2a7efb8a9ee5e85153f17305eb66913d0931e1137df107542598409a5d4aa214

Analysis

max time kernel
118s
max time network
167s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a53d303e861d83f0b58206d2bbe3230.html
Size

38KB
MD5

6a53d303e861d83f0b58206d2bbe3230
SHA1

f838aed6e3a67a0e06687b12bc2f9ca81154ddf5
SHA256

2a7efb8a9ee5e85153f17305eb66913d0931e1137df107542598409a5d4aa214
SHA512

098d50b01a2e370778822a884085e4d3e3d6bb57c5908319a5bf6a6b9ee6e85a37e643e51aba55778bf76e79c9d7598f5fc81d1e23b5411cad3fa91df1c9d13b
SSDEEP

384:SB8a/C8Bitdp3RIBqRWutLUbED1hs8vTJDCztdXqMvPzhzWWZbW+Nt2LoqPAl:Sx/C84FVUm11Czt9qUzhC2bxt2Lof

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{702FD7D1-A4F0-11EE-9BDC-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409868184"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b010a753fd38da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002547c87d6c556dd28156e6b63018907d3c1dac986fb712dafe93ec07b5422a3f000000000e80000000020000200000006aa06368e659e743e591c3e63f6d2adedbcdbdc80441e717b23bba73526c9c5e200000006991b24740e0ea10de8c133dab8768b50e9618c7800b3927e1fa93a34d9c961b4000000053b02391a23c37333bce5df285d8e2b4b9ce168d288ec2eb0e894cc62317c33f74c29eb08adffe05556180b8c327081404ba06902612e8b2ec3a17047cc93ca1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000000ee192fab9ee9dd1038fd9eedf3a0d1dfcd7916605c7c9b91009dfde719756c000000000e8000000002000020000000705b9416a32a0e37fe9d038293d61f1892add46b3934609eba8845c44cb7a658900000009b63b44ca66a95053a7c4c396a5ebd1170c4271731771de632f59c12591a276be831e5b8c44e9bdfbda3e3f6d0993299f65ead4b4469995fa6be33b6f357bb0364c16bc9b893fb1c1528b59369e6e65bd7813a764b16cc3091ef7e8e69a61356ccf93a44f3921a29eb176f6811a637b7673d9f459b5cfdb20022cf7fa0ade67a6f3d85a9d0f751af082b416acc4c8e81400000008ddf0fb7cf9cdbc8ec86245b8a6d87e3df2edd08eec61a721eca2c75a18315a64b45c7c5b72c7e2ee4ae1e2ae0c6582f8ffcad5b20378ec1da5caa41b790b7e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1244	3056	iexplore.exe	28
PID 3056 wrote to memory of 1244	3056	iexplore.exe	28
PID 3056 wrote to memory of 1244	3056	iexplore.exe	28
PID 3056 wrote to memory of 1244	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a53d303e861d83f0b58206d2bbe3230.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db9c8ebb28e262928990e99a71f22419

SHA1
ff547dbf2ec03a72065e002fc3acf339a185c251

SHA256
1c64ead7e95a90e41a37c65bc5038614975ae566b130e48b1feec28b5b4533bb

SHA512
4dd2c284a83c942b91d0607b0dae6d6697f121f4e5a75cefa2d7e33cb8b05fe1d0924037d3e90a438dc7de9532d8890a5c464b2f6a646ee049ffc6c8252b72d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7571850ce9b20a216c80ca9e1abcac6

SHA1
a8d490b272cd3ade2cbd43ba3c63824f80002458

SHA256
00cc7fae637ef5c8179347a995a2f569eb1f2cdf92a616ee457a8b11f6422a89

SHA512
04dbdd426081661753ccdd1106c85606770c855de70517590d4b8f5263e279aca519538d5d2ec5db78dae800492a66d4d842a107556753d11f088ffd9682790c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890703640c3b72003e6834bd1b21116e

SHA1
3ba824170349d97fb96ab566ad9b8dc757047ffb

SHA256
29e1611b8821bd5a8dd149d7a3201e3178b4566a7dd7f78e45905526451c1b3a

SHA512
5f45048d16065348f58717007ff18324a4136119d3831009d1d2049a890dabf3bff7a4574fa59ff63845ec4fb1c1aa653480882ee9a768e9afd3aaec7d06bb61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b354ad7b370b535a9a092e320c5abed

SHA1
8c2fa427c2f73d29782b03f90ab0de492faace97

SHA256
1badedeb916ac1d882650fefc44974f2856788242289273ab0ad26964b51897f

SHA512
b33af795f0e8edfa1c7426ab56308ea74e5d60af536947ff2678fd30fed6c0b6b7aa93fd52d352e15ec7ada95e46430da69f8f14d6fa331511305a9c7939c3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803c74b4c5f2afbce76d6c846b244cf9

SHA1
10ed663890402bfe24d5395e2dc9f0cfebbec7dc

SHA256
0ed629d8acf8ea8b4e90301fa1994fad31dc23e0900426339c1fbb8e9b72ede0

SHA512
c725d70d72d6da54d9193a35d45a56c9272b4967acc2400c40ffa8f58b066fb9641f7fbab6ccbb3bcf15211b66d24bf71d66b0020bed1a30745541b02f40050c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f03ca663b41ae6ecd0942ff9152754

SHA1
045260f1e59b35e5436796f4625e53de466f0517

SHA256
d67c91c108a228317f71aa161a7d8ea601423208df048e4cd63133cfb1d62b7b

SHA512
26864cc5da088ba992267449358f41119f1b1230d2bcbd8d634a7c4fd319a120bc4e512d6cb86fc33d3295c240eff9d76c4a1692580694fa5b228b8c5619020d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583d4c0437fa18a3c7805a71c28be42a

SHA1
bf08fba96b2a8156267f6d48a707e6b2ba344908

SHA256
b895c6edd37c8f2ac7f6615d72d713143d56943d13e6cb3b22ea4445a3a0b097

SHA512
190e387d25db896363218aed99e69265f8871a535be1f6540dea026dce5d498ec557ee35869f89f7b9c14f514b335a9a33bd0d8917c61d1d80c7f5fa87966f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f375f36a0b30802d2ba75ec32b082a6d

SHA1
39a741221bd87e82b4c74a35ab9b8921a52a59da

SHA256
f10e2e3bf7224b6bb39647e31351e222c749c1411dc34ef8740ffa715b4db34d

SHA512
68d7273f82010555373fa04bbb4ec54e15639406f44ab20357c137ece3220da41037c1a4f10dcef34c5355fa398c81356bb5f0afb40908adef001d729edbf531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8acbe9b00749086ed23f0196e365c41

SHA1
ac87f17de414e1c043ba7c4d153d8889423119f3

SHA256
10e748b63b2703bab9e380c8b1b1e2bfb3bd7c4502cd14e5253f172f3fa9867e

SHA512
6ff341047b65de398be0af56c370edf31b046f95c19316862867dedd92fe7b965119d7d9996ae422c44c397d749e45fc2ba32631f8a8e58816d6aeb0f4d59479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7cefa0bc872faf64da7860d3a7392a1

SHA1
d9511a9b51483649ad98a7bec8bda1c07e55fb4c

SHA256
d718864d38d7eaa3f1146ae31a7c8f787af33fde859f285fd432e1080b6004f8

SHA512
d37c7eb79dbfaafe40bae81f72e4e25f0b3b6700a41da5590a85051d54bd4565ea4e779c92cea838e87b203ebe6251401091fcbfadc27de30ddf744d3910e928

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3803.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3804.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit