6307c9d361cdbdd5bb9765879eefcc9379292b6dce3b4f8e6d3bad267966cabf

Analysis

max time kernel
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

056c2a145bbd0eef0cf041fdde03c22b.html
Size

10KB
MD5

056c2a145bbd0eef0cf041fdde03c22b
SHA1

c1716d38042581c54a940cc56d593a8c7fb1b8f1
SHA256

6307c9d361cdbdd5bb9765879eefcc9379292b6dce3b4f8e6d3bad267966cabf
SHA512

09d0e2df1e32671a38144372f0eaa49820c92297eb93fc40faacd3c5c0ea8224c60e298e0176529b542ed0d3652790a8ad8d3c79bf28dc73c0a97728814cace4
SSDEEP

192:PT6cLemskhTSDX8CS2TUd7e0NWzXgCf8aCn8kyWrD1Ny8gRtPraY:+YskhQS3DWzXgCEv9lE8gRtx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000001cc27dac4aa0eb895af3529fed01794e4f993cb41d4ca941e9b04f88dc233110000000000e8000000002000020000000cc867d15e1e03270567b94a4e07c2e8d1622e67352acd892002031bf45633f9c2000000067d5c060cd4531cd0f27fda5caead947b860021f6ff7a6dcd6fedcd25f412bfa4000000024bf0d3abfb38ce81ce99aec7cc39db14ac647e7d8156a7fad1a529f5b544be21397f44687eca9ceb7860211bd3d33e1f008dfe0b874bb761ad9a4d8f606d2e3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04b0537d53ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FA03161-A6C8-11EE-8FC2-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ab23292eca89e6a1a41663ed244e552458390ed10785e18e7258fd48c5522ff1000000000e800000000200002000000045e4d777439347700a769663243e215e2a14bbc10751d1b8a4401d12d4d5b78e900000002e98e03219b3d86d5f283baa7bd25b5225065aea94059a54783bbe27fe1c4ae9ec7b032e3c811ce15ccc6edb82012a0786d4b30e72b5739e51cf37af19a5069aa04bb62faf88aaccdf8b9cd8a8b83892755c25efc884e9ab1792f2f9472d5becdd21d6c30bf9883b3584fe5b690a73b9becc85e3f7af03ebbcf7bf6585e9700b2a13b1d6a508dd27a2d15e4d7e37ebf94000000068e6650f9945fd9ce893756fc010588a5cb30baf6e8691d3544eb7ee91714badaf3f08227978338af65490b134e5e904cb60a602fa4041df77ad6a09b118d931	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410070872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3024	2144	iexplore.exe	28
PID 2144 wrote to memory of 3024	2144	iexplore.exe	28
PID 2144 wrote to memory of 3024	2144	iexplore.exe	28
PID 2144 wrote to memory of 3024	2144	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\056c2a145bbd0eef0cf041fdde03c22b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04b57ddc03b5026d717e1d18ed553a6c

SHA1
66f569deceba99f3b43769f0e4cb49b977d9f582

SHA256
b1aea9fe50beb03c1495e3eeeb52ea21daba9a2ed49e0ee97a4dbec3053e10f5

SHA512
4408dbba764ba7f5c19c6b5ae343269c551135c2e4c6100fb1793317932fece5b548e36a82aec21babcee208d8de670aa40b4249a58aab34d2171c85ed637551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
521d643eeac4b71c86e6f7dd620ab427

SHA1
c3c95c2eb2c3350a784646750ad0d0213d4ab9f3

SHA256
e293ea690442f0e2e9c38e3578b5e292a31a0b5ed7b4bd9df0172e13d329ca6e

SHA512
a1bda6e1e3c45d8a13701f623cdadb4f5328fb371eb194de8e9172a5464b6a6e11584f13cd404d523b19bbe91bd0a23c8d10093177aed3c67a4ddbeb9e79c84b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c9c7488b27b5f9c70bfe82458fabaaf

SHA1
1de1b154e6dc998b3b620c37a2e3d3e88bea905d

SHA256
206bfe83050ce20d89e3b549f950e7e3d02aa639fd2702f2b45d125322ba9f9d

SHA512
9a02c5f06c143f3dec3409bf7a03fddc82b7aa4691a127f66091936f92fdeafd53a01f7f03786cb6504d45e026e2f2268715f726829fa48fa2602413a8c1e6b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b695e2f59c85668e3d51fafe439405a5

SHA1
b5fd2ccbc0c603778c415ccf3ea9e91a20181833

SHA256
bd8bf2bf4eb02123fae26f1a88f3e0ac02c22d3b559a90d29527fa90e32528bc

SHA512
92973562a70b826434f39fd0c82ee210a77f4680396b74099766aedce37e8cf838763d29bbb14068c367dd902e188750e4d6ec21e9c786470e6b7e60e7458ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0c0eaf199a47509957f45ac180512bf

SHA1
1383f97d0abf34486a1bccb8a4f77e42710beb82

SHA256
935a90964108f7e8dc8ca76d6103e1695188fb5bb880ae6cab726b85590a285b

SHA512
5cda4a6bf55a9fe96bdaa6f73ebb328efdb7fab3be1eeccac380797340e85ffca936cf696b9784fd65a3f2f5d8377ac070c4756b00691507a411e1802685d513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c9905e388a655cde028f896aeb8657a

SHA1
9d6beafa191aaef330c7eb1d932c0b9d00b72065

SHA256
59e466353b081adf8553c19742501c33584a1d67326b38606f05e8287719ed95

SHA512
0762d9591c4494d085e8e70cfe68f3e9445f2e6f91d967e68096fef52c5e60f09570ebc6da105936867306bf04534c6e4ab0c62c4abdd1b577bbe0896444259e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d97db6a93b24ca8cbcc8db13c6e8a89

SHA1
a2c3551f10d6c7744911e1128bd0fcc936a114b3

SHA256
107e8bc635ae15dfe2529b5287f9aa9ae0c2fd903c06ccf85c9b4719dba5843a

SHA512
e1107b53f57763223793fe5a7a0e59bac9209fda71f36f680e4677c4be5747dce8beeff02f439ffb0fd79391110f1fbdfc61aa968554c854e27560f40e6a57b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae7c283dee57790aa2c23abeeac5ffef

SHA1
4897d1adc6a2ba8305514463be360f89b3a4438c

SHA256
02191f86e113e2fe1e70aeff4b6562daadbc7a1d48badf73919424532767caf4

SHA512
d069c82019a09c7f3da9056575becffbf6a0ccc864ccb86c889180ee1566ce14384fad08d4b5a6ba1a4c9f5bd948bd2d5747bfc69bf5210bf7df111f85766305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4ef30b4374ce5a3ef5761acd2c317a

SHA1
06e0094b2afb40a92fe33b8078b109c3c5ab059c

SHA256
1f97e9ccb6c9105d1cd092be12d98b454814edbc66de5b02fda54e4e56336f6f

SHA512
1e2f46501f9422731bcbf51fab590e653f8d696b52b2d9794f242b61b8cebec0eafdc4ee7178f06cb27d8e95690eac8f6351235d032f99fdf5cc6d82615bba9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c34464d26f93c19931f493aa1d46218

SHA1
344669cf965ccd10dc31db03f348d6310157704a

SHA256
d804dcb062a71ecf843fb334dd32c34a1314c8571806386918081f5292e00ab5

SHA512
4380b31ed775ce5b18b3036d5c8f2f6d6975a245fbcc951333d79741aaf0931fb2e285ecf9bad68c488e7eb89486065b905361554ee69356504001ba860766f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11A2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit