e2712dde7ee85bff27b3156cba41b3658b671ce09c80681e1d7d4bb4923d8faa

Analysis

max time kernel
65s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c6aabcc58818dcee2d11e3c9794768d.html
Size

53KB
MD5

6c6aabcc58818dcee2d11e3c9794768d
SHA1

4b6f1a896652cfc1ce9e9a1571e017e092f2ef0d
SHA256

e2712dde7ee85bff27b3156cba41b3658b671ce09c80681e1d7d4bb4923d8faa
SHA512

79097fa3b5107f01e533dad235b456a3a61618101ec56616a0817a2d6febef36684f307adf89ee2d3259256f38946b552d01e6a24b5be5c60a5c1ee0640efaef
SSDEEP

1536:CkgUiIakTqGivi+PyUwrunlYK63Nj+q5Vy0R0w2AzTICbbEor/t9M/dNwIUTDmDV:CkgUiIakTqGivi+PyUwrunlYK63Nj+qa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000bc2a537717c3d6d50af83e0c75325e09c2d5db0380afc3043c4d7874ff1aeb5e000000000e800000000200002000000092fe7cc82907947e41f047e45e797fb32827fcd7af39a784810ce70321b6dc17900000005ca3119ff93ce9c466c65f4cf77709f1c96cbae2f5ee9dd90231a3db5764f9d33236cf00b92f9a0710c0ca6f2aa0a1af622efe1e7b5dc757f4b3373de787a03b6092e52531bb432e7c45794f6b22342af4846d5ed737ef019332ff2fba49bb1291a5dd923d243abc3571998e30d1b3adb84938a3460e7b9ab3adab04f562e49c1e139fe7d65b77fcfedcdde36647ef1f40000000509ec5e4822093759dcd71bc31af4317d35583750a5b2e0bc92c748f34d5467c7b9f7fff4c345c422ee5d9ce9f8bc5799f975599fd265b0d2efbf5756e7daf20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a009515c0739da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{742AE6E1-A4FA-11EE-B0EB-D691EE3F3902} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008541d47d7e157db26cbeaeab272c226abbcab6e847d0feb55d7be11906dd6f1e000000000e8000000002000020000000f2e6b482060d17d0d298c04da0318fcd51dbdfed4453723910ec9c0ec5f9e0ff20000000bd8e40cd4200229c9aac643023ed10f61c4011d3bc382c7d459222af23f0d3f240000000b00be030c270a69a6ab134e0bd769fbdf8062127e576e5e19fd8a8367a7fa5ffd3a3f84c3243e01be7c29c1ab4ebe88e882638cf519c6b2776eab54a89878871	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3048	2992	iexplore.exe	17
PID 2992 wrote to memory of 3048	2992	iexplore.exe	17
PID 2992 wrote to memory of 3048	2992	iexplore.exe	17
PID 2992 wrote to memory of 3048	2992	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c6aabcc58818dcee2d11e3c9794768d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feb0406b923dc727295ca45e213a69b9

SHA1
e8d97acf49284c799d59ba9dba0764ce41847d58

SHA256
d2a98cc5f8701fd7fa59d632a7f43084637990891a186fe4415128e2d7a97005

SHA512
bf60f5bff98635b0e3450b811cd5788d7599278a9b2eeb01a7430d0e00533368477d241d8b8c165eadfc7740894e2173220863f91f987e5f1d2caef519da2451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5185f65bee0967b903f4e46381af4cc8

SHA1
b1bba7528aaa1bbc541c0577034f3c2ab6d63a38

SHA256
9667cba04c4cd76bff227c1161ee2bdb1af5b30e45641ab7e96d342b28ee3d8c

SHA512
8497fbf88b37a2d38a71c40e9a70fe3c37cbf5e8721efac82b65b2985a314c2e9699f94c5c24daa9dec73af1a793316840025e2e7c7464c497372cc300ceb817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d74603bc631d3a57943ccd7bb8b1cc95

SHA1
37b58387f1c1cc8119837ba65b7d8e19ec4fb339

SHA256
6c68e45c48e506036d7ce975dbe1991992339c4d0278fdf5d97cd8bd97ab7a57

SHA512
824904da3dc5d8958553d4f8cbedfe7f5069d5d9a4e1cb1b409520c55422193f0878b903544b0bf5da65e38851efa66b8606cfd12e78c7445eeb40d4d4082b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af1556f58d7b26642d3fd3757f241601

SHA1
9178d4c9853cc96a7985f048e89553016217ccfc

SHA256
31376e6815e8d20c8c9d5cca99ad508962099c8f666e52e140f33aaca6e7bc00

SHA512
abd513cab4e95ebdad970eb1bf2621d2769a983f937aaa5c126285edc3f36a3c0d1227abffe8faac7fab84dd061b6c60d8da62cc82262f3fa9179119ffc5125c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
054979a66022f4300127c427d8e24be2

SHA1
4d81d856642a51788712b9ba26935e51c92696f2

SHA256
9dce58a8e665916461f3a5ad17053d05697fa135bdc5ca3d3fc69e3693b504f1

SHA512
0ad10da920f46157913f2bab2886104437df45106ab598dc0f7312f2504e1ece4677a46148cc42f458f549702e13ddea2bb5ac8679dc38dec810d7150d89c556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
500074234172a19a2a06692ba93597a7

SHA1
7acbe84c3751130bef629ad240f8b82d2e1b6122

SHA256
39e494896865b7b78256d464af58db09b3f7d355800e9b00ab0f8c70383e4b92

SHA512
c2d65eaeb674d93e0ce00c91f614904963501aab7b5a6c17d0bd289b61e897667d804d90762b95abedf55b6cd408077b990ee91ade9960d93aa6b6960a4cf20d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dda6b076bc3884b6620133cd25e1e282

SHA1
e16252e8341d5adabe480f1d5e2f119a1bb3bd2c

SHA256
98c7703c92a018ff71ab67705010dc27a34297160b5f9997872455d928b703c7

SHA512
776e81e42089cefa9168c5b166031feb658c1491caa5fb6898e7293b9b08996e7e877305ccb2bb45f0adb3a1b5a4ebc1abe5804a6fde54dd1af05c0d732a7c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17c7d711b1d01eeca7b690648b78dec6

SHA1
dcdd8a1b0311ea32971d359d474e8c9345486a4c

SHA256
eb485d04390d0cdeed15934bb2053bfca58b309442b1dfb4451c02924f17a9ad

SHA512
72fa86cc1df911d5e777ce24b0659e95ba2d6f962b42e8d0e0bdb9392eb53dea70e8f78edcdb522adc871d62e07ed4e732317b3f920e6bd4d09dd40a42fdd62b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b819de14bf319733601087ef4ce8caf2

SHA1
f3c761da26a8a2f83d9aa2feb8c63829629f97ce

SHA256
20d99d829e6208d93a6dcf47899e373cba9757bea5f5e4a4ea8c78e2b0d9647c

SHA512
4ef6b3425b6ff3150d3bbebe2518d32945bc416b752e69d19ce9739aad1bec5ede8e082649b4372d5bec326669bbfe0b25aa7a830a26619bdedd804945fa6fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HC4E4SVB\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit