e4a645f6f336c30fafb46b32805475fb67d4f782b861945d9fe6b8e3aa87464b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d111743651e0cb339fda8e03d97dc86.html
Size

53KB
MD5

6d111743651e0cb339fda8e03d97dc86
SHA1

712ac02ea6725f9602d004735383d57b07dc7ffc
SHA256

e4a645f6f336c30fafb46b32805475fb67d4f782b861945d9fe6b8e3aa87464b
SHA512

f554acfd1cf826a048900e9edf9e6c81de1d7ec0bc7641c6d7b3ff3834710cda244345a71ddbcdd12eb99326b37a8bda6b157517bf2f1fa18704f29971ebc169
SSDEEP

1536:CkgUiIakTqGivi+PyUGrunlYt63Nj+q5VyvR0w2AzTICbb6o+/t9M/dNwIUEDmDw:CkgUiIakTqGivi+PyUGrunlYt63Nj+q+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000001bf6176fe5c9dd9e96d2ac08ffb128638efab66d6caabd8f28dce821fa2b2060000000000e8000000002000020000000542c386a9a43a78f0da7273e6d42d6cb2c2c66511f3efe66e8fd56f8ec21a47120000000821d9bcc1aa22b48cd0b5548ad20459e2bce38c1708f9e0805d4accb4cedac3b4000000018154c0335ea0de9109108efc8eb6a878aea614621e1d240794de04144c9d4e848158edd5965bcc0628e6876d077425b59c40046bd186f98b2e370cbeccb33a3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000059b57a004e8a358fd1c88f7e7b36f4bb495c786581bbbc5f7b146d8b8c548942000000000e8000000002000020000000ceb30c769aee3ca72f378273065eafdaac8b535b1fccbfcf3ce9e695800cbdfb9000000055d14ab0e16aad58b311524004fc847a5878bc8cb4f35d53c7325e3c07998025bbcf2c01d3151ac290c1b238a52d0101bad3782fefc6fd7772adf01cca440cee4b480313d1b8117e609537db1a0c75c501ebeb833600e5bdaedb922330014f59bcbdfb2a373bce35a2f5f107ffaba55528ea8cf9b599719fb23c6d4ad997cc5aaced666fa74877ff90b129519d5c52644000000049583665012f0271ee0ec35f137b0b8cfce63ac656b596829ab7c99f5871a5310ccdacb216299b60bb7fd33dc95af06a53759ed4b166c019bb4a6649fc719f0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07653351-A4FD-11EE-880B-5628A0CAC84B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04123f80939da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409873609"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1260	2376	iexplore.exe	28
PID 2376 wrote to memory of 1260	2376	iexplore.exe	28
PID 2376 wrote to memory of 1260	2376	iexplore.exe	28
PID 2376 wrote to memory of 1260	2376	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d111743651e0cb339fda8e03d97dc86.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9ea3e21ed4240bd55b32213c879e9867

SHA1
21e2b954e8f3f811dfb1dcbb5f0942d29b736866

SHA256
afd8c38f0325731e26e211412ed9b9ed8302d618197b7ac3783406f557198342

SHA512
c6467b58447789061196f79dac44abfc40633f891846ce1c5bfa33e28a5951a383ba31c6b112fd6ea453aab419234686a94c38e50a898e99515dc078dff9121f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a8d5bedb0627ac008dba7f0c17e3c13

SHA1
12203031ff02036f670e40ffad751593d24d3d1a

SHA256
17b3975dce13dc65701ae443d96717b768791896c59d2d1d58a1cd4e4a46aaa6

SHA512
7885949f0d23173392ddd26c841cfff27efd7463421f7b847c0215dfb5f60adaf9e0d6b145616fb8f11d433b99b723a32d72783b354a71001b237054f24f1279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b84ee366c272debff88ef9ceaac9376f

SHA1
ac8afc7f2cba8fb4f13668ed23685856f0d1de2b

SHA256
ec1d8d468e0adf945eefb0042e32be0a6120381739f55fec2221bcb05ad3c5cc

SHA512
e416d7d8f696d1459e66c6a9e5e90ffe98250bbf0416464090d18130f55b4e2fc8b2db784b3e8aedd0937343bf36115e4560f4165eb8481bc9929266cbec2058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b79bff837a54dd0ccee01c48176c8ab

SHA1
173d1ed4f69118fb814688333af254c8b547bfb2

SHA256
e5d2184a5ca9c84566acd91e2c1675223efec3b3ce10c3ffcc526d5d6022727f

SHA512
5e05e07dc04f28b7f988f3cd6e86234f23ce22ed3db93f4b8a0b676d4166485ada85013f0c866ab0d340654338f0e293928f29128b2f99c46db97ffa3224ebbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4d381be2d685199007969159b76def2

SHA1
fd4e553aadaf3283a76cba2f57594c0bed135f59

SHA256
fd50cfe42c4a38b39e52a2abb2f2342f5cd40e1f70ec1691186e8a163c4a5594

SHA512
4bcd927d90f624e17955f1b186b4f9244c7073aedea7d2dd8073edd1f614f922ba0ba8cf022160a617b0c6858e8e96ab2c7b0527d6262eb2ee8d18ba90c03d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ab850aa16c6142382b4b799f05d3d91

SHA1
4f02b80e44f07389c6c49a61b97d968eb41b866e

SHA256
d0dbdb964f7ac0164186b95c8e4049ae005414da32c88db050dc3e522fd92596

SHA512
8eadf60f852e318c0663d9df0f3710cf2ee6239a89f7809adb1c54ae71d10eb637ee4aa69475f8899b80d6d6cdd3f659d9d81b2a33df2e05303aea5fd48f7e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404375425669f1c6e02f8c38fb3982fc

SHA1
e261712e1fc4767152125d42d205f917dda0f614

SHA256
bee4a033e4d294f26392b2d0f3ad95f79f329020144c798d5802090b427686b8

SHA512
17ee018840ee382a2cd0ea77a111dd100b187d25abc24d4d010c26f7bdeae20ed80ad1888dc8480c55c3ae58690338ae3ec617ebeca1cf3c0093484979dcef37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fb782ea60007015ed8e25c8883c8c77

SHA1
b552a74a815d0933bacf4341b1deda120b513cd5

SHA256
f846003d7c1ecc8fc8510c48f41a77f4fd19d92efe1009b1db62200108d78a16

SHA512
56b4f0555482242973abdeea2e11740a7be32c5991c2c86946edbb17f14873da92b6e81d54bd9bf84d5cb9e865f9d23cce24b75a27fe5e0cddbd1f910ff5c3e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17cc4ddcf7e137e4f44ce6854a5c6ba9

SHA1
c3da306728c6da2ddf574f8b1edfcd44dbbaac09

SHA256
055461e9b3fd67bbe78cdcffb5a06919ca26ebf48dece2dc3375a1ba2e344a91

SHA512
bd04ae492aafd44e28e54056588857d488ff0d87fe967c62f1e16341a2c20243e08d8a7f2a29c1ae3212d796ad0351d22beffa389d489fd1ac8fa191a298e25d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a22dca3b0b143295377de356ecd601e2

SHA1
8d10ecb9ee24a139c315052ea5da7540004bb5a4

SHA256
2be36c7bfb7092100f7b25ce157d499aa9cddbbe1af43248c72782293fe48a97

SHA512
8278c12cd42b373c9a79440676ac1f6c92ddcfaa1191bb52f69b30580a77ef3859499837ce9d18615e62996d43e7f89179c83bc5674e281a2b121cf1d2c0b14c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d20e8cfb64e47bba43206911894e4a9

SHA1
d1e396537d8b7ece0171cfaaf804a4d7d9fab019

SHA256
3a2fbca2193e0e25fe296aed2f0aca3b32375461c5e14e104057a2ac04e2f982

SHA512
551754b860088640d418646fab0ba711145a6c959f01b6e98be5372c8c67804afe0dd07876c20a9a14d72f92bc05b521f257148cf55e4aa60fd0de62daea06f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
995382ede1c098a36a63e1f802053e70

SHA1
f8599304ee88378fbe6086814bf2517bd822d450

SHA256
3c157ad372ff892316f57db77642bd18e5d63ff0ad97c1b270c003bf458a6da4

SHA512
14ee3abfc9af71e211fb5f50765b9c4a6bd4f998b3e3f510e04cb372cbce3c6fcd52cf8ad017dfa4fd6c64cb3fa6e8b147bf7a6c4033149dce9a9a0312c2c272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0604MXN8\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE67E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit