e5f4a6e5cc5fd762913f6f369ab7a5d9f583955c861c55b1c3697a78b3e5bf90

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7a9a6e8ec668ef728b0e7fabbacc6f9b.html
Size

6KB
MD5

7a9a6e8ec668ef728b0e7fabbacc6f9b
SHA1

2253c68c755f472d80c0d3ae3cee67a5fd326c1c
SHA256

e5f4a6e5cc5fd762913f6f369ab7a5d9f583955c861c55b1c3697a78b3e5bf90
SHA512

1e4ed8f6e00f90bfc148234350c36670e43b606273ab791dce11169e9b4ef776982e89f8f9499e64d62aebcb41dca74cebd4655498f4d1b04cd49506122e45a8
SSDEEP

96:uzVs+ux7ZTLLY1k9o84d12ef7CSTUeTcY/6/NcEZ7ru7f:csz7ZTAYS/vD4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22496C91-ACC8-11EE-9A90-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009dff6f0f28e28af85cd8c8341decd90f90f8e8261784bbbbb1d9f1fa6c68ef3e000000000e80000000020000200000006be7e061d0e85bb0485135b9f28ec4bbe1ae9f93fd2ed8cb86c64418266ce276200000003d24e72edb45509be74943b9e66f40d28178df4cfbc9784f64fc56e60cbad87b400000006128fcc3fd0b25166df87d640bead8a061e30d6881199ddfaaa66ea65ab7ec1869179952990f03cb95a9ae97e3069546c7ecefd780fc5c9e2cbf53b9b33ee8a8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004649960f2ab75adf01555da627d1d97fcd6b9883ed652153d7fbe97f8e048098000000000e80000000020000200000001569ed347684a7066589b29c78a45063984000d7374f41dd56c4bfdaf37a313b9000000075c9a561a6dcb7371527cd60ff12ec2a5f133c804d8422b1c3f739df7b147bcfd690409758051d9a886d7817e190b9cb5164e24e795696702ceb54acf2ec1213d32a86ed5281c5b232c9d428c19021db5f1b26bd5f84e022d7ff4dd9b0884f907be4a6adc7910039179ec421b1d9a3d70505144575a800066c0cdba6ee2a3d74d8faa0c805d8d0cd8d2b52f5b1405a6d400000007bb79fba67ba564d11dbb15da6e04e7dcec1bc748c63ea0434f04e0e63a78a52e3929685518cced39750c6891060c616a3412e3f79e303b7274d69cb46097477	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410730478"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c2cc0fd540da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
796	iexplore.exe
796	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1728	796	iexplore.exe	28
PID 796 wrote to memory of 1728	796	iexplore.exe	28
PID 796 wrote to memory of 1728	796	iexplore.exe	28
PID 796 wrote to memory of 1728	796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a9a6e8ec668ef728b0e7fabbacc6f9b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7065286da5e9eedf75fb2a9cb7f80043

SHA1
41ade4e0357dbe1d247cae3685926174f5f9d700

SHA256
f7351d44308fb814ff72c342e13baedfeb8c1143a17b35d923b93ec5724a2b21

SHA512
de0cbdb31ab58c38aafa55fd306a0a18c98fc1b30805e09f52efeba0e61d744b37b021ade1880163300b7a3a09cb6f04531dd57b799d176acfb0b7e5d18e5fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab49ea14bb5af0680510e361c35ea494

SHA1
491b22710ed5dcf1b78d505c46b81ea3da73e11a

SHA256
0546c605981540eb4335d7ed6c2bf73a32c681368c885b6f856e9e180414edc6

SHA512
46d8ebefd8dc5e61753169edf6eb7b5c19d223b7b623fad6ee06285558d9fcd43d3d480bcf949cd196d23dd56bcdc48dbcaad40bb9f42be3968931d0fc3f48b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee2bb14872527ad8b9fc92cd46806df9

SHA1
3d7b995a0b83658539287263fa0d94df75a3acac

SHA256
3224052b9b0dc5f1cbea13efc93021ad6ff8c52d1934266da60dc1257504bfc6

SHA512
56ec532cee1cdc1e01c594b30ba0ca134d98ff063624fce394a0fd70125477592f8e95d29d864aa7a115f8be1ed9d098a4bf1bb4cbf6991f2f5488c17a68e823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29eb3930435aa9969e24174c4108b985

SHA1
fea05841158093b291c86f9ff23dd18269b226b1

SHA256
954e4f46387d17d7628d9236f41df485fc31629cd2a6843ef592ac4bdb2a65f8

SHA512
d7fc2a0e6ddc6bf68ae1d6bf8d960f5caba35a050cab230b1f3299360fdca055303ea94242cfa8dc8088f88ba27a07f1e66252fbaab69ab227c4fbd97d7d5130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e9bb12939666afb9192ef769c5b464b

SHA1
db97a308a6a1a90f658fc102e57751fe3bc49b26

SHA256
d176e5d7041ac5b4ea6c226819dc9e202337039f7278bd73d527beb6fbb87291

SHA512
8e73129077cde822f5cd1eb8a6261a5a8e66ddeeaffe1c04e021ce4b3ea206633062221a98a01453c5be5fb4f7f689bbcc787fa2a64d747686a668a7a99e510a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c222c04dbcc73c2f0e18608d74c26329

SHA1
d99030ef3af62e3f3313c66ec2a14d24d6d2af18

SHA256
feb8c29d3071731e69d5155bc7212366f95abf9b714122077e86dbde503ce86c

SHA512
dc102cdebf531054baad4bb6df2765d38e88e8b026aa2916ae7c5f4293925acb2c924d1559a708144e37271caf60a60be8daf3bf6b69e288cc12dd7bbfcbc005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71afab688219976dff95c879f03ad8df

SHA1
e618dcd3fb3da95838e3182233296fd69d51becf

SHA256
8cb2366380df931cd6ec3e8dcc53da6be7ea20d3f5e5d18c94b0ccb9d2c608cc

SHA512
3942b088ad59079a5ce0304b44dda4429705dfb68f4526834a6280754973988f3518b15d56b9f2a0deab0c68cdaefd7ad2bb4120d444f5700c5e73fcf054623a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ce478e0bf207bbe462b18d649924c37

SHA1
35a7af04fc9eb2931a72fb42ad142fc8689c851d

SHA256
420c253091a41d90eb29da8ab5703bccc13bb492fc952cd65ec1eb5b4597954a

SHA512
f2e2e2c3d83ad663555d01f28405048b8b2ed2f19cb1750280d95d912a934074074d8c9fcdc333c813ab8b4f627ec6d93a62b1afb5bf5201acaa7d2eb0516e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
324cd5cfac6249ac6b2b3f26400ee58b

SHA1
8cadb3f640bebcf1a30b9df56a508f85dba0a9a0

SHA256
58ee32cfbf2eab6f94e01ee0f3a79bc4a75823dd465acfa98d8f9930a200eb52

SHA512
aa8cb168ce1a9c26adfc4820f98f95a466a45e121590568a403fe5f0ad5c9c6a687c65e72d6a85b897a1fc9c172da92b504de12fb08e2c1e6c1b62189a1e5d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
344db9ba4aa3f81119ca43a8f57af4f2

SHA1
cd1aa3832029166ddfb76c9e3a8b11cc80a88690

SHA256
ab509f7dee5f01f54b12d8f36d31b543e2703ef311330e26a146760200940ef5

SHA512
5c674b87cd34fefed3a8413920883a5ae53a3be92dd58dafb90d7f719a2f9ab8454c7a4e6407e7c6667f33e7565235c03b371cb3a299ba39ef351dc89908318a

Download Submit