af56fa9afd7c1f8aabda1635cddbc3ec0c9844e3e630cc3b7f202624e53b8a7f

Analysis

max time kernel
140s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b6ecd294958163cd06c6f1dec89542c.html
Size

36KB
MD5

7b6ecd294958163cd06c6f1dec89542c
SHA1

3b702d8639b65364e4486391cbb6fd6bced157c4
SHA256

af56fa9afd7c1f8aabda1635cddbc3ec0c9844e3e630cc3b7f202624e53b8a7f
SHA512

7df2c5f1a21e6312a5c6046bea05971f3a0addd68533c06740b4f0c3b87583d7865f14be749c12e49e04130e0ab44bf4d35fe33c59afdeb6d77c568c43d22c0e
SSDEEP

768:VLB01GYfoWz+2+xAXBihPG2dS/L4Bn7vFZ+r+kOS2G0z:AgWyAXBMGIScha2G0z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b070fc15d840da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40FC1951-ACCB-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000061ec562471ac353bf93e33450dc4e48ee80604fbd3aab63d3bb653ccfa43e2e000000000e8000000002000020000000460cb1886206ce88b65b73fb70c4ad4d0c170fc3d014015238d69408e6a818ce900000001708dbd9546af0c1306cc9095402d41fa3052aa96ef09185284c895a2d74db1ad304596fcc4291b72badceb9d1b6cbaa02ba678f38ef70efd425f0963d8ce0fdfdc6bfa30450b0d6b227b6b88d7a779d1423b40985453c506d9332da303a0a497d005b03c1e8e2376ba22bf62b05d5a65fa6b17adeda09d0d81765699f5ef714966a9e2e20a0e6932d3060a4479e12d2400000004c1738ac75fa38072fc5fa9c3d305ac47c7eff4c419404764a5e741d91c3bde66d00f4c5529935db4428a715543a8735d8a8e453bec49a4222ed9b8b894100d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000010178e68ac91aa9ae292e9a1d58892ae14a1c701be31b7a1f8a0de4370f4c781000000000e8000000002000020000000fba5d68b51b9998124684b57aac60b3fb22e5aa48b342f2497f5d92d4a883b1b200000009ab45bc0569bf2369ded1b599c57e984c255272c10495cb9a3db5944fbb281f840000000f3389b36802747bdcfbeeba10f4980c010c0622b95a5d1ecd1f6fbfc65a0ced26ef893984ccb2640cdb88d92afbc01fe21850481e391a127e24c7991a266345e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410731820"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28
PID 2848 wrote to memory of 2128	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b6ecd294958163cd06c6f1dec89542c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a606260311b07cfc03556cd21c306a66

SHA1
35de177090c7fcefcdcc0a30dc3e368233e6ab67

SHA256
dc1dc66b683f6e31d506e1941920a32151241260abe7be22982f48d880f50df5

SHA512
c7125457ea0ef2e26ffdc7a7ffdeb1cd19cd9b9ded30c61c6f9dfa95d367092c8737bd20af13542e35f047684be4409737a95eafcede3be175c297d0665993e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6490d00e84e765e1196b1fde59e25500

SHA1
d8a0580f1cfd58f04235ab035090cc18fee6ae90

SHA256
627e679f0ef483839f5f155036dbcce2af79a0429303ea76d794fcbb607d8faf

SHA512
8440a2d0542077813bd3ea8179be369610cc06adb19705ce75b4da361e3172b12e279d75f4a750a14996e25b3e5865db2167b5e4a0f3d689194d6acc4e601790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4736770a920b2d436e379f3d3fe3e237

SHA1
a45f6ba66b772589ff957772f77981b43e97399f

SHA256
64488acf817bc488015bf79cb1e0feafc745f1ab2577fa1af7f01436a095ca7a

SHA512
5abd1cca92b599a4645874c319f82d1a6fa2500b31d5046e7caa85a81748f189db76455f8ce7ffea8245376b96e56f8b1c26a756eae87655180b6d773ff9b554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56d917f59b841de8884dffc96a7d7b8e

SHA1
7e62cd94aed14987e83a39feb0216d4380f10479

SHA256
783305ef012fbf43eb2ec9ce08b3e839add3d777d340a8ca6c177a0f079f0270

SHA512
d2d6932d574106910cbb0f5e44d4a2c7d84c9fc062c63a264e49abff8152cb8a89bdd660490f004de472c2b48c15589f7d638a98f6ead54b14ca534845cc1f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ae221605763dbfd1337e73eb4784134

SHA1
efbaa620f4a6441cbabd4f9ca906482a0f90f928

SHA256
bb9c5125a8ad51c79d422e19a3081a882e68a64257cfda561593a1705dc6e5f7

SHA512
7c4f7b4f84851f3acb7ce02c9363cba961431583fa414452eae6960b7c0fc492fc439dfb7c35f513b0645d5e9adccd9201b4259f26ea706a0dd6c1455753f9f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79837dde667fa1856fa4f2fc4b2ef3e7

SHA1
89193e96435852973ee82f21f3e7c19243b6ba27

SHA256
da758de92a70919e344072bc73e9c4fa044ea32da9336f7668b52b167c9db5f4

SHA512
302413359666bb86f0668b30f31a60c0af2371f525a54335d456a11d11806b1768be07387ca095828cafa1d6acc9e8c7ca58f5bb6e51e8660148e9e1f9d07c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f14a579c145b552f2841cc7c32335670

SHA1
527520521f221c490b6ed3392c8b4493549d72fd

SHA256
5c6df4f05d4220f6ea67d54ad1427e645acb42188cc32e817853ff4edf9b9a00

SHA512
f74b5427822f3910dd760a7a022b08bd42d264ee167f9b84b4b4c2cd6201039f812e951a5f9484977df8fdd7d2fc730d40fcf6d7678a4e3592bcdfef38ce94bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0e388b60f7303b82ee7d4baf00c2d37

SHA1
e2808df2a80667a95f40ea076053ed311b4fc787

SHA256
c0721b97d8c61d921327d86c1e360a8230df27f4f24dbb6b4c64b496a687fc69

SHA512
a64afe0fa175b1657196843455d441703018ffb5f7aecb2d8805772ea03350321658c4125ba5269402fb24d78cf3a6531f424cfd69d683bc0c6805352f420868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f3f1cbdb77ba6fc5ba7c29981ef9977

SHA1
4b32ce817c341fcca8fed79a9b7f64082084c717

SHA256
07510b9f3e3e634df781b7fffd4b51a46d66de7a088128711252cdd1f33156f3

SHA512
37af7a214b6cddbd78827051de06cb5d6f19ceda8ce1f9581e1aff184211971a82eac24a92e0fed8c932a7138a0f76c2378f5886a333fd7bcc3666ccc5551d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85710d6744f648367df7e1925005ae62

SHA1
6d1c025d69395633d24f44f2ebf59349b5db949b

SHA256
292b18889650b9a37a99b0150d54466f312b95f2750039bc15401679ee1b316b

SHA512
b41ee37a72a5d4c013b6faa23f0ec6d1c6ef6a437d56c6b03406a3d47c681004a0217220a2694d745a55e50c1d11d54176055218e6e96a066e7902c4ba2cb84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19995d23e4ff290177bb69d08866cd0e

SHA1
6a0f82755c3c5876a05130ad3d7d719de8a07583

SHA256
9f6b3eb0b39440e9e8910cdca9c4c5769fd9f3bbafb59cccecf5dc51fbb6014f

SHA512
29f0564f077acb5a1ac5571608c8070beb7aa2f82ae2caa2cb6349599e3c3cce268396d2a15638cadb5bd07035c260b56232d942e053d9deeda8f5543c5db158

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6FB7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7871.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit