dca957aba6520821eae65e00776eaca827b08acb77778265a8378143b9d69786

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bc086f74b2c9267558f4a1e9b8d3654.html
Size

43KB
MD5

6bc086f74b2c9267558f4a1e9b8d3654
SHA1

41ef90cf9bf129dabbff392ec9b4e677c503bb3a
SHA256

dca957aba6520821eae65e00776eaca827b08acb77778265a8378143b9d69786
SHA512

751ccf694816c77e5c61e243db386dbea9a8299f747e860b0dcec7ef7b50fe0624efe904acde5e7c99c5bc1ab8a89c0795f2418196d4e3e8b2777b6cff133b6e
SSDEEP

768:nxES96wV9Eh6Njj8kxKufkoLg3iVvaVONMmLEEDjsWLRw33CqVwQGS3rQ3f4odOl:wU90MDxKufkoLg3iVvaVoMmLEEDjsWL4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000fbfb4494fc88cdb46350b7a92577196d5db88ef41b802f99db8553067f2cc111000000000e8000000002000020000000180d9892138a42ae5f8ef6321b99e426f6391f3dc47070e089eeebd6252d452a20000000b059e46e5539d2513876db555a643df8ed01a8e81a42890a9e4522b818d665f04000000059f593db98e80538e7dfd41cfa11fd8a74d73e30195dc0dee6e7c2a2e45045011be21a9fb239bbdb9d2bfd6c5231eb6882ec9998b59dbf69e4be7fafe8d29917	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50430f300439da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4803F3C1-A4F7-11EE-AF44-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409871121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000028d17547e78cfb8b0b86e53236f1b1b0f57dcd708941250b6b5fc68df4c68304000000000e8000000002000020000000378305116ddd61941b96463375a09788af958483df89db2e90b75eda32380b4a90000000c7c64be26c7f81a0282dabaccb2daa2ca233394109ae1864ebc7f9347cf4f24db63d8be3e8becb17926040cb4f11245c4836dc97ed70bcd1d419d931ddfdc0c0253f75c82eb2c5ebe8cad2a1f9cdfd60dca995eeb3c2dc893201b8455d0a4e0d2637e7874817b6cc25ffa846e4b5324471c1c8ebe16344662f7fe61e6f7ecc76ba2b7e534162adbe52ae5587bf3ce94740000000673bcb6e91066c9c09f12f9795e80efc444558d6387e6317bda1389f293e4f81f29a6ae3d15e4fe87cdf0cf9b546dede70dc9dafe22cb32f075eb7266d59842d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2284	2220	iexplore.exe	16
PID 2220 wrote to memory of 2284	2220	iexplore.exe	16
PID 2220 wrote to memory of 2284	2220	iexplore.exe	16
PID 2220 wrote to memory of 2284	2220	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bc086f74b2c9267558f4a1e9b8d3654.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b51133408184d4df6ce54ee21d197a

SHA1
89a9d17c08af814d8a4bc93a4f47a91362c59995

SHA256
5807ebe8ee3d3c33c8a1d862e60c5c694cc9ed03b252e3443a264f364b9024b9

SHA512
ae43398e4a4b96ebb60df9c4f03a6fe04b04441fed4ddf437e7dc6d2aa8cd2aa8886a3d9ddc8433b3278ee42199fd7b16a9104ece4830bb652d4a0eb73df2e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3baea92d3aebc838bff0c539a731021c

SHA1
e1413970dd88d4b007e7b8616e73fb755ee7ea5a

SHA256
dd482c4b8cefab7749f320e612e57e5e31f37e804cc0cf41b3d0025a72ca6ef9

SHA512
1956b37a4df5728097f92c899658d41b6590286624a1bc471f5bd3018ca2b9682e89ed9f12822879e2203dc2043ba294c7ab52fad0bef706c29bcf0c2483f038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24660bd58e2270a544b4031d056df8f7

SHA1
d6487d1b3a30f0ea1b9b190c9dd6565a95e04ccf

SHA256
6521b1160beabb1ddabd3808468849e00b2c503681e1b2fdddd1d82964b44110

SHA512
1f8f63c248c102908a299bdb7d7b897834a19263946f72352ffa4e6c43af229e3d2c5e9f4a535aaf7d8b39912a49967ef2cb1568ee6753ffc5ae08b85fbe4a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc293453b620575514a79b4ec741ad0

SHA1
8c91ad5ca819713e66d69eaed69cc9f272709c18

SHA256
1585a93c04f3b6aac7fff5894b3705479ed50bb1529181faa83b0658178f8780

SHA512
cf5344847c870dcbbdefdbc1a83ad3228a6534119403fa13dd5196835924a8c1eecbaa3aa76f54eb09743c3d9d58cde729d9125c71cec68889c9648868ee6ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85354f6003fba14b6e276f191d0f4881

SHA1
b749aec6cb13d80a78026473cbd93dfa0569abf0

SHA256
f4326f31eca7f2fa72fdd6ea5b7238a1d53fdb03d6a907a6e97a03ce50cc68db

SHA512
774309bc8ba7bb51d376cd597e263d5b87344d0a51881eb9d33ba15307db5d4c659fdbec503f23908fbcc23e0b4d262cf6503ce6071c9304af005430650c0821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2df81504ed430766431336cb551f231d

SHA1
53251c65500b96a8ddc6198d2025d45f612238b3

SHA256
475037d91565bae35a722ab366017b1be7d64e803dc8820556b8c7b053734d23

SHA512
18abcf2e469199b81b6605944f45e9f7b03191b1d3038d9c87885d5a5f17524ced48a49d58ed2e37d33bf8bc72739c169cbf67acf4e8f7e5f3b0d44042f45721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9ff35641fc2cb96ec938173f466054e

SHA1
3795dab3f5ebd055c5fa5cf2502537fefb38a991

SHA256
8f29bb9f83b50abceb2d32d02d1be8f79ddf41420d00b36fee8ad6988d2d3a88

SHA512
c8c02235ebe6c134a23ea7c8efaafdcba81d90374692cff0ff6202bc7b67ba8874bd62bdf4ab9d33b53afbd7f8d459c37f66a338a1474161ac5d9b3c06016b28

Download Submit