78dcf04e72768d0f873d16b77074d737c37aba9b1d276a61bebd3928dd47f4de

Analysis

max time kernel
133s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bc0e5d36e6e127c5224edc9ba53aa53.html
Size

2KB
MD5

6bc0e5d36e6e127c5224edc9ba53aa53
SHA1

350a3fd5a23d093e7ceba299c46098b4f81eb334
SHA256

78dcf04e72768d0f873d16b77074d737c37aba9b1d276a61bebd3928dd47f4de
SHA512

ae93bb4a431067e8c54a11565d4359ace5180b679fa81f76e57783677597d5c5388e211e609b55f0b70546c657ed37ead5002694174c691f8c603d3b60646e14

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600172f19b40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d3fb1dcbbf72294644447fc444a0fb6eef782d011f2203c31e8fd70cd89f96d4000000000e8000000002000020000000a6a33ca9f909df5404750bd350fe77ef36ef548f81e94719286589e6f64931dc200000003e0333ac02dec4d8b92a0536488ec9cb91c27e579bb2e0350f34f20e85a0bbb440000000b4cca0b685087df7ecc9fd560b56454ea164ff8f3c76bbfb2d9401ba9a66e484f3776ad8f933d742bdce16b33a9ff8988d9107166318388ea5f74b6742afce4b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000da72dd80fed38ec544a02085b6e5b96e781117b438323595caee371ea38159e4000000000e800000000200002000000088f17ce0182832ab16ca42779a46c1acae37ac51a29fd54d6f41559888af9c3e900000007abbae3ec8271c2fa0625957b777d1aff25c52ee2f98f9f6d63d556eb591158b6ac33e889662ad8f34484a3dc8931de0ffb8842350115077e9da8d4d78d76b2d7a2387cd608c2efa3abaf0bb8d35bf9334d8382aba069e78a57472f3dddd3ef6a156b417c7f68d79d7c86e7bf69eeb144b379bf89d5b0d1f63c3f8dcdc31f7ea9b1a42ceaf3514778c33366bad6abba54000000074137357b838e90038e85193a3e85dbf6a96bdc1eb1aa7283e61c8bdb1ad9713d413b9c88d37e4d2e998ce2c38e2b7e01dad72c0b8cc6101a3a1d2aa96507517	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D123791-AC8F-11EE-AF58-6A1079A24C90} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410705988"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2304	iexplore.exe
2304	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2364	2304	iexplore.exe	17
PID 2304 wrote to memory of 2364	2304	iexplore.exe	17
PID 2304 wrote to memory of 2364	2304	iexplore.exe	17
PID 2304 wrote to memory of 2364	2304	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bc0e5d36e6e127c5224edc9ba53aa53.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
267b663131bbb066caaaba18ac5e0008

SHA1
23e832e1fda2542ec847916120f558159a44b622

SHA256
827a09034cb889004d9c63d8c4bbf27803d356bbf4450a9369b42fba93a94eb0

SHA512
31bee28fc63ba995a7b18fe6e2ef26dfd14b396a08bf020d754e4e2608c6291455c51c4e9baa515894ae9c53f77eaaf35fc775e6ff62588aa13534db3c4a6ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc4d3e3be36906938f06744326b97b0

SHA1
476b6bf1388ebd57c1a9328a9db715d840e3e23c

SHA256
b8527ec1c3082bc125dc368b64d890a5f3337dd5ddb50b5d600c513b29b4681c

SHA512
0e2b3ecb70481c366254ea8ecb58075b2c0603c2a98479a0f3ebc40f47a6d7c9c933339cd0085c80f8bd3c0616d27af43f2a1267c23bbc86ae07f4fbf11f7449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71ccde93883ca9818ded13650ca21395

SHA1
0af252d617b390c948bdc6614efa6064092f5949

SHA256
86976073aba471c471ade65e5faf83b6385ad881385fdf62c97c9c636dc8046a

SHA512
6702392f509debea2bc950a604784b4611a0851d60ee46787360eaa0d7cf0d46d9f837bf9116d30448b411d0718c95eea0c9b6fd993c10779f3aaf9e9bb37664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aa0ff60eeaf112536e15368ab9d43bd

SHA1
1cd19d5a66f13a7b42078da0f593aa62c6cbb965

SHA256
ba7886e32e3777946688d4db63f0947d5803ff56b2b5b4bf16fda476d979bd56

SHA512
e16a0edf913eb749e8bc6c20a87c15cdb24d8286bcd126a46f6fd74696838e8f570f5db64956f65707e35d57fa7330befe57ecbef4167cdfb4925dc945182bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41bdfcfb68fd0e52340c7f7eb2e01d33

SHA1
56516b19f34ae2cf5e0ff592378d94dcfc3f568d

SHA256
0186b7670d690e184b23b1f14eec9f5e388dd8499fe841d1e7e16d8fba209245

SHA512
c45ce43fb618c96139684109a807b64578b2d642d46172a7738f6cad65fc91b2f7b926cfa67c9732b015dec940ac569c0d3c3fb30fc1154dce57ed7dba80c12e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8141afcd89d9215d6ea3c72a069f07d0

SHA1
039cbf8a59cebf9f46ddf6a89e74caa2e5b87a40

SHA256
00c58db2f58839d59469a7b602317de6c54cd60f2aa604c7ab851418cb7c39a6

SHA512
270448d4def209dcdfe9cc7119f59bed3c3be5b7c218847924acf48104cb9daa943854d326333b6ecf0c40b28afc3b4e270be6290bc05fef00a9d95f7fced769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e58eca51377df315c4c481f3f36605f9

SHA1
50796eb7f334569630a9d9a1a4b4e6dde479bf72

SHA256
d77a9e035760fff0b2eefd058b6cafd5275366d3e7ec664d9fde077a9d7603f3

SHA512
2ebc68891aa3c8b2ca3991b84e0d505c960d7896915bf99048ed4c0e7b0c51054c8ab3786fa3ec413e46c7ad63ad095e7f77feda3b4b1a2c0a6f7c4df2ffde73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4727917b08ebd8d0b49f666dee7d9e8

SHA1
eb2897318ddf79b94cb8436b9de8fe84afaa0468

SHA256
f533a07a801d93661311fa0247957876c6f8db3a61dd7d9814f540f9bef7795b

SHA512
81c070cb41dae4c8cc43ef63049b73fbb20c73b7345ed35450ff8b392101894116d542fb556d7bd589ac7996f4cac633f21887faad0df5b7137f0555241dc30a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b528ec5415d96218a0f9ddb910aeb861

SHA1
8b2a8238b41a88782b372654cd0200793be5f799

SHA256
60d1b8c73ec8164d8b5a9da63b4f6cb8dbfbc748bb0c22075f34ed849a01d446

SHA512
69340d17dbc9020c564d9280563521926e470592155f8579a78a25003163abd79ba520408fe65c43456e64b50ebeae25c17ce8a1fa8add5eabf6c64af0468601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47078f04c685375c4f0f69783a11f639

SHA1
d97fde87ce439793e059d6e252188847d6b70f45

SHA256
2ea25cf7f0d4d743e7f493252211d39101e645d545dce9f5a0f3ae0b22d1ebeb

SHA512
69eb02bc873853ee72e7310453d23067200288fcc1673cd0ce90a744defb969a9c3a85322d9ea9d4f568b553eeb73cfcf039df27f18039672a23c5f0633fbc27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6c027a7881598d544d370e92f18865f

SHA1
50193810594c6c1eb7ab9e3400268b8fdb6cedc8

SHA256
30eee26e4f7323df5eb1652f15b5e23b8c5b68cd867b6c67598f1b9cd74477bb

SHA512
50102a035f027b466f9e63dd06e1911db05e97f372c09cf56cf210367ce3b1ea7fcee68e171955853eaa01202db9fcb2f48292751bff6e8ea1d4c9a071a782ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1ECA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F69.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit