e3847ef4a3aee0e81b099c34bd7019243f1deb08331561b5bb8b8e217087a9ef

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b33b2b680efa915411505fc066edda5.html
Size

9KB
MD5

6b33b2b680efa915411505fc066edda5
SHA1

521d2812023ba1e32b650b67cea75d5097c20c9c
SHA256

e3847ef4a3aee0e81b099c34bd7019243f1deb08331561b5bb8b8e217087a9ef
SHA512

11457bae49734bb374cfbd3c547a6402e3a0dfd383fa6e708c86e513a0fa5c9246bd9b4c861ce61c2c9cdab4345dc0334be3592e8e72888ac085325ef3686a83
SSDEEP

192:SIjpfuut6ol8XyuAuQX69T9iqW9TMpkh68x10zenAeTy:SIZuql4AucoSH10zeJTy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000030a7b7a4c5cb1e83580e5a3b1d506fca131a0c573a798d6a1bd0b360a83705d8000000000e8000000002000020000000297b99dbbb584a5981534adc0273648163bf61633dad0bee77a3c975c147af2e9000000045fc4ad6e4fa1866812fdc494334c0d32f51354bba07e038b4b4c630148436acfe72edfbe4d2bbadead8cdf95ef44772bf336bcfad6a9a759482a6d9a761f76816fde0577b29403a714f4d1d47829665b365711a88f64f1a34f099228d2f9f2123e8429dfdc35c8457e23714c8d0a97d92968355562ed54b2acef1eb8a7be56b1ebf63bcf966e4f7844c5d29e6dc9910400000009235daa7676f77d97383921c5194d1071db27bc0c058767859069ab76b285ac2a2ec8f9088dbc35d7b8de1ee22919d9b258064e9c9f4c01c2a4bedadcb2a9d45	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409869942"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B674B11-A4F4-11EE-A5DE-CE253106968E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ce0a7a0139da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000040b60e651e45d189e40186c6dbcb2d8979dc079960825230266daa00e65ea1e8000000000e8000000002000020000000a4a64282b07477f7ca855a4dba85d0c1afcee12578d72d16b25345be11f17ff2200000006cb8983967bcf9c33e4e8705fab8a80cdf561d8d8f104f217bb76841a2f23a18400000003fd60bf0d6ee5bb5ca6f957fee4ce11d3e2781c62be1633fb87d7eedc5c620c8f13faa522324e9661773518a20f735cfe23dd49c474cc62e5728f1809bdd6ac7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1032	iexplore.exe
1032	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2324	1032	iexplore.exe	18
PID 1032 wrote to memory of 2324	1032	iexplore.exe	18
PID 1032 wrote to memory of 2324	1032	iexplore.exe	18
PID 1032 wrote to memory of 2324	1032	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b33b2b680efa915411505fc066edda5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48d3987ba873ed1afe0106c68ac4e643

SHA1
8a8b1276cfc5d7bd876091d33b1b2c4f1bf2a04b

SHA256
a38ed48df666684fdf2101418204a9c4891ea2bc2c3b39f648f44261533c473c

SHA512
bffaebf761a5006d9bf4d08850bbbea00e6cf3026723f88668efd08c246fe73fc1eb0cc84290718f0e0354300dd4bddbe3bd0748e71b5d04c83a848d9466955e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc085e75e4c135f09c0ea4d87a1d353f

SHA1
0d1d8cdbb751acddb546e709f54d446c0f9ae94f

SHA256
a2cf8582f5ac1ffe3fdced0d7208fbe35b870429347af83fbee49eea4b6e55f3

SHA512
d3383c82289b8d89d512bdf28774f511cf3713d407db033fb1c89948260824bbf69c8d9477e4f7954a8405bc89c127abb14eb5113ec510b187293fe38bd3c81a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d6b2cb22aa8e22c046398ebc9e2ef95

SHA1
074e5279399cfc303902a2283794eaa4228e769d

SHA256
180955aafa23f73c479edb2fcddffe3b6e8e6cc29a529cf33106aef7f39a1be8

SHA512
3e98e6ec295003727071b6a258ba3b7f2b90e0f7c5cfa7cca66a0c25a1ebe22cbdb7455d64da4165ee24cbbc62320f395e05edbcee411b58eab56fcd983a6b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6efd93dd7a43d795ac9ee3ece7c6fc57

SHA1
9704ae6b9db4e98ac5d80e8f5ae169fadf563a17

SHA256
47a8bc64f9c91815b548f3f980edea180c90321ad1b67ec5cf9150d0f0b4fd81

SHA512
96d599ac45075a8cc0a6e05cf1f5cc8f26b5afe97ca16197fa14e93626e3675901c039f82cd767163a4592bb94b26634dd33cb2b76172918a31140f7736db9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b419f7ee33ad5403b0558111b8f248

SHA1
8f1db6b23c9361eb74afbc20033444166b9d2cdb

SHA256
e6a3a34cde1ab890eec83f3f9260a648eb89f21c2e4a5473b0cf131960848646

SHA512
a8064b7ce741ec88dbeaa6c2bf36f2c5a2218e20939d25241b7ec9bfbea950d996c4724923e1f481edb375b761259b5b0657a99233859ae25d8fa372d61a0a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b39789230c87228680f365cd7c8079

SHA1
40b9edb2ead4c5264f143b374cd964967d9db97d

SHA256
300a28bb6a518e2867a74c458823d939042526b9ea9ff92f9bf6b70ce5e18904

SHA512
be50f4cea187aec5da40333c2146a49c872dac9befdcbbf40599ebe28140ec4646103fb8d15bc06cbdd6479c5c6bc856d7bdc6076f797583fa425c67b3fe1bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1b76cf2315c26223a752d52bb75f569

SHA1
6550b3a61c8ae6f5e4eaf098fbb3370a51e2985f

SHA256
5736fac1df47f04913fabfce4a7a9e296ce98a17a1f5308ed6bfb2098475e7ee

SHA512
e38198721bb40d7d1a7c59bb3a4714ffa409d0d9ef4a3b3ef5cf72bbbba5976fa5bf7d88b4b9582722c06f72cd7522d03c881236c76d452710e9a741fe72d268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45a772f1e4180f2f25672a7c25017a58

SHA1
bbd4f2190b88e296912781485d49985e9c9f5de0

SHA256
36a915ba193fe93e7e5c181679ac1f4a7c3ed7cf76d03f4e22c22995d7958f3a

SHA512
75960f5e1231eabf3fed33cbe05e91cd48c4d048c454b236eb188f3275d35eeecbba7ade9b48b7d8ff369918e1db3de660bce61718e68bda5f874cd9a40055a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890a4a822a0ab2ab77966dd547a325dc

SHA1
89531fe7d6e9b2ee1bdfb02c7289140801370c2b

SHA256
6a6646a333ce05ffaacae2c8cb268e6b56dee7533d3530dbd9164aa0077028fc

SHA512
199da802cbc1d87437bba6bac557e2f3a5a246201af1f3573410b2165a1c73069c05f41ab3271eb38cc19b85997af990daf4daa2ccbaf8ad847d457e259d6be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b645432e91d337be52002d73ded40124

SHA1
af0a71f3c191970e71fa3a4a729df9c24752debd

SHA256
a9f4415cf85ea19e6edfe1d669cbf5228a7586756fbf31697b7b144e6c5b5d21

SHA512
a924cbfdc6c25a86db866b47196b1305baceccf51fe7f33fc42d0998880f5da11d518250e78040c9cdd71d273a8d1fcf409221f19615240796818ee20dbf71e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f281c8403106dd4a026e4b794b42fdf

SHA1
399fc16c395f43dbefc9ee42d39b1395ed64df02

SHA256
484dea7c266a5a957569e4c54daa50d68af8e77c2f417d4a28a02ecb80521688

SHA512
ce0560d83dd9e836a9e7b8998549f2390585aa471f517bc057aa67e33b571348a3af8df325c441f8b6df2e096864ae4f6104f444b73ab9700ffa7f4b9e3a3118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1484ff02fe1f03777b65753920d79df5

SHA1
168c0cfed522cb90712a7242bca02fa973a71480

SHA256
4c7e406298a61bf5cef412b81c719b13b74582671980a98c3b33f87c92fd93ac

SHA512
b2bab6f3886d817fc7cb210253565520053f27ff2948d08d00097f972780b5264b99dc824fbdd7c8fdabb35b182caa8b6905e6d1e59fedeb992a1a1a35af6ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b7592fb0c147b79f0c683eef2a9058

SHA1
0f31176dd6393a7243158ecb35c15a615ffee8b4

SHA256
5c9b4808e4c00d5a9a07691865b66d3ce13ef591c30c3f6547e88d11f7299ece

SHA512
22f1940c701ea894d62e53768a27e5c5cb4a202ea6ea38b19110a44a2f24ff87afa1a18e8fd98556e526c418294e1f030ac1f81160a63d1b7e7d1a608c462622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fff5b709c8f892dcdd0d73071b8ad70a

SHA1
d2c844b05ee875119c2c539be231e1ddf5be8638

SHA256
4bf0fd110e8bec8045e658cf9dcb583e9dc0dd12dec183f34404b73dd8fc9070

SHA512
b7040efbb9382b577a13709ef5f5bc991d96fb1d3a935f8f295120391bfc273354f4c809b4db640cab80a951f04e64b20ceedadc72dbccd0c89d8c67ea6a6e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD0F6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF1D4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit