52e5ecfe41728f404d745096e066b983e691212e1cbb1b4795d41a4806c9e29b

Analysis

max time kernel
182s
max time network
235s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6693dcd31e1839f0e770da08f5d78a61.html
Size

16KB
MD5

6693dcd31e1839f0e770da08f5d78a61
SHA1

173d5d6d0ec29fe131b93bc3ef025a0b3d5399d6
SHA256

52e5ecfe41728f404d745096e066b983e691212e1cbb1b4795d41a4806c9e29b
SHA512

37fce4c708c3c7260cb669238632352c43f026ab76d18b97846cefb99be049901c4fe4c95c92806d6f565515fbc47facee261c18d53edfa2c3c28ccc71975753
SSDEEP

384:S6IeK7MS/WukqW9FIRhfxSzahIvBl3LknV:SfeK5aFyfOa/nV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03ba72eec38da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409860835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E1BA950-A4DF-11EE-9B2E-42DF7B237CB2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e53da064b3625277766c6f602ed763372ba78e25900dea17dcc3f9b714da9c14000000000e800000000200002000000097354ac095b6cc6cce4f7352a2b80f811affba5b210584a497d7d58cf9608d9820000000fa72ba4a70d62d3be40dac510add94a07edae80667e3b0000e496a3927be55604000000057d7d0813896810c293a864757fbd4805c3fbf71a8601d5a6fd640985bc5a1fa7a3db1a225c0837ce255b9ce2d20fcebb9f6acb508a4e916ced80f53394c7c5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b101154212df441fa2b8136813ae01c6417e4b74defeb22d7e7b108637716f1f000000000e80000000020000200000005f470a69d2790de0467d72b24ded514c669b1824f5187fce39425d2d9952027990000000812f798918d134a82740e226a9642e796414d307a6beda8d609a986480d685c6e83befde8575de2c228b0c5ebff8c1bd8779723b2a94c136471c6262a53bcf1cbf72a5706b87e0be301c2f8e8480b6af82310715100d15b980bd9ce9b0c3ebcba8fd82e07814fcbb5d3a7e4d831192875adb386e498efc2f1168b326e188e3263134acdd91533ec1dd0c105e034eaf2b4000000071f34510207145a2d124d733074467339a914f9139ec68d990339b28c1ec992b9f704e26622162f67eeea69d87e1fec2f88a99bda4ae18d7487184708ba44f0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2888	2636	iexplore.exe	30
PID 2636 wrote to memory of 2888	2636	iexplore.exe	30
PID 2636 wrote to memory of 2888	2636	iexplore.exe	30
PID 2636 wrote to memory of 2888	2636	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6693dcd31e1839f0e770da08f5d78a61.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09ea75dd3b5d974c5a003345fb4ea4e1

SHA1
0cc62a18b26b7d305823daba4f0a638562760b91

SHA256
306a04c90e3638d729782cb7890feeff5a0ede6d675ba3f4add7a08b6340520f

SHA512
78e1951fc6fda4d06eb1f112b810f6693f5579c5dc87bb402671aa0947e92770ae6635c5f32207dd458e143b8ec40da99e070dde571ce5d25d909452121e61ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a8d04b18d99dbaa371b13b362ca4de1

SHA1
81715c39e1fd3eca27c0b3715b4586c880374cce

SHA256
1a05d5c94dcd8d14a5bda21c746d6bd8d114199317acfd2700a0f230fff57a65

SHA512
af0d6bc24305523e9819368c2a9094d4bcf3bb33b413025bfd6a41bb6907d59961d7b538c1c1fa6cdbb6b50264e25a33476f2ebafbc2ec03dd39001fa4545d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7620a8eeb03f2282604ee36b7f677d7f

SHA1
ce2d1f7dd0c41335de35201dfd73d150596cb7bb

SHA256
3cc8de8fd2c7759f8fa098ae07f2cd0a38a78129dbf82c3246160438961676d4

SHA512
9d2926009063b9304660c6a4c13012f6e0a76013a90648228f09c896108c06047e3f584f842d2aa81d32e8a44221626546d2da0737b25d5a154658f19ec5d936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bf77fa9656650d320f82ff3b93ab79b

SHA1
aad089cc8f0900bd1815bd54f2c4268bda23de98

SHA256
7aaa18a2580607061562cf8ed7637fa7e4a8988871649c7e9a906849bbaa5649

SHA512
f9f8d14acbe4be21c2b1b4983bed3b0c4fd1465deb2de24e93f3beebcc2722b6f45cb8a0bda6c527b0454618eb679cf70340a0c60492f48fc5db13bcb0057c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8b9cc0361ae9700a9c1bc9e7ed65509

SHA1
4fb2b61a110836af66cded00f2618e7458575b5a

SHA256
5b55c115f356e675135bdc36ff483aa10cb6da56aacb89fb354b07a78e2c813a

SHA512
38db3f74f1b80bf312b4b7f409d56eb9e6e95bdf12b65a4eceb85feec702c654b3016674f670cfab158f09e7cea80254aa804d13705613a0372acfaeabf6e153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a2c023c3242ecfc6884b10fadecb833

SHA1
1a2239d3fd4103aa1a5a37db4365ad476bac7db1

SHA256
dd2ddba0e8f8b412bdb485e49164936c92b682817796629fb26a463651347575

SHA512
67509d948115dc434314b3f6e860c43bb9b917d128786d153a5c320c80c07b8aa9cf0f206626016c866e078a9366d5392adda6132446edbf51978e30bcf30412

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F6A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar52B7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit