c6da433e618ed39e6eeb676d893a735c8e3cfb796c87cab62916faa1ee127786

Analysis

max time kernel
237s
max time network
277s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f544913714505f6326a6cacdaa0bf59.html
Size

40KB
MD5

6f544913714505f6326a6cacdaa0bf59
SHA1

a6a1a8d095b9ec982e99edd5115b9f52dba704fd
SHA256

c6da433e618ed39e6eeb676d893a735c8e3cfb796c87cab62916faa1ee127786
SHA512

b149c5161fd0bfd2ddb845a3a286b6dbce3b509dd3af667507081d62c4801db95d434461bf8932d849e1d3b4fa866148d5fc03edba3a686405cc9317f3652716
SSDEEP

768:/7tT0EipB5voCRBpPzZjib7O4J1NzmWtdcQtNdfWZ6cgLyjL:/JTupB5voCRbFjib7Os1NzjbuZ/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901053b41539da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000031306cb36384eafd6be5fa8ff14b25b7ea470d02063ae385eecf7104099a1754000000000e8000000002000020000000b4f364cdfe9a0fb7f2e931906c45e3203d9817b2f56f6fc7b8cd01739e5f564190000000d60c12eab968aa71d7c65c9b00bd353160f6201407d260f2ae8b1dbebb7b316e973c09573eec3846088439dfdaaa132d1dcaaf20dd185c9779659b320cdb0daea5a09d5a957f993b14c99c5fb0671809300476acbd3966ddbd423c40fb7822644e0b10972a71daf142bd5a2bded01d470d739557f0575fde16126a2e8fa40a6dff3a5e3824872288855e8d054ad9c3c940000000246f3fe5af84780aa1bb3757f7d11fc5b036eb8a7ddd67e98aa404f0bd18311896d1e64dcd3332ebf691e4cddc8e0e72e31036b58a2a69d838e3be5ea260a0ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5948151-A508-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006f2aa73af733dcd7cb2b9098340865c97d1b1f45ea8cd73c2c70431dbd8cd3ac000000000e8000000002000020000000d0742cabc27a997b4c5397dcf8a941d70b610709afa3daf1d0a7d801c4bbc5632000000078c3a1ce86aea328c1514eafe45f95d98b851cdc26d1e7d66a47d431c59b240940000000a2e3f366ef5dd21ae4de53bcf809b0f961c45dac92f56855eaf2fa3614d1477c6e722b5c1d67fb96216033c989bd79f742e67610696e3fbf9ee7fb66f21650f2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409878622"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
840	IEXPLORE.EXE
840	IEXPLORE.EXE
840	IEXPLORE.EXE
840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 840	2652	iexplore.exe	28
PID 2652 wrote to memory of 840	2652	iexplore.exe	28
PID 2652 wrote to memory of 840	2652	iexplore.exe	28
PID 2652 wrote to memory of 840	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f544913714505f6326a6cacdaa0bf59.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
543208b5ce215ca7313f5b0d9dae3afa

SHA1
3445773cc5bcc24a922e75220c26fc00891085e3

SHA256
60ffce597b25c4a7df8ee4c5c4ff850a2aecd65285daeb6a09f3967f304b96a7

SHA512
ceb19ea5b573a0d8a29537a80fa53126f18e5b51112eeab7dbfc32b4abdd8861bf6e647cb1610e49dfffbafce5c34e15db7c9217238b2bd982a818ded71c392e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d18119aeed77ca742335397ef00bdea4

SHA1
78954d4247e8666a94e2de9e6b857d699a97c22a

SHA256
340f10646ba0fbba9471ab3291df9bbb4c10b906bf82625191313a48af2e0379

SHA512
ddc3f9ddd07d6ad9f573b3c1d3ce73f2df52fd2e911bcd4de0e1631e1ade5293c8c92ba70ddf8bc41c2457d041a4d036e58c680201690a682c973ff13017deba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ce7573b597953ba17e9491a1ecb5d67

SHA1
38a002d4364fb24fd49f8a57692a216e239f86e2

SHA256
b364919e6b50a2444e80df1fbec43950390e1eb9ace91b07159b193333e8a0b5

SHA512
c33744073eda3fb64919746ccb48a5d3b94820d68f52ccc26f7b038bed89a0bed5ee6df691e9256dcb5addcc60a0ea25c1e1d85849ebd2133b13cbd2326845a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81446c1c0c1e78fb31dd0df933d9323d

SHA1
9c3b11422362d9b1195dee00d9fee50f6b3deec5

SHA256
e4bf5a96ccc3135fdfce13d45cee4e1a27c686e59aec76f096796617f1e544c7

SHA512
bce46718910767a1c060707cbff69562063cc5f419d4d585534c1944e85ee5c248b697564a4d94041a7667e457718ec211ecc7405c6c162e38a6ce95b0344b27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d501df1306b8328a86125ca28ec28ecd

SHA1
58aa8ef86f72b3552faa8f4c3ff0038418b41a15

SHA256
57959280fededafb185ab67b1f6cf4cb0c762bd2d9aed7dda7415074eab1878e

SHA512
22f85a532c88145f2ee83b07e235aaf812848e5907bd9ad3dc988887a0e02d919de74a1e6d724289aeb6d87fe78f54a1d5230f9b87e525a6ad9babea0e9f8841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9c2d50f5679fbfabac0f0cc4d796480

SHA1
4f59860fd290f7634e8fababa9bd156206512191

SHA256
2297902419e9b022fe05a2ce0ba67fe5def7c2ecbd14db539db268c0e2950df6

SHA512
8901c6851abcd01a64e66e8e05b78dc7f043c8bd481fba1df5cb932ab57799a5fc878c3b0616caeef8845309274df1b3172d27ca3507c3c03d53e3c1c6fb6b4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ba42dce1fd24ab06a7e72cc5eed61f9

SHA1
094e4b3f7580d719025db1229aa9a44da11c8b71

SHA256
4f4a6a1dc20e054ec83550248463454eb66c7323de540dd87caf50f5cd70cee5

SHA512
1c900270cc5331da1fc344949ff5b5dd1ea02c3705ab782a72d1cdb14597aca9021bbb3fedd83334d183c588721ae9e04004eb9d26d4f30898b4b5e8e1521a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56ba5e293f59f43739badd6674aac72b

SHA1
c0266d0e14e5f922223616d214ce6b10555b0c30

SHA256
0fe03c6853eb7fec04c486c30ce76612405e45f1b545b3c28abb76e0004cf221

SHA512
121081accb22a0b40f007218572cb7a1a19e1c5c520b3b20d793f1d0b49fe59861b58afc2d36064bb6ec70ddd67dbc6f9593edff5d22cf5842192faacb63fccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd7e23ff46aa188a4f91e96d0cc785d

SHA1
8f03d56309d0b1ac78afe92d6d61c0999e98d4a1

SHA256
adf7f8e50f8c71f4ff27a2818e380244c67af993bc183625d3f8691dd6150902

SHA512
346ab30d23b28b9b43a28538a03b22a7e09c4b8609bf2ec5a3c2471899300a6d23bb6531670b868849c3e2652b54ddda8d9ada91388b40faa0ce57c0d6c77a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30cf0ef59d557ecdee8bd6d840e9706d

SHA1
12e2882a1dc9751019157d1ac6e9df7033a8094a

SHA256
37e379864681c82d6869107ff120d768f57576b3d586ba98a212c1231e0fdb8f

SHA512
779b035b05938037faf07ec50e30d4772f4a78eb51e6c0e5a17746576c01ba082f79ad027149c6321fd34d6238c037103bf2493513c6207f53ebf1654630ce20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aa0cc44f38cca71ff7130b14bde5e8a

SHA1
a291115a40489fa78d6ac7cc5b2bb05ae2ac8cd3

SHA256
aafcf629e7602e2ff5d4344dc55d13062fade92e58c8d7566e3bc9a4da7ae963

SHA512
5605ff5a51b04654b3eab25a8b2a3541c4def40b7dc4d0278e9d1026577b06f29edfab4d473ddda82f90493a62a30d25141ae04fe8941ed5b3350d757699efcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f2d8eec092fcec863ba64f862e9e18

SHA1
071dc5ea2aa7b996f64ace480834e91dd505bd91

SHA256
7c79ecaa906126949d2e37c066f086b5e6e312748d125445d5ddaed77a2e8bb8

SHA512
ec1403dd4f318a39fe876a8bc57c9a2784b3192ce236d3a2608e9b9bdd2220b89a8ed307385259fd6b842ce71f8fdde482fe39e7028d5e0edad5f032a77887c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0545cfa347b9117e0266b0b989dd337

SHA1
9ee903e247e7f9741993e369013d8ba4e5591d73

SHA256
838467e0f921ce2caf065b97e8bbba55f44fbce6e72559cc9fa657043537babd

SHA512
bda5a5fc00dde51662609f3e30a50caf8e40a32d2d1485561cf9c27c2b40520275e26c425319b0cbac482f692dc3ef6c7db6d3827aad8a3b64dfdd7ec9d3a63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcb7484440393ff13f21051eaef1b42b

SHA1
fe060ecd05c76b170d7cef278cc6b0049ed7c6cc

SHA256
83a968f341728ac45d0263b08aa97cae70d5dc4d1c40e164e6a5ba825f295ca2

SHA512
39e716e0abc13bc3424d0f35b92e1a721a2900f361cfe6a9ff9545b64214e01cbac262838fc7135877df9b9356bd9de0be33c98e208e637e0cf140d55da50e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f6d9d803eb518828f3a34ed1d6c3eef

SHA1
7acc57d8677e3aadf2563b21cea31eb3f883b4b9

SHA256
7c7c30c5d68929f97ec11ca1eaf8f005518feb760aab66087f9725e6525e06c4

SHA512
57c516081b761ab05cb8fe881347a90b6fc9ebe25e4662031307ed52eea8e0a740cd568a31892eb47626d06401cc4f52a7be825a3e5984c3ba2627a47048b0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c45fb57b8939cbebe879ac5729e88523

SHA1
72cbc22f27027c0406acbf83463cbf3dcd14d8ca

SHA256
4f6ecdaf836dca18e32234b03f7992a05ece331bba2a827d710fa5bc6003c6bc

SHA512
5977a35a319dc924b06b4f60eea64e357bd6609ef2a076403cdfc19489acb3a6c479a289432529fd5dbe2edb4c62b58e79a58f6cfd2d28e2989aee81b0fc18ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BAF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F9B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit