e0cfe4045ee9d086ab9bdb365ce47b95e7ceb41cdd9403437b577451f3c616ad

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b9685e7b4d9fce3a22f63cf5585a4af.html
Size

99KB
MD5

6b9685e7b4d9fce3a22f63cf5585a4af
SHA1

a2fddc0e970d2423cbad452c7c93890e96047cf1
SHA256

e0cfe4045ee9d086ab9bdb365ce47b95e7ceb41cdd9403437b577451f3c616ad
SHA512

46577736c653facf7d5a62e677c46e2bc8f322353aac5fc8e0fd4486180a5d643c2e48a85e2586124faaf1758f044b5ab3552959640743adede00b3f84cd770b
SSDEEP

1536:eIPTjpkiiTCtbjceKcQZVRwt0bRSAt6WXQWOy+FYj+TxVe65G5:ecpPiTCbQZVmt0n/XQW1ZjGNG5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410705648"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f0802b9b40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a7c8f4a99361f1423d255dec1a3401687d4e8bb0fd2e854399c59c789aa76c32000000000e8000000002000020000000416adb29e358ec0eeb2147925f8a8b352e470f4c603e6a20d9929b55a56b2fc990000000ef8d693ff23a1c06d00fb62bbbb4d3f1bf439ba249d6fa872990d813b43a53d2e3a28a1b4d59821a1e48de5d946c563aff5319925ed7da3d045831edcd8ec5010c164d2152e132be3edea541b3426d4d027085a60494e29ac814d0c55cc00337b518b1bb967a7f1b06ec7813bf2273201d750a8830e069b9ecd0d099990335e1c530e048f1321b038600515f8af5e7bd40000000f5e0de1377aa7f65331f4af09995fbcdf83b52e94b64e30a5bdab3647282b42be54748fe29e8b704ef79d599a9e1da17310ce41a76268e4d771cbcca7efa90cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000002022cf7a6b6f33d200dd8b65fac7f5a3395f46e05e6f7c3d0a137e6f89f21f1000000000e800000000200002000000089778f0b1e70ff9f3f81a6eb485c2b8c4a815af2fd07df153bb3fbdb98a7fc4420000000821fdd0f39ec63124118e127f662d5a26e23b263a46fc7e4b13a256c0c7a777f4000000005b992c099c028dad3b8c54574bb1e15b5f0588bf1cfb3029e67ca985f933bab32a0bc4601d82b41521c93581ebb23566ed1203358457ab67577f2cdf32d4778	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50D09321-AC8E-11EE-8723-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2736	2976	iexplore.exe	28
PID 2976 wrote to memory of 2736	2976	iexplore.exe	28
PID 2976 wrote to memory of 2736	2976	iexplore.exe	28
PID 2976 wrote to memory of 2736	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b9685e7b4d9fce3a22f63cf5585a4af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dff8906a956d676b79b80172fa5876a

SHA1
f739f8116de0e74c99364e28cdad5b9ea9159581

SHA256
3d72c3a5037f13f3bc65a4bab32a13d366acdb4c385ecb95fdcf6fed97e6b567

SHA512
b744c4ec6ed36943c84aa4c5995fb883850113b8c6a6feb1c412aee917b78cab79a0b90864673b99b36adf7347f9f508b34076bcf1b7dbf520376f0d30564729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74688c982215f996f8c3b8d9c55010ea

SHA1
b2255af9c30e0b7a81bad82e5ae7ba71966d4b45

SHA256
04dfa33cc924f38bef1c5b050cd432e13e3336381d7c0bd4bd24792e8fcf5f87

SHA512
eb50f8625f9abff3a0a0f175f0426dee795009b11232a955d4afbf7d758c869e509493c0a2e2d2a3745af7d93fe5bf166da89b44d299095dcaf8f3ee4a7d5ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc6793c5a784ea583bec1aef5f4ef936

SHA1
b900b54e20c271a152ca5f0ac7d03ef6aaeaefc3

SHA256
ea0c406e098a1ae126257d24c8ad9b798104d67f0d02c87ee780bd1a9bcb4ee6

SHA512
c157a20aec6d1e9d0f0eaf84be96c880cde319fd9a33a9190a1378fec8f9b7be4ae46565d5b9e2f7ee5a570a1f36e7a59ec253d6386922bc82d057647df2cb79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
969832c02397af63bcf27bf689405f78

SHA1
4225274e5d3b50007e6f20abf1c704989ed6f451

SHA256
e89dff1cc1bf0fdb309154cf071195b4e8bea56d7e05263ab4bb5bfb03112247

SHA512
12da06204fda4a923e55787176b592dd47bd769ca2e00016efc845951b59fa2a885f3d1e51fc38e0d97f8d5ed3988a0dc0d070eefdb5383f9e70818fdbc90be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d60546b3c731689bb766710e94bc96f

SHA1
42c3a625e839a1a461260a9978f324f1e9cfbafe

SHA256
4f9ed7ee8264740771dcfcf73d26902de9b3ffcdb27013b0dac3383f1f5b4f7a

SHA512
e9c6707622fa0baf313e0e3bbea839915be07057697eda84f1fd7b45d9a7bcaa5ca8b34213f9a18914fbe22a5c58985c79bc7b38acb50f2a49c05079463a702f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2523314185fd921e9717fbb4e8e1c9cf

SHA1
09d39dfc2bb5399fd0233fa5ed1371bf9fc98613

SHA256
313f0d00aecc3d1c2a552b7c89126f158ce5258985c310fff79de407561a7e5d

SHA512
3bdf83d228623120422b5b22a91503eaa4b6cd0a9c6489af3215662b209ea58b8e7db3a7c6a7acd2bafce0ed05c9f88b1c153b94543cf4a381223c01a2a0cda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018b76529f8df9a201fdf4f3e0e530cd

SHA1
9a4554c4bf5c6d5f8382b8df9ae79f4c986f96de

SHA256
e0647ba780ee1bf5c989c0ad58f8fa978e6b4de7ad14db856a780d49e51645f2

SHA512
e84260e95690db782b104a419d825f172c030e98c3e1d1e069d93419d4b335b3213792df38e9673386051f333b8759c1167a372a0eb29127ab0fa7c04bd8b5f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0339f9dfd695fe32c293979ad5d27525

SHA1
4cd5a5b3b2e83fd41029a73bdd495a261a505dc8

SHA256
dee9784b0b8497c5d87b3952bde36ac82a96642d77f1ee2afad8b4879b06edd5

SHA512
119a580e856cee20bb43840e60b419da5372d3ee4e7bea37b5e60ffa0298569bd43815dfda23948f597c1ceba6c131bf1f09a13f48997b2eddab58621e8427ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b66863ac325abf7ec184921a17eb4d9

SHA1
36610fceaa224fd6e01d10898237642104e47b94

SHA256
2f6509d7f65c19dd1a840db33c43081b38b9390b78b0847f6416c9f2333da4a6

SHA512
9d2f00d3e0b40819eb6bffe03db21ba29c988fff8b00f5c53adfa167e47c9fb0afd8449edfa01df70e8d8ddbc709af40c7bf1a975766cb0062d43c4fd78d4d75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6475f8e8129733a08653d6d54119efb

SHA1
5fbce2a261803c3a7032155b66393dbe7a873b97

SHA256
8ab75afc9cd0150e04602c49e2b96f91c99d2ccb87316682d4a6b1c354b7a422

SHA512
03a132b8982010601d70464f497eac3bddc6b4052b39b0ead0d158a29a4b42e4943b41cf555448c65f8eef966207157d4bb79be8ea94164a3297d298d4fbbf66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584a46922d8ca6fd409ea602789e80b6

SHA1
0d78bb3a66d68b32b96f46d5939128729c3900ca

SHA256
00f13a403cc9adbdf49aff0dc7a29da658546919bd1122e3e6b16e8e16d47e27

SHA512
90651b8de3bba6dc5fcde70c29c304561b24066f3d449939781fb09ab1727a2c7bea12e962e181f7c7d167890ede77d27c6f7700736fbcb963c13a3b3e9a3458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E37.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8136.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit