e16a553a9ab69ead41ab744fd7e508d7afe3840261436ae11710a28f43e01f7c

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6e30a7c18eab04a8d23eccfaf9cddfa4.html
Size

113KB
MD5

6e30a7c18eab04a8d23eccfaf9cddfa4
SHA1

adc5d4497feac2d1e8b0994c02882cbc5b21cbb1
SHA256

e16a553a9ab69ead41ab744fd7e508d7afe3840261436ae11710a28f43e01f7c
SHA512

29c0c440e0822f4b52b540ea154f856237f1a8637e9f316e9c4e8f3ef85c2ef52a7ce1051e491cd3ecdbed089d153f1095feebbb330b2726573abb40e73f7a41
SSDEEP

1536:7hyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQy:7hyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b5d7240f39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002404cfdadd86dd89ddc2972f1f3bf34cf897cbf8c46e4f6ee2f83d8c4403bbb2000000000e8000000002000020000000699a02a6265dfc82d286e816991a408d01f6fe4c5a553ef955f5aaefe05f166c200000006852f950ddb96876a2ef88e04d8d4405db7417fa2c1d754ee4f400aca063e1aa40000000aa6ac22deb70e746fff046ad8976ff03cb5e9d93467f935aa5a45f89afe55de4694bf78bb74f25d8cea18e0d1b9e9c694ed3e7e1c19f8eeff25d5d49e315f7ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409875855"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e2466306b5452f8290690f2277501e4a689e52a5a1137773a8ce334498914932000000000e8000000002000020000000e8b0200b50577e70e3e4dea738dc3c15ad0c7aa07ec7d7837e52b415d812fecc90000000eb99d4fc767ff34ea63d8bb839242e9ee40cc797ecc6222d0509e9d0edd53d4e547ef3b66ffa627c762b34b721f7f03415093abe9e7bb33cc675c8420516d0a0feb0395329e65f9d4ec6f1a9b248849e35b89edc8d2efb153247e0e8236f2845819490b81eb41b53e705a916991d316836f5f68666897047a4def963c2bc252840422711c13d5d3e08e59de452159f564000000014143283451b617c76017b73d8f3916ed6ad6c66cb3686db444a4e8b27a935b666fc009391bb600b40a21c2fc12ae880846778d37c3f8ea36591680190cdc563	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50709851-A502-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1632	2104	iexplore.exe	17
PID 2104 wrote to memory of 1632	2104	iexplore.exe	17
PID 2104 wrote to memory of 1632	2104	iexplore.exe	17
PID 2104 wrote to memory of 1632	2104	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e30a7c18eab04a8d23eccfaf9cddfa4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c5b64b3898b649cf421446657a43d97

SHA1
2239cef45332931753da1bb447a79297fa72f623

SHA256
d6330cfbc0d845b41e0469314b381e43a168a6b8344676c85c25745bf7abc8ef

SHA512
c3a51b0e52abfe4483812769f4a670ab48297e90b4e03855babd16b8a1bb2788a77daca24ededc45feefce38f04fadf44fcfda85751c7514ecab46e7dbfc7033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43cc6721920704cd12be289253cf2921

SHA1
8c79b79b9b3bbd063ad7bd36c47513542eb3d014

SHA256
c82a7a64f3f451405cc4f4b873eaa0ed130ede346a7992f009d862fdbc7187c7

SHA512
a6a2896fa063395a057f427170427562b761ea08b80c40223fcbf5f13d00d25ccda0ff75a632a8adf6868cf4e86790f3bcc9d0273d908568aa6b5c60914759d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c8f8318e13358b61cdd3bb5cd19dc7

SHA1
47d98742164320c5ad057773a95d21dc4914b85f

SHA256
69cb854da18cd98b91703aa6e2b17eb26233aa111569ef0465ccb391c1f4f52d

SHA512
261a622def8e94c31c7d166878bf900c81f1514b486a9d998d3da125ccc04bc8241ba9860d51345d6c216d0bab4f1645b478e5a8d2cafc066e71f09aa221e88c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9696b1195fe0435d9818a0008da8686a

SHA1
f15c704eb6ae680f90202599deb3af51900a2f2a

SHA256
ac84f05f4a60a2bdbbd881ab54c0919f2a31eb12e7ed2228d91db41d8aaadbd2

SHA512
ee8fca9dd9e3f07f6d3db88a44e0b86167823a73dc0fd1d2a39869f966e681d3d329b458d090a45ff8d131933942b603c50d9f2f9a8dd181fca5cc80d88952ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54350de3edaed81b02b0a614aa6f700e

SHA1
12716bdd75cb5b909989c14cb8ac55b505114c57

SHA256
56e6e2db2822a26b070b2d3464f05c634551f78b9ca9ecea968ca734ade95efb

SHA512
fb2c710436dcf4119a00e566ad99efde66f476bd9ec7de81a11d94c6077fb78ad3bdb8058ab5fba3208176543301a92c1ccf07c1c96a8527d073ab13be6c5e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
510da98fd170c5c49035f5e87d91331a

SHA1
4edc49c777f7af0089968249076b289b4da4d187

SHA256
ba863d223ea1477a092870d89be2becd96b288ddeec32410b1f10d84c1920408

SHA512
925eb041837401512d3987303c2add4af16bb2ba477ad39a66690dcaaf49a50d127dabff744ab19c909289ecda2357ec69df39efeb47dad5a354b94efc147da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eedb447ea2a09ee849694453f8aba84f

SHA1
eed8b249b7ee4b83835bf48434e6be1da8a497a6

SHA256
e272ceb19797db64241c51dce0c589aba324c66c368b0b2c9c247e533d76273b

SHA512
2ae57791be579fa76da66cf5e39c7693ddb58f3a84f9b2a4dbf935f49cf61b575e12fe942fc23e845ab32af96813464b10843ab6e38cfe3448ee9fce65c49813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53aa967a9a53778241830ee67a5d54e2

SHA1
9c9e68492252dbcae14661906bd7a177efe10976

SHA256
33a3617505020df971c5f16bef327f5a16d252c3e5dd4287f9796e8a46d4503b

SHA512
3ae7144162557230d598f83117d642785440d8154e34a5d6aaac8e0a10fd375169d22e66b0ae0fcd900c9808bf6561231a51ec50b78fb954f50d3c8bb2ddd7d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e492ffe08ed81b8e2c80bc934f6d7a

SHA1
44664746b812eed213ccd87b3d6061c5f70acd1f

SHA256
5adf039fd484b955baa7bbe1dc8338592ef83f29a15f2b23292fc1ad4d36603f

SHA512
7bc6828ea0a7388bd215c0477da8ed5c5d76e659732b9854e0ceffb1924a896dea7d6929ec7c2ae8b060b0f47f6404d16891139bdac12fed0ad02c5e1da33b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B01.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B13.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit