e5dc40fb7d7dfbae36e03aa9607451ee9fa7e77ea0862e484a007bc106401dcc

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b525519a1f269506b8f83d08518142c.html
Size

6KB
MD5

6b525519a1f269506b8f83d08518142c
SHA1

70abb32828ae214420a7e8ad722223d131c18bf2
SHA256

e5dc40fb7d7dfbae36e03aa9607451ee9fa7e77ea0862e484a007bc106401dcc
SHA512

94584834c7334701178a12833068f2b0aa78729a1f1eddb46a0e38e8bd4aaa6563762b186c905906d66beb81b0aa475e8b7c04867480411929c79dd4571279d0
SSDEEP

96:uzVs+ux7SjLLY1k9o84d12ef7CSTUrg7cEZ7ru7f:csz7SjAYS/V7b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38B49121-AC8D-11EE-AD08-DED0D00124D2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000334cd4f59ba714786f152d0f889b71f6e5cc7e64e3fa4a231f41ceb61a7b859f000000000e80000000020000200000000389e1c7a1761eccb28d9cca869d84716dea41e67e43dff4ba57630c75f29c149000000040f3370d31499f5ebf1103e3d75c7ddc5d81071db2220254c26fdfed8b6f135a43bb327d8793319aa4ee9ff75ddbcb27bb5b96b6a42c02648133552de2eacad20a03e666a1180e63f76c6c5bdbe0629b6301dad848479bfa7de6806b23e8a09e3c7297819d9b60b143b2caf28c4114c76971a114373c69369eea9c8add85842685d9e47c50a35266fc8503bdf919592a400000001e9d622c0e345e6b0194c15cd4e0619b9209fbc6160d81e9db28ab122b0f574d16227846ad022330d825bbdfab9e9a2959e03dca0961a584703f7e7a99f5c91a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410705180"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000001c8d560301fb6b8eb45f757bb0f310c5fee5e7222d453716309d202b44bac5c000000000e8000000002000020000000e699bf9adddbc04014089fc75dfc5a1e1e2bf5ad2a294bf7217f85b1ff00d4f02000000049c91455d08596b0ab4572fb85af367ba05972186491a55967e5e3e9e5422ff640000000bbc728584ee883bed9750c2b06c2e013920dd43ca7a654ab1ff0c9fa8eff23c2e2017977ac3225d6170d63d873910d622ebf78237e8f205d0e8551c6461f489b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f080ae159a40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1588	iexplore.exe
1588	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2692	1588	iexplore.exe	28
PID 1588 wrote to memory of 2692	1588	iexplore.exe	28
PID 1588 wrote to memory of 2692	1588	iexplore.exe	28
PID 1588 wrote to memory of 2692	1588	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b525519a1f269506b8f83d08518142c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ed175d4f538e52f0a7a3cfcae5f48c

SHA1
c92cf2f7884cc048e0da7cae969a794d1d211dd6

SHA256
41b0311133bf6ad742740e8136b0a2deada7c1420e0cf80b49ab2d80562fc882

SHA512
d3ab798a5c517fa1cec0518a176c1e9b6fe73bcf6851abd9ea4e65f569188ee0cb122cc8db652668c4fbbb7a12ebb4d8e56227a14f4776d5aa11d4f1cfbad0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb352a2a4802bed1043a56dfe2758b78

SHA1
0b3b99366eabda5c04466021ddda8e10128bd028

SHA256
293919aa2c4acefa4151ab4ab829ba9bc26a99e6284fca46cc97d71dc70b3c41

SHA512
c8ded016e8688c8c3d8408c114d6f47eac088ff37085450efc2d669eebc79539ce1d797de02c50acdc96565e1340087dcd2d359fe7095665ab2e22702317d372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bdc4a106e6ab017f5b51779e2dda563

SHA1
6cb0d60891bc5e07c6324ac752b253cf573c0c1b

SHA256
9009fe821a1521521d7008369e14cfc743488b506b1acf6047b3977946de5585

SHA512
ffb4aff8cd4111ca9bdac0f9c460a4167165f909b1fa016cb28793baff363780f2f065e80c7c5ac8ad8b73f2f79810a62a323bf086f74a7bfbdb151285580b70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872be3c8fab15815f71e004731814869

SHA1
39e7f4ea1cfd2826db4108f482e2b1eb81e4b444

SHA256
b16033086ca64602bad3f2527d85dd939773ac5c51906103087847678b60baff

SHA512
c5d367e1bf3eb975729086d5a90f274c0258f756636592b602e20361eaf59feb460892beff9db2f926a8d2395e6efcc8d7ed384883ec949f90ba66c24d9d7980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3709d713d498a338dfb8aa0c8fa0ec

SHA1
bdb1aac01f2cf39037715f90a9669bd0ab160ff4

SHA256
3af75f578d9cc55ad61ac5d6eca84292ccde969b9de17439bbafa9bf09ce0203

SHA512
0e60c30fe73905cb963446898ca6227e093d9a7ddb0594a9a48c10caf34c83185fb503e1b540074d5389e0fbfc62cd245a7740dc9455cbf1b7ab3146c5c047a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03646b814f8c383b0c3576433cf52833

SHA1
5d394ef28654c6a9492465d075a6ac41cdf4dd28

SHA256
891eedfe0adb79a4db7ae0e59fb08eab69b5b32a531668ef6a2237d2d893511b

SHA512
3f73db8cd013ea17f21135c8e2e8b3febe8961d74e7f7a3ac376df4976370449cb21fc8a24361da07a34ef5de63c877c9b56cd848a9c2eb748b66b19ee01a0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfdb35ee866a794c9ea3ddc574ad4cdf

SHA1
327a60fd15f811bffa95928cab0d5daed3f4f9d5

SHA256
c663e070b46d8b5b4d0d31f69d85091eba7941631e4b1bafe4ae066a7b2e3110

SHA512
53359eb172e2484d2295f1cf8ed38fcd7aad031952dbe1fc7d082c8ed1895e99f7a6736108026d919bebfb6a6c8f02712e4a3017ec98700497087143082b3284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa0ae692c423ee4acd72f3d1bc43677b

SHA1
88b8610eba55808ec4984eb80d79bf8a1c7c3cb7

SHA256
1751d0242190dfa741fb9a2d24aa5b78e146bf33ec103927ef4a0ab7992befce

SHA512
8199c2a44ebfc1bf47051856ff67a6485cea8f7aab34955b9e858ab418db45b2c02fbe5659980542c85972c7339c169ca8e4de2d56abba89d9be18c9fdf9fe7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b983a0196ea221fac5a87fb752368218

SHA1
0a559fc0eb9138c48e62dae1b80c649f25e4629c

SHA256
18424b7d3d692b5d9e10542a362218d338dc6b6cbd977406ed5fd744c52218d8

SHA512
13cc683b37ece8e7c6e94fbbf92ee0b1a43b0857f6eb1ceb0c57ea56f9b0ad77bbc5afe98f3dee23c1a628dffe3912ef11de26a358079b4699df2306506c5fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26ecac3b15c007d8ad3aaf81891a8a90

SHA1
72d53ce2b74fe7975cdb23253b820568beeee254

SHA256
b27ae5f719ad1aa86213fdbd51a6d594da45b1abf4f467a7b5b758967e36d843

SHA512
abd4b1fd4d2f07bb3a50614c3b5d0acac96a45658b69ee1bb72c33dc8c41979c5278fb478a2aaa2e1a1a7fef4791086bc35319c805a62fc8fdf6ba81cf32125d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2edd08b7867b514740b7f378c741d06

SHA1
0034613373b093eb3a48c7a72db11069f1bb3651

SHA256
708a7f8f5f7608c0972fc21a90bb15f2e6ec82d503c4bbcaf403a420cc177cbc

SHA512
5b97a7f2db40f94a3f720d27486e9c305463139a416c65fe377f0d412d347ac9e5d40838a614a3069328d315aded2062a80c4c30c973700d0e776195d21b002e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC89D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC98C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit