4b4d024dd2ba9f21f32ff8e5d46b5a0342215bcc6a9942e45e21ec2213d429dd

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6cde7c9f82107702356667d00ff68b4.html
Size

1KB
MD5

f6cde7c9f82107702356667d00ff68b4
SHA1

5e938923f79b3ca34454dacfa0638473e17ef7dd
SHA256

4b4d024dd2ba9f21f32ff8e5d46b5a0342215bcc6a9942e45e21ec2213d429dd
SHA512

3d7275336830d694c4770b764648f376eb2211aad3d04f67e3e4d5710bf925780813ea6ecc5c71c29477e87a7248e4dd071f2c113a8ae2058e9fca36706d93ca

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410991679"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000dc96aa38f66206a2246fffbe1bea1b38b6a8456d98660e4f37a6b19739c41e39000000000e800000000200002000000007f5b94eea6348cfc1b500f5469c6137a7483b201e69b25286da53facbcb690a2000000064537e79a8ec7e4957ae411a9c5d20028740c83ff8f558bf050648cc9c3cebc0400000008b105786db38fac7ab1a139d290b3253b55e1af790755c99b9fa2a73f2f595dff147fea5806d009d2299cf7f31f99ff1f9328ed2198364f2c0f837d2b84030d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000514c39cce732dffdeab215b6cbea4b60a9a9e8904b2dc465eda944983ecd52d9000000000e8000000002000020000000999f52ec5d153fd0e04a39a917f706318a36577a5ecb76c2f03413db5f1b511890000000478775117bac945331724356588b82772cfc1a7dd37803b2830bf97f3e230d861342d14ae0c9665cf99e6ddeda83c47d868abae90e4865de01175edb73322681a57db8d54cb47af300fd589235e87f7e2eb1c66cbf25b10786f911ff2b3d2ee524001313a7f5702dd4b55652be7c197c303444747480f1ceab6670e7c20297de6f295784307e89ff6b5416f0ab113d5140000000e2824b0408acc01daa9fce6d04bb0412b9ab5af5742610c1b08a65d2269d4da9a43efa96e7ce397753615662422858fb7efd3805793410c516e0966b570eb26b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a061211f3543da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A4D9881-AF28-11EE-92C4-6E3D54FB2439} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2304	2188	iexplore.exe	28
PID 2188 wrote to memory of 2304	2188	iexplore.exe	28
PID 2188 wrote to memory of 2304	2188	iexplore.exe	28
PID 2188 wrote to memory of 2304	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6cde7c9f82107702356667d00ff68b4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8039d855fc4da6be5f8b77ed606384f4

SHA1
5078ee4e5265a695bb8659ed646b19611b020eb6

SHA256
a108766a897ffc0bd44286ebff2d146ecd3cfef358f768876d00b845efd1a914

SHA512
eef8f9d636a3a5f675d3f62d1f9cc47c1d3d8aa97d707db90dd2558aece6958f15794db84bd7fe6b7efdc7da9a80c64716c3fe19574a3d39f340946aa746c085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9f264a554da51fe7d177db6957753a

SHA1
ea2d810ab37faa580c4a00823324de7e2fa60c7d

SHA256
be772cafe8d87dfd1e1682b4537d9d2e206e58796fac6cc9201711ee2577ab40

SHA512
e80130748faf9af8e150cf49c6f13071625f1e720e987b3c2f244e0a6899c7d70d14838b463eadf1faade844deab720d1bd7b231a8a88500773a3e92d8502a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d2bedae789e7b6f4577ec00ffa93bcc

SHA1
31e0c597e3c7daab127d08d569971cff2d1fbe0b

SHA256
00faa0761762f08763441bf722cf8c16fc869cb11c4de1392efd03080e8ace5a

SHA512
50b3703f91d42c70865ac0bad21d7763ec3cfeb0af8948ae79e3295257d8af94cdb4b1bd1260104d96d3b1369abde0e112449d1c9fe4dac3b21637bfcfeac39d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83230a6e0c9c29879e524b28893856f9

SHA1
90d2cfe7cb3aad44b648a5a42c12beb1eee5d85b

SHA256
55bf6cc9576eb9d33aea1f94a2f72ae96d9538803fa6b655af2e738f0730b066

SHA512
a59978b3342c270a0973c09c7cb17496a6a8c4e9fbdcd10eabd2a8a8477e65d8e6e634417810de1d144851258673a3a35c5ca1700b2d95d58a86ebcfd1a42ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93bf3ea426f4e7f959c3e7fe41259043

SHA1
c742160335a5a151836218b1485216fc2a09df14

SHA256
99262b2085da128bb3d3e2f886dc6ba03075078e42798fe4b0b01848fc54a4b9

SHA512
3744be61f8f5c38505f96bf15f4d5381ec79654defda8638db00bca94171d87e8a6f0c09ddffb44747c3f15698eef6305b3a60a878bb9214bcd901273e3bbe41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aebc90d9abfd69128a58f4e32bed2e94

SHA1
1f149c8e985c373e94bc5246b7c9fa07c23f3438

SHA256
94f69b40be791232107da6896abb5b285feffbe3d673f62701b4d4c344e029f5

SHA512
ed545bd2ab8a77b0ec1c10aab352a6b94f8434acead4cd0ca926ac0bb5751aedfd8bc06fef325bd95b1b14cd7c68000447aac0555179c489dc929e49aec03a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964ffde599ff8126ee4e4207fa1af798

SHA1
08e10d002ac306d1116d1a36962716c3e4265d75

SHA256
0694a8f12875217f174b5ca5401fb85107c9013ff953e9b332e1a1efd185ca02

SHA512
47b92b494028bf1b30ee8b871d5ac81169e1d93d51dc8f837daa676d0dcc235f64b77a0193f0c8bea9afb44fbe9578e133dbd7904a3839527fc9bbbb98eec9dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b1623f67b5d59581133146fae7dc0fa

SHA1
37a48393e32d2b63c8ef34f8d6b2b11fadba3ea0

SHA256
4cf972c9371999db90d8b241faddf0b34d368045096567dcb3ee485b94d5fce7

SHA512
56eb9c31b322482065d0ffdf11cce0c84676a34669b5187ba3c035f206291fa1df0beca7ac0f532311c596bc5b1e3f25a48a83bc03f9088a44088e63ef6bd899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7e123f914b91f0dd67460aa2cc49ea4

SHA1
06d16cdddfa0991f73c4d2787f9fe409610722cb

SHA256
4987ed8ff052533a165dd00e20597dfed9feb1499eb1f3e138650a4c1cf67d49

SHA512
5450071d3b8d42876123f251dac96bbb2d5333c3409d1f3e49ed3a14f213e973deab6795e1cb90a6b832ff5b097317e56d5abe5f7ea2a8cb3d873aa20b99175c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad482dd9fb3bb39659add0f9bada3c73

SHA1
5bf4271d721cf5322112a3ffb2718863d21e8360

SHA256
93f416e0b1fa225a26abb7135ac61cab7684dbfd96b1c589d745f0e1cce94c1f

SHA512
52ec7e0461b0e35250d2ab9fdbdc86284de1f9671a818ac89ead2a5cacc4f126f4f9160cc4f9e2b311d4bfb1b6b0514b05847685972c0c5a2ef81a1b6290bb66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77d3910432676301ee1a9ad2788e7e73

SHA1
6a35a97098121c3196c087027a652e6ac5acb250

SHA256
ca19ff13d227f76e61ec574f0d599681743f001d703d31484a33da79405612dc

SHA512
cd811c8bb15082001449ba04471d0db9fa96ca563361584c9c7f72ba7b0328efeb5601a903b8fede3dd4e43ce9429a8153b2667e8ef1d82dd14979931ee161fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5718.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57A8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit