e0fdd52fe17e6ceceb5d3c48749b500a090157dcf15d826b3017dbe8174ad5c8

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b4777ec980a75a5a593122e3d388daa.html
Size

69KB
MD5

6b4777ec980a75a5a593122e3d388daa
SHA1

81f8a38a9613a90b3764aee77181c8304110af4a
SHA256

e0fdd52fe17e6ceceb5d3c48749b500a090157dcf15d826b3017dbe8174ad5c8
SHA512

f8b861ac323cf4f6bca554d5d6905c22b5dd3eae55f35c63c370685a1bf397bed7ba138cdae2ece8755248a213eb276c1997f1c31c700be2a2f3bd1c4364d37b
SSDEEP

1536:gQZBCCOdi0IxCSnd5kja9orkdsLOjwE3dwjPXW+KdSyRUUXxBr5Gjqe60gAzCdKF:gk2A0Ix15kja6rYsLOjwE3dwjPXW+KQ1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB466031-A4F4-11EE-AF58-6A1079A24C90} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000710031b6c7191e7534eae855a2fe1274ddfd27b2a41e6585fcf1c5f304edb718000000000e80000000020000200000005a0e45caddb19231c4fa0cf48c1c21e26619e5029a3f7623a42c2ac7a19d8e78900000003030e9279eea107862c6a486cdc4a89c83bfa1486e678f634ee0ec6680daaf6f52d5f1fb546e8d66c028e4ac3b42b0b7f53cc0aa3fe4100eff7384b9df1b7489d59044ad09925b8adf7abf33e27e321779941d4a00222b68510c341318101fa5fdcb296ada6bf3dae31e18933d773d9b15aa3f53a32e6ad94952636073b33c63b53e8a4578e56108cbd239624facb6a340000000229ba153f1f7933f9435d5330b40a356483cec88fd87b376cff3d5d37a36f65c18e8405a587d6bd47f9d8326957005ba63cd6e9f2f62fc3746d2c05aa8b2db47	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409870084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7002d6c80139da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000007b9273bcbb91dc75e109021f2a935ac03b876d6b735c40ac09a6ae2fce8cfaa4000000000e800000000200002000000073493866f9ad036bcbecb249a4a98ee953435d87f93f771158331e053b2bd52e2000000016f24f2007fca8fbafc8557a14b3ea298c852177f533e7f52c29bb9fc1aad4e540000000df0c69d710c3b9563132ecab61a1b231150865e96de7d9f2d8d55d36ec460b9f4401801c74a0b624847b73ba7d14c12d20766ffb8ed41c33e9168bb327f1cbcd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2352	2140	iexplore.exe	28
PID 2140 wrote to memory of 2352	2140	iexplore.exe	28
PID 2140 wrote to memory of 2352	2140	iexplore.exe	28
PID 2140 wrote to memory of 2352	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b4777ec980a75a5a593122e3d388daa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c528d29bf12167365a551794a282ad42

SHA1
3398ab58f08a61d3058ce4f5483a337fda8ff868

SHA256
a4465a3ca08001e2a81e69d27b44d31cb3aa32995837a8c11e121cd406a51985

SHA512
81c942be1c8cf637516073558a220e24024e8c729f33c4bf1c09e2e32876946266d4d1d3a21d642ba22a39430996935a11a742a52a6f38c315d5d4f22bb1ba31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ef3e5ba7727c663d221a7a4665ba2e

SHA1
9fa2a97459c06e69b45640f4f2b5f7931a0dd15a

SHA256
d5069b125d1bf754721ab6599c81020cb622e6e6a038173d058c9e1a278639f4

SHA512
0b9ad544f2d37de7d10c46195d73471468b798444220adbebf8afaeb135265c98dfa3bf4f12fca0d519431346699e22ac5c23a340afb46548486776723102058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eae504f84601bcdc2498220eca37e10e

SHA1
0f7f74d65de99f197e54aa6be10c9a5526072b4c

SHA256
07e4b1738c5218d0b6bdd619200e4eabb47b0169e1c52fae55b9d638adf6f675

SHA512
25d9222783e53c7b03dc52418546ba10b3cfe089fcd14b1e8540c79fe889ecfde3c7f9a2425f5324827087f30f842a55f320263ce7ee0473fe666faf596075a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49c2f4db195bdfd89b55a7a38965c5ad

SHA1
9d324908d75435dfeed444e669c223e0a6493d35

SHA256
be758f5a7cc0b15bb6cd6f0380a67f262703e236189747d5aa17e0df5ab9085c

SHA512
6e34d1376867d4b099499e40e566aa0ae5a39e9f3fd4d2227d513a1ec71d940584d3fa2e763b347edd446254965792cc7c9cf84ebcf6e52e3d6f7025b3b426eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5a36b4db3cb59721348a0713fdf137c

SHA1
ccc5b0f668009e65226556fbff3143a712a49b7c

SHA256
95d2c744f10e95565fa98f45cd0e208ebe2a341e2f4e132474a163b4f773709b

SHA512
f4164e0a0c0e8809d3eafd1f78059d4b0ff79b9ce85be2e3025d6e23d1e2b78b5053e3173afec2f1af50bf319598bd9ebf3bd4ceb29803d4fc928aaada227f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b439c9b59ee4e5d5d151b4ec561b3e72

SHA1
5020c26207a2fe3e643a300881db28613277959e

SHA256
e4c5412f4c0228a2ed06d294e7a3fc61169a53930af1f705cf739b83cb3c1c26

SHA512
1f133e830edfcedbcca1f4d15249b678fc805abfd6030788cb94eb577f608727a9e63b414cc37dfaece4575f775f3ba30cb1e88be118b757fd3e9b4ccc5ce208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7832d3d73ced03dc2e2a4b173089ad63

SHA1
c6855c28538e6a8997c0cadfa6e76ab0e316eb51

SHA256
bc75d88a908fe93002a61e873e963b854570247473a0d6f6c1281543efee0124

SHA512
1a6973f4fad715481d5c9a058690b5e40062eb44110b1e8a7f8aa7f7ca5d91cc41c1e37d97f28051043ccdd52ad8961b9dac22cd4c32718166ec4e8b3cd53369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52ba36e82eb3b44fcb4bb7c21a6c91e2

SHA1
2216723c38e1840c1effa1ebdd283c36541a4f2a

SHA256
2c8cc1d4028c7d72f8ee2d95f4b8be888068de1304455bb7c765ab50ea80fcb5

SHA512
68c0e9b08425ede7ec2eae37e0b68e0ab53e261911803ff017f035ff809f5741401e005a0cc4c29af17e2e1b0f6884cd8f1be224c12709a87c819685c72fd91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a563a7b98f9747fdd515c9077e7bf878

SHA1
dea1f7d6ed856292d333fe0c02bad8dcabd0e339

SHA256
33cbac0917f5931d5b421105c5a045a2bd6cc694782885bf84ffbe04e2bce62f

SHA512
63cc6f3f4ca0f4a0540d8a7549c9ad8507ea4ccd61452500e8c1b5139ba49b18c9f9c20b7693db84590ae62674216d0e174535d47f2ce7be33da12f937bfde07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f30686aaa74ff4fef0b31da40b076d

SHA1
8f736cdedbf17c0ee7c01da1b4296238f32090b3

SHA256
865245eb619dfaab9ac644cf3051c8e91fe530c838055cd410dbd9cbf90bff03

SHA512
f686d54dd1725295fdffe618a654cb4267414653d6b826adc0e9f52a891eb0f0e32d22d8239431977bf4c516315ef34243c2a74f817f3bea7befed789648382b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9621085dcd78fb20231fde3bbdb46724

SHA1
ad7fa9d173a84a15dad71d39cb9a02e57190af31

SHA256
f7fdfdefb04115794c8ece7c2e89ba5259f6daff34b49cf87acf1e39466d902f

SHA512
984ffb7f5afb84c57ffde760f6cab4e6c9ec1b3842bb0207c8daa69f34ed1fa729d042fa7648f7a18b9aebd65307eb21b3db6100760a1abeba7c245ce293b31a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
118e3c8ace356ac8fb9e6b2b93e0d931

SHA1
bde443532c7bc6ba78a0ed63f374018d9b358fbe

SHA256
62186b190bb8ef4c1dc9a1e92d91047c43ccc1b210238e633535a78aec45bec0

SHA512
a2c88c88a2e459e4b7012e46fc20bc3b1c12566c00be0d9463c951ce80de9227391aa46c1a5e00fe54a3087b7db9ea38459110572244085b045182c30ef5bf8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1863.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1875.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit