e48b1b454b0f219707739e729d6bd930e914c884bf8a948d7d14b52d90ce0002

Analysis

max time kernel
116s
max time network
188s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06d8a38b7d2c9d6f8377b7a6de428545.html
Size

53KB
MD5

06d8a38b7d2c9d6f8377b7a6de428545
SHA1

5c5de82c3aa1b0ef0af4a13a39a1c92c9703444e
SHA256

e48b1b454b0f219707739e729d6bd930e914c884bf8a948d7d14b52d90ce0002
SHA512

92bcca9de2d185216bab0d2df110f9f61c5ef6e165b98fc5b88a5f90e1324f16d1deff5254602dfa6f3f592be2556322695b78b0bcf779c0fe37d134ad0dcf70
SSDEEP

1536:CkgUiIakTqGivi+PyU2runlY163Nj+q5VyvR0w2AzTICbbAom/t9M/dNwIUTDmDW:CkgUiIakTqGivi+PyU2runlY163Nj+qX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB5D2F71-A6E3-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ebda80cadc72b4c514d340c0ec74937ee12c9bea4e43e512370d63c42f57a01c000000000e80000000020000200000001e44a8156936c642cb75cb932a4a9e92c8cd8186247b609cfc42e119fe30e943900000002b1fcdd031f03c8c7585d425ce8dbcfa1c26de892dbd4ac41d13a877629478b55d8a5867edaf2cb4b940deca7b5b72a89b8b387406bcf2370f561076c15724875dd2193e81639475e0346af0530ec0d133f618def4c813f8d155879dfb186bf811d3d8b0f7cb3e2a24127971dba8e3acaebea285e69e994ba5f1cd96167b1b83927623596ccb28642e6f322b8506918c40000000e0b1fe65d4d8d33f9f639a27a898bbf70349da33d5bfb5bdfc0e9ea1cffed1312adef8f10f8d87a33b23b157b2705471b2b5dbe508611be5a476e0bb889265d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410082596"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e294cd5957a6a8318f872657ba654fd979ff5b22bd7e41735e366c03346076f1000000000e8000000002000020000000d29f1bf412b1dd6a92ab22ef7bbcae14ba7ce3b14cf8b73629f79cdbb3564e472000000060f1fd0ae1b2f159269f17f0b401635fe85be42f14d2a0ad17871d779e94d241400000002c3fbbc636aaaf93c304e331ba5056914ae3e844c707acd0f81f9bb207a5d6029dcf32f044df35e8332d41b416d7acedc2fbf57ed184e84a7adfb3875e656b57	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f5fe94f03ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2816	iexplore.exe
2816	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2648	2816	iexplore.exe	30
PID 2816 wrote to memory of 2648	2816	iexplore.exe	30
PID 2816 wrote to memory of 2648	2816	iexplore.exe	30
PID 2816 wrote to memory of 2648	2816	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06d8a38b7d2c9d6f8377b7a6de428545.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d6866768c5a79707294fc31d3438991

SHA1
18a668b7024c3284826d468567bd13cec59dda6c

SHA256
ee7db752f50d5b131559412eaa22608be25f232e07b1a05663dfa86be59a98b6

SHA512
a5cad412b9325cf57c253fcd46163715361c4230f238741d3db8004fa42e6eeb70349a871dd0cf0e7e852e1a9a3f7f9acc1da74edae7d4e55be97df464f90675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31fddb4e740dbf278d9701b9e65a4a47

SHA1
7066c0f554e99857a8141a215908a396e58bc2a0

SHA256
6a9d54e88e8fa0cdccb3c2c2a4d3070027bb212a5d81dc92f84e6a64143623e9

SHA512
e85a562031864a6337afca1dfba459b53e036b2ec574b715b23cf660149ecb3281d3c559d3d53ed188c8173e86cd8f5b826a282872ea5513f84066a0790a3a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd4012a8196a0a5fc9e03ca8687b348c

SHA1
651197275f0cafec0629177e1fa4758a5df4d8f6

SHA256
8c2441432e855336b82ed17b6e310da7fdddb1c16d801d9fb88f1619b6bd2e74

SHA512
6995432552e9c52683b4715ba0dbd8a9f95bce8f475d9fd677a734ba7bd9f3b58ce28c580ea0192a1eb4e1cdc841f72de367b66e418053901bd4b5c39458b405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78d4195b02632d5007da4c438f5540d1

SHA1
37a55b62b9318da995d171e1432945bed00e5654

SHA256
b4d682aaa006c0f12116ab220aa0e0441f837baaa95699cd40de3299e7835d54

SHA512
afb9dacd3d39199ba66a3ae6e543b7922b05f25fd1fe2251dae1ae09daf657d85ecb6edbc5290276718599a380b981be62c3a8b5f31a98efa8b66fdfcc2dbe7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e23a3363b3d6461ca2b36de49f0436

SHA1
6c644103ff29264e1fedde7faac95998d70ef7d5

SHA256
ea33aad4826fbdea6ca3bd5a1a5303f74671576bbaf900af551db775bb5d7fd2

SHA512
d142c5f07d12b32aa2bb821f5fc43b8b8c5af5bafd92b4e26b022a3d7bb32d84e0c49b30e7b8add1849ece3fb198fb0dfd27307f5de022fa1ba925ad2cb1f50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69f399035085abc5d2afbe65c337872e

SHA1
dd7a73e4bf3376d505e3b5a77a2bc862548b9eeb

SHA256
a47e4c2574f057b1b4a7332be003b0585fbbd0c8e4abaa51006cd8ea51b6b254

SHA512
edd03d012dbf9b5535b6864a3e57bfabade669d8ca04f435ed175a51173664b30b144c7384926f2066afd36a9f5d25ca9fa8f202dca68b47cebfab29ff33c0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc4c1bf68202130a35c472c9e9bce9a

SHA1
ce8ec55b02478628f4b74214c48357211e82d38b

SHA256
faef03ad8faa7fbb3bd6b00b317d5e481f85b586ce6838c9ca8174abd6517c62

SHA512
30a266f2c76439c702be1cd017286542e5c1055ec7d1fa21787e29dff38c1e414839634ad5805fd608e4a028ceddcfca7f79107c3fe149b34fed2299d4f6a7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c2838a70210b31291dd97bb6f1e7d29

SHA1
63131afec4d9a78af7ccd8f80a63371d66a380bf

SHA256
64387313768d5eee86b90f337c7f4a43294232876bfb2655847a1ac91a14f1fd

SHA512
d8d3cd21f892629b8646110d6c2eb043e2a1c33315a59f6ec9cf392fd459918d65788b7324e9a42cf026c3bda04667a736ec28477d191faacac89fdae57f6598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ccaf5ba34b744aedc1208111c83139

SHA1
c845a79cb6c7ebeb5cffed133052e28d25b14c18

SHA256
e3dc82c2f107f01224b4bd7c54041e60b32f68fe944540e58614ce914c48b76c

SHA512
53bef92bc093cbf8f131cbf35fa9840b966d2b15ded1c895e3069857bd6c0d28052bc740e7f12024e1a8bae17aafb394fe9e23b3de2b61e005863a4456d1a664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
430f269989715fb97d086cedbfecb224

SHA1
f206c77c0ccd7e774680daa50161d8f3ae6eb83b

SHA256
ee3f329490ef4aae08532a329efab13435f3b5973ec7ae36826107dca62728a6

SHA512
dc085dc6cfbea022ffb2d3011949d1a4384a2a023028a5bf8469b072b369a668369b83a458951637a69b875983ab19275f5edca09db03784edea15ab1ff45bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f69a774db29d9069839b21e49b94aa95

SHA1
856513c99b233f39260bec3b7a7d81c5660941de

SHA256
1c8e27df77c5fdc5a086c2f5d8fd32d0f25a3a19939a6c2123fe0dfbe61d2e40

SHA512
7cbcda375e4c48a04003eb90bc714f0428784b4e442af34bb5e47a874c7073ce6f46287fe372906351d72b6dfcfb73f78ee74f7a0435f63bd8bde80cae67bed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464b75b411b782990018b1b3474bf05d

SHA1
dd70fb7ea825703b7889e2b71d4e0c666301ddec

SHA256
c64ecc07e17b0ed42c6fe49379b0aa24b055f87216c54e93b7f955347cec5a74

SHA512
04f4ef4f35962027f9c8484fb2231b34e54a6ed0d4a20feefbb02acc3ceb674cddd109f7a75fc86d71fb4d55bb23dd2b4d719d16c6caaeeeb3d852fc70c6ecb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
276620afbf0c020a79923efb93673224

SHA1
ac93383a445e0ae9a63443b7f61d4f8c26a57c27

SHA256
622250e90fbb0cb40fc7bb2a0c1a3245005de8d19e83096d56e63bbb5489ebaf

SHA512
d1269c83a97656d90eae889c9e68b912938c0d117527e6dbbac830921a87b184e37b2fa86bbfe8938ac94e3a461b0690ad8367f61b7aef0a697db1b3f140e212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51f1ce0c635a981eba74047a1a299ed

SHA1
7a3c7ebf5d6829d01e6936da42f5d28d6e9ad57b

SHA256
1b46cceaba40736acc5c8f0fea0dd25a47368c8ec0c6ce00378489e1726b8d22

SHA512
d813e237efde56ad57200d3a0092b8fabae961ce14056d85d2b1a320c7e9093bb9281a5c46434d660d224313448061c054afab6217837f053e0263c529d1bc7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8d5c9a5669beb056e8880325a4a26a7

SHA1
a130ed3758cb182b3031545adcf45800fcf4cbb8

SHA256
3614c3394f0794231dc50bb8de6114ff9b587fdd1b5427b65761d74dbf5dae23

SHA512
5a0ab90e9e49bfa68b6c0cdbaf0d5b4ffc40de08823f08a5868ce7da4aed5bed0dfb76e193c6e11cc90dc88cd79c067278c9142f26dbd0f0d68a999cd9f6842e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\upshrink[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCBAB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC1B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit