e116e0cf668008bf8aeb3c51aa5d476c79af1cb8967ec1edcb2fb103461c229b

Analysis

max time kernel
136s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d222cac655aa4ee12fdbfe9ed12cddf.html
Size

9KB
MD5

6d222cac655aa4ee12fdbfe9ed12cddf
SHA1

bcd7816f5425c70b9047deb7a8dc8e646a62556c
SHA256

e116e0cf668008bf8aeb3c51aa5d476c79af1cb8967ec1edcb2fb103461c229b
SHA512

a1da615d630af992ebae04e73ee669737b271f9ef05d7e992441fabfa3a4455d0ad7df93e409c10b0b486be362382d04d541cabf9a46e5cad5fa0adbc8027baa
SSDEEP

96:uzVs+ux7gNLLY1k9o84d12ef7CSTU3GT/kPsfpUlVHcEZ7ru7f:csz7gNAYS/G2UPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000610561f282abee2f25dcd68fd554e909c4599b1e9ac2770735bd3d231337dbd7000000000e800000000200002000000030c43a6db316767414efa6d501cb891311bbb71580c40f1069b20f0363c7c19620000000e1bc445ac0cc62554ae925e8a45509090eb3f4527fab6a28fa016729aab7c5c540000000fa539d05bcd7b452f1136d62ccee8e5178d51ac7c118f31d8c7a7e62cedb85490881112bfcd5d974ef1c4bf11f7386f246999ef3f79a61619b930ccd04797008	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409873692"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009a90d86312c31e6893ea0b473f9694ea045ae79dd07ff939fea73e034eb735b0000000000e8000000002000020000000808ba774dd45ab90db4239e69cff9bd4946f93c83616fc27b3d678d6ce0dc53990000000520b090c17f3508ac30f9be224f61c83981397a96a2c9201653f819bbe801da2b8aed423315ca9afbbf7da80d449774bd430e5af56e79be0774f96a07e54c3263a9646ef43d1b26468dae79e465313b6755a514a9f7717f17326a48e218f3a34ff5bee8f2e71e81517c089babd3b2e960ea48f6066028dd320b3a3eaa067941e46682640b9616300d20fe9c562051cf34000000063cfc2f6dca9055797f7ee0f78fe815e8a957f245d0403dde4f99f96dc61370f0ff11903d55714dbf6c1b12e139b6cad41e2e8548220b81094d4843f2cc2fa07	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0051181d0a39da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46F3BD21-A4FD-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28
PID 2108 wrote to memory of 2116	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d222cac655aa4ee12fdbfe9ed12cddf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
211a8a3e042ac24222cc2ffd8668a331

SHA1
fb407c95b6fe7738794e35862f1c90ffa737c276

SHA256
18113b4b63615ad8eabffcd4fb2cbf77dea318445e3e7b05fda5ba513816e9ff

SHA512
909a88b85c187476e109611d675f2cc7c7108e6746e47c7102b0a73449639a1f62ebb21c6509017c39fcc49a515ec4a8a77836dd38825f578c3e32b2aafe17d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10488f65a561d46c8db3cfbc99ecc1b9

SHA1
036a9e2e280e68925a28e731d067ef7095a6252a

SHA256
debcb46537bcc2a617ddecded038f37099a049c34bc70f519ab67d1f34267107

SHA512
990935b5c25d5a63f5519600317d198af8a2d6c0f8de0bf471297b9a9fb5631981b1c4c31c9693bdbb7cc81b75d12594d4af7f4e3e4a123b30ad693a31168de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd9b4ee685aac314feb72a911cc0447

SHA1
bce5a36359c1549b0ca9095c9084d7f97c1b8ef8

SHA256
ead152d70e9566ec3142a7b769d7a3e7b5506f1047221ecb6629e338567b90e0

SHA512
3a648558ad4daa75256c2501ecaae8287014109fc4c71822f47fa20d656a9ad526c19224c6fbe4dfea716ba4bcd463aea8aac7a7c82bb0a3f61dab0c17af63a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe486569b1dfe283e8303a9af75a427

SHA1
e30c4955126f4473d01d1975c7a596acac2ccb09

SHA256
a1976d5202459f5fc9fae5eabbd28c1e4a29e118ec666f337bec20212ea62fd9

SHA512
9e9b2c2da232f632f3f3b753c85655fb19dcb903591e3d8c22a24f6e34a4c76edd2c919985ce188bca3e930095c67d2d7a76a06e4457ecc0c7961c4f70cbcfc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f78b8c334bc93ad2ff1e21faa08cb933

SHA1
31bcc9a6a37664c101d41e7ab0906977174f3d96

SHA256
1c98261ee7b626771909395860bf053429e4e76125e8addbf7d74bbd34678df4

SHA512
a1c96bf34cde98966ca73a90edf9e5239e7715c478b66a5cf61c7758e6aef92cfb16212cb9a9d1dccd4bb4da52dd838f15c8631fd8494e08b80b3dfd9d7996fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77cc987dee022a41aaf021de9e7972b9

SHA1
6837e32d0a4b2e2a48e2a0fbd67d1b8e85b006f6

SHA256
2b7de4ed423b1b61adb92573c0ee9a660e0238e9bbcb00cfba3676fe0b736e8a

SHA512
1bf998a772df9aa25e1849b7ce1e53f2ff124d5bb505a395adbfa0913f959f8b06002934e01b4a6ce0d05c4e69a8ee3a358d4552e1622652e0467531c7728e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35800f1e728df56881b34d81f3c49289

SHA1
718418f636d983ce50296a11ace74d97a4768261

SHA256
aec6f0b60bc0dfbc589615df5b248dd503cb5bed697143da5d19f4a1a7bc60a3

SHA512
f57fe1fb8b4660c84689861cfdb00e9d8e6d2d1fb0de531e48815ef9696a1fb01f7cdf4abb17ebb4cc6d469995f7fc715b90e8f5079b8c2be2657a65a162245a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
386934406e3a86044d7f7c6057f93941

SHA1
bd781ba1553079ec4ce919e774046a2e15324c41

SHA256
e96402cd3b5b30d24243d196a8ba2051816655590ad0b476c326355395ee81cd

SHA512
192da5bca61773ad8da24bb47abf35378ce97714fee23d46292d0018682d95e1d49a79c313578518b60303ec8b6f0d6df23b8a09ddf4531dd3f826d8c1625388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0591e3c18743a2cb8639ad8d8edbd4e9

SHA1
a780b18a7c5a43ed62d59f395b98aa2240e40040

SHA256
4796b93d156926639a59da45716a7b9c1865b1eb41bacb79377a4363f3a9e446

SHA512
dcad4432931fd38db7522dea6cc00c21276ef359d73dd72dc80e7420345672d077eb354ce518ea90bd3587c4fc0c2e379b7c01bcc13dcc9be155934cb0ed7eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cdc6a8da4cf82880e70c5fd8248a430

SHA1
a253f853f4f99b366bc28e3d60e96bdf6784f804

SHA256
11d4e00158cd17a7db207a5626e7404c112e919311befc55c70f8f8d753b8ee4

SHA512
6b3f43a4766429d33c19d92d141775fd877029475029ec1710e80cd2d71fb15f62294bfb1fa89142df07190c7d4896090617322ba7ba7f7dc997bfb34a4be5db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29da450308b8d8d824f7ece7aa2586fb

SHA1
d5c78ebd97bd631c81c71456e03c740de68dcef0

SHA256
3612b5432c4df3d643d2f85eb1197826932ac4bb9f68a2280fa1293b5143c821

SHA512
f09dabe1bb0c945fecc6154a8811e3264f71581c1c924a83a6abc3a04bf7de0a12bd4d0aa1c425355ee4b7190f8e3eb603408335a6978db3408f46d695fdaf22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ae6bf0a21c9c6297718f511864f1e5a

SHA1
3be076134538506654263be44cb88321298cd0da

SHA256
fd9c5c35f7cb2b4c93b704996f9f3d60f50c620aa0508de5bfabe8a737d071cb

SHA512
4d4979f15f3f18f376a866a55342098e92880999a30a39f06db5072ed1f097b2c0a1d067a4a880c66d3458f63b17f40856f3b76d9a9c13699199bc9bb8f497cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efff618b48e287cae09ce34371d21c86

SHA1
d3513a74774a373eb94f7cdd8cec366fe998f0c5

SHA256
b14b6acc4e4b2a320d87e92397d426413450ba356b3aebe4e4613a8ef4d0585c

SHA512
57776253e4076897162714b19d43e9280cefd3ae2f98358e18cce1d600dd89464498e0d422e20a062bd633f730cae2553dcf0eac7869b63f8adf25e9c97ccab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb298e9721553cda0fdf5baee302651d

SHA1
395d3a841062fb799ff297a7f7071c41ef9fd01a

SHA256
cbea2f4931812a4a1bafaa0fdc2f659fabe4005d20b64d2afed621dc6f91951c

SHA512
166778ed2e42d8e8f3ac45fb9163e7960e3925252a69898f33ea57cb3abf3b514b2ef8d12417ffb10fa01588fb4d16b9d836680a23b5cc2daf3a3e5f925134ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c815c63f2446a23f6d71c527ab3d374

SHA1
3b9cffd3d4807f41cdd9f996341e8e58e9750d6b

SHA256
dae80e3e854fb022f0cb109b6bfc76804285e259dce1f7c3866e423fa8937043

SHA512
e1afa45cf88a1256e868b167877070e2ccb71b9a3c61881fdaebc25adae4a58f5e6f8687487bab89ba67a1cbe03bb8aca644717efe1de9aa22ab6a7c85ef7e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC094.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC152.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit