1583f9492e40e8437daad7660b8f3137d0aa14401980418e90236fabb4304eb6

Analysis

max time kernel
143s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d398823c97b179eec9d8b0829710377.html
Size

24KB
MD5

6d398823c97b179eec9d8b0829710377
SHA1

a5c8a937d1af1652420fb8684c9bcf00dcd9ed6a
SHA256

1583f9492e40e8437daad7660b8f3137d0aa14401980418e90236fabb4304eb6
SHA512

54a6fce887003b9ceb8be81511ac3c5c054bbaf829ff50fdece34dabdfd74998822d04dd4d0a695a2c457cc099c4f5ec239861b4e952cb82183af5704275bcca
SSDEEP

384:SImCsxHYF/sDn6iGpfQmHwuOCJVoTwozP37H:ST5pbOzuy7O8odjrH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0064e89d0a39da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409873912"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004b2da997c7088379720c5f93992a50a3ef7ea9ed453ffb4b4fae98b62438ca43000000000e80000000020000200000000cb9ad8ae25ca0bd68a70aa3ef7b25419007dbd3a8595b6d4754fde507b9069f200000003c0a3ce5b013f4bead41e2dfb2729911262c8142b2c7b571d70611b2e64d6cdc4000000019515fad56b8e2d2ec99c8e825abf16ca878f42562fe300ad2c2bcb2b135b9d485aa8ecb88555ce428fe756648ee710096e5d8ca389c7d8d0eded84dc7354e9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C627CB91-A4FD-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000027540b97d381e067b4ad4baec0aa57a822a66caa0840bd62e69ab102b06d7e6a000000000e800000000200002000000002564d2ade33b713837d44759726a6779cf3c7491b3b9d8ef2203bc6784deebe90000000cce4fcd259c51645f8dbbea45f36cd31cd7202079443aff165206aab65d7027f83726a1b97a89b61fa16e7fe99a6647436b5de3790fc692bde0c5fc5f392059e98755ed9ccb4e58a8616f03bbc638a62c50fd306b6cc75a714cc99e156d9f66034034b64e12f2f429f5cafdf38f5b595fa8387572086be1a6f8a609f2baeff0962b672ea2bbe80f7e82523d3f569c33f400000008593634ca53ef9eff00960277e6c961a3ddcf99658636167deed7d85f481cb396762bb97eb1e9b097d0dc39c0b701a8b889f3df9be2f513f8dd0bc19f2191d54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d398823c97b179eec9d8b0829710377.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48cad579849ef3fc2adb7ce35b25bb7c

SHA1
61a7a16cbe7165a52745c6ef0b8e7c227d262b28

SHA256
47339d9568e09300cd283a4a671aeb5a0884d4e83acbf8a311109e8dd918b6b9

SHA512
f0198093078da870d961d5999476733bd127a48e570bdcbb39b59b852f8d3a2ce86fc2b9da4f9fd5edac026e4883e75e3dbb0b9671ce5d3c77a5de087bb5ebd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0afb8b12e1b94f41823dc5ee90532abd

SHA1
d60e66b14df176963ef91028380d40f6ea746fdb

SHA256
be4d30a031114ff58e7d3f5c80e457b8a21c3fc360db0f5d9531e7e1a1f4b9c0

SHA512
f15fd90697ba09e0ea942f1f8cf7aa93cf067accc0527da6baa25bfb420d8d22565b011417eee84866dc9d7f713304696bffc671706a744478473225ff11ced6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37474cff385d3222d1b0c216f08c4084

SHA1
ca7e3a7024c9bd30fa80bfc077815fbc1d768d93

SHA256
ac60e0d2619f933468ba19787f5e50a201c655cc55290dbeea3ddeb6abfff961

SHA512
7b6862e68e39bcfccca61ab955f8a81635c133f1bde2d98ec6666300ce54e7be6cb1519fe77128854ec77bac30cac9d2c1cb415ced5940995425220187bb7ff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e1d6e9600239a75788e435fb4b6caad

SHA1
a9bc1b7fcff43f3f59c1a1de60eab91238fc9a67

SHA256
3985572dc5c38f2f7eda6ef086c2803d6564735fbc78aedaef883c63b0e7f809

SHA512
e61ed7a04353a4f9949f2bd1e50f858791f1f00e71e14227c7d3f8de2687505ec33c985abca4c95c65a8d07f012c9dbbafabdd2a35dc36fb8948950a6d2d8509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5dce2d5139e13618210da4ccfa77aac

SHA1
edd0b9ef87a1f7f164df94c87a839eba63b371d8

SHA256
f6e92ae0e0eed70498a68927661c49c9a66602f2a3f6da4d6cd618fe3a24fff1

SHA512
bbf1fe00275926d902153d32b09a05d97cb6127db974735f7f44fc9acf7f3e933f27d831fb9f28f9d0ef2ed5b9484ec6bcabeece2851f24e4d91c83f009339ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
959bb3f327a555c01bbba29dbc70d6db

SHA1
d9bfee5b63925d7bace9fff3fcbc880accec1cbf

SHA256
423ef8e10e0324e3b99ce0c4d30075b8d26e08fee1f24201482bdb47c5d26f4d

SHA512
48734da5a01c432912d7ca6f3dfe54d8091649745253b1dc737fc92e2064c354290c3d544bc339a48d05fa0f01a8cb847871be28497dcdfe499d7ab2d2d30d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
862c6da178abb02f21c28922022bc6b8

SHA1
ac5859c7cbfc6c3e32c63d41d37aa62d2abc0201

SHA256
1c557166e21fee6fafa753101bb41c9fc6f90e6db495ed1dc1d182f44885f1b2

SHA512
c15cc1813c146fea9f6e6807a8ad14e79c68a6fa9dc2f4d49e650e8cdffeb4202832116385fe16fb68ea9e34aedc1a044e58d42526785249b19f626dd3ddca87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aef777ddfc63a182e5ed515f4504f42

SHA1
26ac409f32a64f204645ddf022b68d7a78397d7e

SHA256
75a74853bbc8234ebca745fb1b39889e18da154bbb0eba721547b57e73579083

SHA512
cf2ee49239265ffd18ad786300cee5e70f1c9fdce334c0651339217ac2fe5d50c2a91d721dad538b0cb8088c414f65da8283b10145368df73704f9e6943797e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58c5076e739d0a832f875bbf9973f6fc

SHA1
2a76b8075f1eff1c65c945bfb4b214898885f13e

SHA256
e5fa2e4ac818e287a587b5f43c9c4c8328fc38d2751933af7a471adfed1196b3

SHA512
992e7980694a03d107c9e89c720555edeb445f3a77699e07a9e90bc25242aba40bf9a7cc9acc1fb379a83d1a55f187f92cc37f685cd0b658b23fcb16f122bd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bd1f193112575e7e190af272eda8ae5

SHA1
79c84434b68cf34146e5c24bdf862feea6f78667

SHA256
9ffe9c8c8d07e40dc9b330725af45aad6028d342a0f7db04bfe1e4aef791f389

SHA512
659f8885f10deb36fd1cf5d62345087d4cc6f10712c43640e0157c56d71253a06b9b319d8b8756f27cf76a756ae5650ee10248c20b2f467c56b4823e1df8efeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba22fa7facd67920416dc8e7ab212899

SHA1
a816af51dd2153ce0471c885681c9271bee55ec3

SHA256
99cfe98d04333e0a981cc26c96a6a0e9a91474dcbee341e7dd3baad14270a501

SHA512
e55dfba1268db609ff9080f2780cca97ba555e8061b3d4e4600399f74086ac2fb8688e961928819b8fb44deb1f44ac11ce16f88dba9636d254b9dafeba2bc3b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d935dba069fb7bfabf4f5513073b937

SHA1
fe7e106c988b8eed0c3c6c62a5c985eb5aaa4fab

SHA256
ad173afa6c6b552dc1a86378a374c11cfc025f3dd156aa515201839dff2247e6

SHA512
024672f5218a4006e26cb0cf2bc47842d562c129aab0377c385e814b3fdacdc774637414b9f2f112c0f6e9998fcac3815f5e59cf500f7f81900c63aad798353a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aa762433bbc5905dec9e6253356d74e

SHA1
b29cb4e79f7100afdadb39428135ddb3a7866277

SHA256
3b5a968751a7edbc6f06dab85eb3e632b6ea3cf318ea7e9dba5e1ccc6832333a

SHA512
da9d1d63ec79c53ee0d30b7b01a991e9216d8acca8c146172688ae173e0ee7f2b46ebbb758af9e82ebfabdd0ba5aa3a8f4322121d58167d2e6d55cf6b0b1af46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b40ff2901105c9d91b0b7dc816ef3b

SHA1
dd86dafe3f29cbd3df9b805e5d5c0a711157730b

SHA256
ac0838cbeb0d991de7632ab8785cd060603b8ec84e5cf84865113bb969832d50

SHA512
4602fc8c735353d09ffa48cda3117bf9e104b660afa9b4477de0d4f27d3e7fdec2d2b0c5b9b697a23ac03eff0946932152f561f14b0c131c54b52889233b58c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC7F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCB1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit