dd5ec7e12f89faae6f38d14123f1d9e3d02dc1a324394685ab36e66ac38d40ed

Analysis

max time kernel
151s
max time network
186s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b4d3347ebe04449493a978c5e1e677e.html
Size

58KB
MD5

6b4d3347ebe04449493a978c5e1e677e
SHA1

5c6715fd2c42a88382616c7ec4bbced895aa1988
SHA256

dd5ec7e12f89faae6f38d14123f1d9e3d02dc1a324394685ab36e66ac38d40ed
SHA512

52fa5ac2c074da7e4f97726f8d171151c0a9aa5313d353f9217f062f6de3611e13cce5f4491fc2b371d49893cf521b5b5b36c93fcc0af26c01bd80ba003d4755
SSDEEP

1536:gQZBCCOd50IxCwfVsfufQf8fJfXfBfTfif8fTfFfYfRfAfSfif9fQfffcfufUzf7:gk2P0IxsGoEBfZba07NAJY66l4nEmszD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f378245477d6a861a6546fb829c067dc9fb8cb5b60073f47c8867ea08039e3cd000000000e8000000002000020000000a28f1d31a29de542d9e1f54ca55d71f33d3d63da9a454cfd62b0d6269772a8df900000004b5f0d950e1069f80cdcf89af1e1b314c8badd03acca9de1a9fb54c09a226579f3c97964346c1053117e598b66d68e6e21fbf18fce8f7a930ce46ff8b8f3b41267428e2e055431961b72db3e256bb05c31a51315537e501e5a81d427123b14e595651a1d5ec81b6a255266a817db56159665ddcf241d031f7f7b4939f799bd8d1b58cf8ef551fcda8c1246c57c1dd18c40000000e76743c3aaa9debdb46301c62221fb0e4dd9c1ff92634eba16b8d5882d5574d78ea819bb9ecdec92deeb5651711095fa4eaa804a7b2f1d6ec5f1c03ea514307e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000006ec1608343617d7b544afe851cdddfcb6dd8c4011a436e9da69982b4ac31a84a000000000e800000000200002000000094330c7cc7f75b5060e9ba327b64e170efa380f8b73dac4a929f4903a700142520000000c7eb6b5475ee93aec22b1e0f4bb1c5374c3b997545943e1cb274c7d07760953340000000b60c3e470bf5397897c6397f8da92886ab72dde874f0affe7e7742cb85b563eccd1356db8899f1d70528579a9d822b42f96e1a87a5dcadfcd0c6bb2ee48c5fa3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E7644E1-AC8D-11EE-A20D-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5040874a9a40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410705214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2896	2828	iexplore.exe	28
PID 2828 wrote to memory of 2896	2828	iexplore.exe	28
PID 2828 wrote to memory of 2896	2828	iexplore.exe	28
PID 2828 wrote to memory of 2896	2828	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b4d3347ebe04449493a978c5e1e677e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee86cee55e7577484326402cdeb28ff9

SHA1
92d9e992c1ebe5a34ca1dc3dbcc63a9f2c0aece0

SHA256
b368a16db616a153e928542d50bfe6b6dda3d11c05d849c07a8fca6a0be92b9f

SHA512
fa41f48115af957657796de7b25590211acf0d3d71b81cf1d71bfb86b404005d127bb6bfe1611b3c44b059b6e1aee361cf371199ed43989f6a34621a0fe62485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6459c6c03bb684669c8c705b186bce40

SHA1
bd1d0b4c9302f663d35bef87e49cfd3a09377bda

SHA256
c284f0887231b6832a2df9df0b5c5af301e9c94395b394698d70715d9c407238

SHA512
074fbc475817ace8731990267791f21f8695aa0221a565381bede987ceea995c7946f54187adaaaea7a70e6c15cc23a39b47dd2c939473562911e2898310405a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddd1363aef367981dbd4a40bec131b14

SHA1
21b68f676403bec667328dafb9f8e62c0daf39f1

SHA256
8fcbc4f7200e21dd80d21a4f7d47ba381e2e6f39793b9833cbba630e040d986c

SHA512
2d02b19d0b5dadbfe4bae7ab35412db6aba98d628befccebc1e02b5b31cadf7da4fdbc7cbfd3477d5c5be985391b3a649121fd56e536053b9bfbec6b464e9003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cb526167cb0de309f449ecf0bb819ce

SHA1
87c8dc9f83e2a08ce59f569dbf6d642f1fa2afa0

SHA256
f0845a4c5eb4999f8daf3ec6e5d23e1380f0396a59fe3cf0f980a75151c055e9

SHA512
6e44ae7689ab80cd0985eccbe54c5e5c066f479160e3435b2683d075a89d33f0f02df7a502392f7de0509446c3bafe71d71bfc4f6ca5df5eeef4dd24822a5824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e745b2be37f2801a936a4e5d7f0ec51

SHA1
b3f70db497bbe93d836fe0c8872198ae2a59b7f2

SHA256
1c5d7dac57b7db64e5549c2323f0e68ea3182ecdab888ef47426cd08deb4171c

SHA512
9088fbd6864520b82deba618950191408292bfba70b09bd9352bb33695cd4c56df7030875cc18e901aa261645b461aeb56500a42d220bf221ccb38cbc3fd50e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f1f3199e81c9450f5795fce9eed1cd4

SHA1
e7b6fc6f80e02ab90de4e906b14a446b3df0e0a5

SHA256
63962c52093ab0116f23a5b84acba6ae1d42c7652c5b613532359a017af05fe4

SHA512
6aa05a09010d84e8abf67a18d52a00a307c5221fbf24c6613c98f85fd304441a4921ba84fb57a3803556967cc358bdfb75fef8df85652af1149b4c37b7f863d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c727c21dd903746d279d801a21f523

SHA1
0bab2195817ac935f7829a787e8ea54044eb5876

SHA256
81a4fe50c7ee559ae7c3fe71322151c66cdc132a59657eae5cdad30c0b942ffb

SHA512
f18f4982d28aae5cc72f4728c99a15248f8a3da485496106c5cb618378e2c20e07605803eba0b08ea80657548f93aebed4c0bb5e7beb9c611671ebab159f6721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9327163ad94f2fe3333d1f0de9062171

SHA1
aa1dae8ec7b49bd1bd095575db4762fe4faa9d5e

SHA256
798c27b2cefcad60313060bc5a164f6dc342f452a247262c8cec6dcdab1f72f3

SHA512
86cfebe84268fa51c81d8dfbb6f3a0c97cc5ce8346c68ba47a431d3257b3cf1594022c3835322538eccb6a81cbe9d6c270a53dab39ea6cf807e945318bec243d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd7d48b4a1cda2c38b31aa862aecd9f6

SHA1
172d38d6bed8a6d80fef1fd4be3172603fd57fbb

SHA256
a7db9a6cdb3f822f87ef4673e6d59d169b8a56ee3eaf82f957a05439070c3c6c

SHA512
8763be0a4313c7216276914dc5398e72774e9b033df4cef3f7de782faf1d816943fbe803c4a57b4b9bc7efcb0a8d363dceda6ea1a41cd860bb9efe1227e7466e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8b3c05762a8175e330206b95c222ff2

SHA1
1e6b8a955f56efdff99453a31fba6a4e25805701

SHA256
166029977a27c61d8d9338afe5fc67f677e4f7eb5ca68caa9caf5c47c2354363

SHA512
0d0181e689906aa205617cf616799408a8706e93a422d375d2329d8fbb4bdb902a031f19fb2222539eb7805b14e134b09f369865fe9c8bd19cb052a48ac27699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f533ecf6d86f23f845ef0fb2280592ac

SHA1
ce1e0f43a183c41546cad06c4fe64c7dee6d15cc

SHA256
740b923b82f92490528e52503917a0f01fc52f93fe1145a91ecb5b3c225f1fd6

SHA512
99e539df6c19bb743cfc6f46d74b4ac4df0052fc0394d09c6cb603ec37f4b68df81dd8158c561b6bf7fec3813f917a74d671183ba8264015da99a7cfad1c1630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
030dba69cf20ab7d9f3bf1b94535ec57

SHA1
536b22ae7cc8c7e2c1dc9172a9d4a6c58802f143

SHA256
70d699ea7d7e904327d945564ff5849f85bf988235a1d3f79122d70aee60f18f

SHA512
bcbb2b23271db25740ee362b2cc289413a1438f77e57eb1b38bea37c8b5e8729f8baa3f1c8b3084b2b7c2e371ef7bee60a593d4aba744f637248619ee373a415

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA508.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA53A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit