3815f0cc12adbdd8e3602ff01a39862ef62389efc93edffbae2aacebb5a923f6

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a0728c9342dcad30ee2a770d1116a5f.html
Size

895B
MD5

6a0728c9342dcad30ee2a770d1116a5f
SHA1

7524cede5fc66412cd1a15c25a85b202d5392fe2
SHA256

3815f0cc12adbdd8e3602ff01a39862ef62389efc93edffbae2aacebb5a923f6
SHA512

7eabf5c79605de1923d7dad3ab4d48813791a9eb71dd243142abd4d534692431370befa5dfdccd2598a8babb0ec67b3a04d71472c259d05925b350ad9de2c6c8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05e389f9440da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410702865"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9303E21-AC87-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000017d43f3c6667a43bacc18b8388294a7893461130daf5a87da40f14dc8f074327000000000e8000000002000020000000b5a55f7294b82df9164b45340c79274aa3ddf61996d91f4d11ca8b98e750853e20000000e3bf254c61365d5d5c306866cd473a4f42059885c43627c3bca7df9a71bd9e6f40000000e519a1dbde0a81eac9791865976b2dd197dee72bb4428c0a79d0f0d9d001c97f444373d66c94d2ff3e8e760aba687526b0a870c354112d8bafe4bdde01175eef	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000080eabb6252e244635cf94a016314ca918a8ce3959078c30a139511ef79dd0dd1000000000e8000000002000020000000f48cbac53b3d7a8786936c8679805ffb8f2e766ed590af446179bc40eb2c167990000000f4a2352f1be523f375e5597d1d717d65f03a92ef0aad074e552cd8fd63ab31c99e8a7e4a1c6f530d91a1bea880674565ecd51985fea57031fc9e86e65a05c043eb98b8851eb21d5747498f56ef4135593710d1647f929289b2fba5f35866caf8308dbd113303ae264fb74d2fc36dd54f14cfaa155f1ae091eff86f1cbb6905f2838d65e612c2b6fbc288c3b938b95c7740000000556be0f75f78e786ab1efa370e7da29b6881a06879276a510a425cb64c8d34aae99ab637d4f5376a83061064e3a33b07000548f14b802e66a2e93008fabd6562	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2648	1696	iexplore.exe	28
PID 1696 wrote to memory of 2648	1696	iexplore.exe	28
PID 1696 wrote to memory of 2648	1696	iexplore.exe	28
PID 1696 wrote to memory of 2648	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a0728c9342dcad30ee2a770d1116a5f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e0b325ba52eb6d19a1e71f7efa3bdd

SHA1
cea02ef802e1f8c2282d2f579bbaadca08b8651d

SHA256
7845e17befb31035c1ce8d41dccb1c1a4065e547f762aa5f6c533c5ee0db0b85

SHA512
f66f248752ee099bd81e0bc3aa904a2bfa7b21d9cf8714ceefdca928580b4fadef020f598343fb63227510ab235406babba655305e0f712593b648b025927b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b6b982b9b5a3343b723bcfb0583204

SHA1
c54507624075218f203fb2c1e7d77b7a7856af02

SHA256
4dddd89917499f265f75f95740b394fd1dc97bdc258a4504d34bcf03ae87bebc

SHA512
81dcfc4ace62581812aa6c3688b7602e214a2c3b7bf0f6ff236375561eb69117650dc2c7ffd9d34160f9e0e217d1be5cdd2a672240e3890cc610bfe5387c604b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7557f38009626b5c58c6b66c6ec29ea5

SHA1
3f02afa922151f4a3910eb6961f3ab1a05fe0b5e

SHA256
a60ed42ac990bed314fae4070f674d86cfda5d00747798dda521ecbd493e8862

SHA512
7b83d0e2138337e983a497b20625894d43b1c5521395f2a8f4e63e587acb350c2ed0447ef12575f713a6d291ea43a48c7f0beb3851edb65a79c9066f061771d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed54618124a59d5439f9f59a49add8a1

SHA1
543b6908843b789b811a39ba06def66b23271aa2

SHA256
6c498556b8ca8fa348232ac0527441f18189e4e14a48168d0ba8d5a09c6e06d6

SHA512
2b5da8726b1f14e7d8cf8c3d1b26378f3c312de0eec78bd1e189c09124d50e9c7f2fee13f0be94850ce667aae388928bfdda12d2479d59ff4fa129daf3a3d70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a410aa8cdb9fd2eb1f2e59add124165f

SHA1
fa4d4dbd5c500bd6632d5d1c3e8975fa36e92d8e

SHA256
a33e9edcf34fe6c7f8a51244914a0010feb526e4c2eea4dea3f96b4ab305ed97

SHA512
662c5274b18647943e2d1c4a42dc3da70e8e16a3d7567105debadc8d4938222aa7cf64f941a4555f0fad15aa9b5c19b9fbfbc47cbdf096872ea8d678de6d67ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fe8f950553d4a8477aa5e16eb528b95

SHA1
0b288e74eed429106bb99bb1dc9760334e45961e

SHA256
c9b5e52452cfda2af48c4b61dc057e3255d04e2b8536fc6efafa60115bb4713c

SHA512
dc0a4a17fd94165c3f2f857e4a3f6a19e35540cb7a1c10a28052d574323faf665ccb0f55b003a836e407080c7a078116939bf777522d73058cff44af10d20aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fce39e49594065899cb5a1ca7fcdeb47

SHA1
41a61abb7a3c97c3b77dc947aebbe185bec1dfdb

SHA256
b02d778abb245b75a87e4d5bc90d9e155b05223bbea5934b7dacc10ed4ed0ad4

SHA512
06cc715778a5e42572ee39a896fa298bc2153d086dfef46f09e4eb91256851c574371aaa88046d8bc4166f6f9de1b8ed43da6d1e55c5dae93673a8ba8dba90dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75307a90d78bba1703efcb732410a2a4

SHA1
2795c9029b6aff2be69193632c54708b4ea70d72

SHA256
02763f8e4a519d0236832d04e78e2442816725e7de5b1e217788dcf1b4a8d39b

SHA512
58f64d1c1703ddf563efb1999371fcb8cb2d9486da424ca90598ffae27b3875cbc95a1cc11f0a2eb99b33702aece21d5b64980736ae83cea0e131aeebe68fc9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10ed87999172d3b5b52d98a39d5ef9e0

SHA1
17cda4011f51e157a96d47c67968520c3e1f7803

SHA256
e74ba7a2ab179e0c5dcb0c6d27313df0b71b4a10f16825148303bb1b58b28271

SHA512
bed127a68012ca4cfe92ee96608dfbd877e8b7d8bcd6668cf7afe5e522b0eef26e2072eb62c80705dfad1c3cba46f7344cc4cd1bcd352893e964a027c28a5836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e64ba75e8b617239e2019d6661b3262c

SHA1
e34d3a22d6a888490e27e1703ce08054562baa1a

SHA256
8f18cb36b9348f9dbb37659ee1247dcf55a7e334d57dd05889804590f88ef469

SHA512
6e936f14090c435c7daa6ff85c8eacda8b039a8da0ae84f179a896e0dc75c8cce8dba89797a3427b955e92072c87c5fd6383e9b12051631aa5864f93015bf28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46642fd9311f3dd10d3c0d9006cf46b5

SHA1
78dbb45493b530f588e46b7bbdf1cd14006ec4d3

SHA256
85bc11dfb5d9c6ae95a299162d1a3c3596760a99d55f779072dad1438caa54fc

SHA512
ac62948ab0fb17996fbcc9d01b7c7f4ca1c0d234c1ef04606c9aa27ce77be83ce4ed60cec065a2f9bdc5f7c9de1347ac5853641ca6ceec6df46959884e0b8f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28202f2bbc275779c4d3ddf03b027b87

SHA1
b3788473e93de8db0f7b7d2585f3ec289ac4b505

SHA256
3ffe86153a803ea3d9e8705b2d9df0b85355c880d753d39fddaf088f07020f3c

SHA512
ec3a38558758a12dc43ac7430452a82b14c3080da7d593a46c2cf4d67ff43d8fcd738b0ba45a36a74abafb045fb51fc69467f32ebc7019ae262ab34bcaef6de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e747eaecb2f885ecbb9d573df4a350fa

SHA1
9f256a2563f3da3b23016063dd99bc98f817d4c5

SHA256
72b92403441b3e7c78f240447400e9af41667810c5c0574e1300157e4b89d718

SHA512
99c2c39677ecf9f6eef639557470d84fcf6a432287b80a25fd74429193de3bb9d25efe1f7852f01e032454b5fed641f4e9d73cd658cc678b0d329efcabb4e734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa5b417b6cc74dc30b765e6acd8c6af

SHA1
123b0ec9bd58c8082cbcfc3883e49ac007b05983

SHA256
ff370c963ce0c0cd48ff863d4dee4c9321189f4c7a425cb23e126e618288b541

SHA512
169fd5057b7bc797226a87411725014bbb3c2418e101760894908ea6912e2fb6a87bd08d473af47891746c6a1ea4b13d32f0d25cb587851a5e8cb6bf28bc76dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

Filesize
1KB

MD5
026fa8954851f8075fe5885a78a4afc6

SHA1
8562629e5970dd5843e167c278ce27c8b3987e82

SHA256
6205916b24668fd7b70d572e03d5365952eb699dafb83665715319654f2192ae

SHA512
c130d275cc45e891bc1a1932ea4958155e6d64a07a4a796153ce86aff81e829ef055a0e7094897636dc5d7f3e679231583dd7df5b9625cdd7f458106d4d3968f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95EB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E86.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit