7036a
SHA1

bab073701c1d643b5b1c732943af545ccfc7ee1d
SHA256

dbc315bdf6fb25d32e03a2c5dbe1b0266d495daa775774d082c8ca3475de57bb
SHA512

677b9f9106e20ba1f6ec1338cac02f26ec6dfd33dde3143016e01f5ee8e2c7529b16853923289d79774796abbdf2d0b308e72029c8ab1f39e5e23787f022db72
SSDEEP

384:iDfqBsdiVA+RgZJrpJ4gQGYaLM9Kxb+ysQ91TAyIqp0cYAeGj8:ufjoA+CZBpJ+aLM9KuQ91TAyIqOcW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BE6CFF1-AC86-11EE-A5C8-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e037de22fd3ed9a73945a44c4d1b25b678025cd933db7494ea90e17975164383000000000e8000000002000020000000ae76668c5248965953a768e7f41f124ca0ede657ad049097912ec1372c4171fc9000000012222b02c4624f1cd79aabc43da053e999ead7ec59a663befe55e9bf96770f77e608ddf4d675c3d32af5503129813125b90d1d7338af37b81583e22ad9c43b10f24cd3a9f0f852e3c705a55d225856274d7049584d29aa02d6b768834ca35d57ca4798d1865cb9ed1b3a5cabfdc5aac9a24168f9fff74c01cd5ec863cfcd6a2e689bb8b81ec69bcb9aafe98139bc677b40000000708f241862b0b7967bc2c4a4971ec4ef8f15780c89541125910785ce9987b7eabe3415965c2b4733d2cc3961e87ed1fb220d6f4124b219c7f5632b3414b39220	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410702147"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000fe73e0e023f3fca2c56df835e2197f16ca9c41e9778ca55e0bb5f326921b9134000000000e8000000002000020000000ac7d9b05ea7bfd076782ea643023d1d4665fa5d6b802cca040e6943981f940c720000000854efbf7feeb29f0032e6a88ad234997cd6b187939c40b75a7f2181ab071d1714000000040c9b23246cb110aaf91f88b3569f71c3800c65739b152719eaf46367ca66e743bd0df705196d5116637abd81c4fad3e631281fd5e5549d244e042295a512343	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f010bd0f9340da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2628	2600	iexplore.exe	30
PID 2600 wrote to memory of 2628	2600	iexplore.exe	30
PID 2600 wrote to memory of 2628	2600	iexplore.exe	30
PID 2600 wrote to memory of 2628	2600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\699c430c0ffa25de15d813f44fd7036a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ba51b04a97a5f6e24749eb197e1340

SHA1
924cfb8e6a6ea9c34c6a18cdbb6efcdde4adf7fa

SHA256
4ada8f27669d733b0f696abb836f88d77c30514e7af20d4ccc1af05d7610457f

SHA512
d913964b604d0077693785acb7f59ae7569e9287a862fa2f56cd38137c1d0fc7977ae007abb03bff748c7b3f98e9937f122198c9150e8644378b7a49943d18b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c12c2a343105efb12cb075ae8313dd0

SHA1
4bb8155fa2c2b3f3d60f3a8bf2693402ae55b104

SHA256
78ee6152c8b7391bc108310650ee57fe1de6ce81130b1f506f9d6273fb6d8392

SHA512
3cc202d8b6d9c9ce36226fed9ddd29fd6b163ef59db6eca3dd2740c1066c53cd2c656847c99283cff9030ebf99734a7e646a53ece5561648f37150928e7991d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464ddc937abeb259f83b6759fa016b60

SHA1
ed95e3ffdee22f9c53e4fa1bcae718ca861b5d89

SHA256
455f6eeaa5fdac18fc7fc08b1c2f56aae95f18acd9af0d46f9c914416944e9f5

SHA512
e3cf43740bdbf6fd9d896efc937b6dae3f81e60e8b7c5b068e98187a12b2acaa6c0cf5931e6238c8fd0eb6efe8ba9a6ae3314a0aa9c0f7b27da8791536a61f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c0c4a32c15d2436227892a574bf3a67

SHA1
6e4545d4a8ba2591716648abdbe1e486568137b6

SHA256
6f8d675edda89a7078b97bdd390a8059d62ec19af236d0ee6ea5cb06e3ccf80a

SHA512
3f891f5b710e895f3f2f7a53995c6a1ffbbc19dde81261957148713239322173782ffd1cff53eca64cfa98c5f811f36c853cf858de5d3760ceff97b3324b0113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3965c271107b5148ab317d8bfeb7677a

SHA1
04aa6aa0e961a796beaca331676f15720c244894

SHA256
cfbb4afb9ab940f628bcdc7ba1ae412e8bee1fcf541a7f9536d3239db26a9f05

SHA512
d71edd0ae07789391661a3feb073fc3bff6ceaa373410d25783a5c0e9b583217a711f1bf203a47506b00c1c7bb05aa1213e8c878c1ff666815208963ad4356cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
512cb4109832413b4ee7a0d2fa7e5bca

SHA1
db5546e150af2668649ced7f3e74600e04aceb37

SHA256
33dddbe822b6ae9df2443a597fc9a71305756c3f97711489860650a60f3ef56c

SHA512
5e28e8aa3bef47914d2ca4737d25047494b4e39cce53adfcb9ada004bcb7efce03eb655c1fbb7f477731e1ccedaccbae14f15db1b95403f42d928052e1cf5bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af7ec7a099b112f231da8866ad6d0fb

SHA1
a2c5bc0fe02728f3b864b70b6e79865a98b11967

SHA256
d5e1c75d76f46c5dfb3441f794a902b963ed7dbe09d062411aeb27a7369cbdf8

SHA512
8401b31c7f8b2c1fe6e471ed4ac399172bd3dad9313eb1c53408484274ffc56fabb0b1f2e3586270c5d3cb7b85b8745e8a107143189c7a673402e9af285950f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b2f24105aff3a97f178cd46c7d2ebe3

SHA1
31ae98d48b8b17395cb06f39dc85b455d80fad9b

SHA256
c5f3581062ddaab1614f1ff7cd97bb0334e389bbfc74ba0202c39f45af31167c

SHA512
44a9ca920271ca55a8227a68bc803db1b252f453b3de4c30f5538c1333f29cd2a73132d462b5723d2d5c9d6c6d290117afd6d8eef0bc965f1542b87b3aa06d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d3e4db7097adabec006b9a8d813ed17

SHA1
ce7bb37c55707492c7954be8c1957937d5d30004

SHA256
c338fffe30aaf1f9cdf9c424a7279978e37d66824cecf335254574f1c2e5b3e0

SHA512
0d79ae438a5972e547cb35671d5c677afbb0a47d61d5a35b20525d66ec8ca12409444127ede4a341d042810c0d528c950acc10ee97a9722df5136a6decc33b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a631795caa8a65a7fd686dd5e7ef1c55

SHA1
3d4761e36a446e8c9c1edeca9e99ff74321eadb5

SHA256
c9bf3b3c2c680047346bb18c887195a58ee92976ab2a7610d1043657a61d7dfb

SHA512
121b91d40db17ee14326f1bef15e7d4316dbd35c43fcf6ededebfe7641863b85cfc94ee2237b84219249c7b1a5cda09361ea5be66d63121f04c73da2ffd075a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb16e766e20e3df4bb6f1eda65a06fbf

SHA1
1ef389175582b47a03632a081e6bf14423b8b68b

SHA256
322e25d4a14b5ef7552b60cc7d537b56bf0c1348fd7c640653f8d95fe4ae7d64

SHA512
b0862f1e1c488e3c7517e567d6cf0a38745893aa2e1b85517273400c556794922304c0c1b501ffa42e2ba5ce828639907dac35c05a65e3e97a0dee5587d9a621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f820a19f8233eedcaad73dad39f39e9f

SHA1
09f11ee929cdc73421da31bb224ecccc8712b3f2

SHA256
a02c0eef693fa285b8f6a01927f5496d8ce62fb43a4d2803af20938a853e7113

SHA512
b3e1acf2d9b134970b1d1d988e77a662013a2cb4ade2e4feecacb9fb8b2513726240a80988e8cef6f96576d9e241d024661084fa73189d7cb7927460d882faeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE6E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6F8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit