dc69424820db647c0f1e9c5551c9c135207f7c5626b011d558935d260b40dadd

Analysis

max time kernel
65s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6fb872fc7b7069568e25f437a43cae9.html
Size

53KB
MD5

f6fb872fc7b7069568e25f437a43cae9
SHA1

0580274e8dbd47949b3920c851203f168e4fd979
SHA256

dc69424820db647c0f1e9c5551c9c135207f7c5626b011d558935d260b40dadd
SHA512

5854fe9e0f1e961800c3ac5d0486e90fc5416a090d4480029aaba42216a4478f1e51332624449d412229aa879a0e45fadeb6a464dacb02b93e9c71ec3e52b2c7
SSDEEP

1536:CkgUiIakTqGivi+PyU3runlY263Nj+q5VyvR0w2AzTICbbKo3/t9M/dNwIUTDmDH:CkgUiIakTqGivi+PyU3runlY263Nj+q3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E041C51-AA2D-11EE-99C0-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2796	2000	iexplore.exe	28
PID 2000 wrote to memory of 2796	2000	iexplore.exe	28
PID 2000 wrote to memory of 2796	2000	iexplore.exe	28
PID 2000 wrote to memory of 2796	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6fb872fc7b7069568e25f437a43cae9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a38230c3efb9d471ce4dad9ae2900bde

SHA1
8b50f4a1cf610882748779d447d07c1e77be3fa7

SHA256
0ace44cb6306de7caa56cab889c5bc8ce60e547bb6964b3c7fb27f7deb8a666d

SHA512
6b18cec6bbd488225ff8188fd631d8065c75c73c775688c3770e06b8e5d369b3e0b0b8baf3d54ffa0662b45110e1d301f2c08fef6bca14dc38ddb9dc51e8c7ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66bc81ef260ee734a62ab4096ad2098c

SHA1
00200367a1e62224dace631d35ca3efbc5f9d261

SHA256
54a7c8d0a6744fd66efd123b1c2adc95621ba767b292bd1843dd2ea755a7dedc

SHA512
031ec4d0c8c4528c000ba909253eb648423887435b3251a2f03f9c446e3a1c52fddadf5b7d9cd71c0c923722952599fa46dd27249579bbe824b3ecb47a87008b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a87a990170a635d671c4f4c2a54a8350

SHA1
3ff145461a2074ed3d4e848e8dbb195165481560

SHA256
2da44afc31cfcb058d7313ee7995803266c52ee05e444da7390c26e4004c6f6b

SHA512
eff72cf39ccfa69012ff51b7311cb17f1931e03a83397120ae2fb4a7ad524e96daf7d614d3e37cd889e0324ac57dc7b5300d6c316701c941c8cc3bfb4ed9102d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90f8f69cb4188aab46ca9972cce2895f

SHA1
c70e110ab8da26eeba6872e2dced11419e402934

SHA256
048eec54a7c712db74356311e7acac334af6bbcfd7a19b4c2f91cc2742f0e9e2

SHA512
0f0bf7451ce1f997dbad0345cbb7fb5232a99b7c7bda2af9d17097410933459fc2d552387bd41a6f461a60be03150bd11bbbb263458deb3486628d2ddee7c417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15f8e4a2a4ac936c7a0ca9b446e26219

SHA1
094f5ddbe200862361a3228aa591ab328fd1feba

SHA256
18a0acda0097bd554774c2cb6af21216a3708ec1f82c843546bb9b4d82219cdf

SHA512
b7202df91096a38a42df38ebf4d3ec56f44ab75afe915e52abbba1e5066e2924841b1d19edced1283a0dca9799000ada484d00a5dfbc750c93e5a7e436dc1204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f20f39018d0bac443eef3ead0a2e0f71

SHA1
a0a13811487dcc53a0666ce253b51d2a3182c58d

SHA256
d006d57261136ef031080a1eb56d73d9831ae29bd847e11ad09f8a81598cf6da

SHA512
ce5e2ae522b1f9676419b455adb60400083ff5bf2d9096b6edc092cd54d1d30d5b0cc1bb802f24235cfcc14f556bcf06688d0892fe9bf419c282eecb7c1fe7c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ee66c05c8c63a30e508ad6519f35ab8

SHA1
c7b5b2f9802791bdee3cd9a161581478db2fdd90

SHA256
4109392b44e6dee68c177b30ca0f0e26b371a820cbdc1f7dc15e79509e5ba000

SHA512
7d512766636c8bc34c09a4a269fac08219a77d9f2b9c6d2d70cc1d2eccf18711e3fcdd22a6d035786dbe323847a9bb6570ca7f89f9452576afa37d261ea24238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac34330ffb6dbcbc46ed5de68c60e63a

SHA1
6c6f39a2910e6ac4b5344698701a50cccbe76633

SHA256
4827cad08fb7d80952e40e5c2569953132201dedc6809742e252ef28e16237ba

SHA512
aae9e15cf39280686e5a6ab371b7b3f99704bbe09abd6d7629680c5bda0b817e1e89d46ac4b4330436e9eade8caf7cd53a082d0a597bd8564698c2218a685c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38AE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49C3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit