be19f8891cd754e65d734f94150359d20b4bd0a020227e1347352673704cfaf1

Analysis

max time kernel
138s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06dd466ab343bbf8a92de66db8aa44d8.html
Size

49KB
MD5

06dd466ab343bbf8a92de66db8aa44d8
SHA1

120d9eb08dec7ae759cf2e65e341b7e4ee283d1c
SHA256

be19f8891cd754e65d734f94150359d20b4bd0a020227e1347352673704cfaf1
SHA512

b7f0e293d355816cf5f2b01bd7dac7e589b500200d0a3c0c6c56399cf29e4964d0459b557d772c1a4569339ab39a20cdb4c6fb63ab060e41d9ef856bedd34e19
SSDEEP

1536:SgprQyl6M475BzhbUXkh5Z/ZEuPetJOu505mDyjoyS4uIywHUf0:SgprQyl6M4dBzhbUXkh5Z/ZEuPetJO9V

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAE41F41-A729-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000020b1703ef95f0e046328d65fabdcecf6c9d77a83e83bc0ee03dfe61241f2affc000000000e80000000020000200000009af325f2978535e75cf96986ff7570935a1cc54234d4b3936dcf2bf37aaeb19f9000000027db7f4667b3d9bb71dc9b4bcaac6c066fedec2f20e128c156b293d890d5b6cc41dde4e6928d77205bc935c568f5f83f7bc61c22d4ad0831415bbe132b6912bf4e59c0dffc77d56c4b419ce117f709f99df4b0af4616332381264da49eea490974f10dad580c88bee05bdd4831deff97a658d8e40c739984d3eb66a66253bf1aa0f51d69b5a033b8bc6ad31bd92c50eb400000006bc92fc9c3922041d9a54f21d8aa316827e2e9862288346e4301f060484460a3b3de8ed545850ac4d4c895939943f63b32c58c932c4a5401c8918d6fee7b9d9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002d59453df15ea348fb8f72fda5e87965f8d694fb8fffe95ee5bcf7cac45ca9d8000000000e800000000200002000000062fad34ab07167d2f0015289f181a1ef5d5a8843ea49a10f1146309609ca8e1a20000000471b095fb49795bf069e31a1d28660eb26ff20c25cd4fd116eb4fb0175577e4540000000640c6af6f283e0faf4e237987ad378ffabaf072990c25d2c8019b92bdbed7006c5bd4e5a01cdd437b0ee27518cff7b568f10ce7fa966afce8cccb9767f3085b3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02530d0363bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410112794"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1404	1640	iexplore.exe	28
PID 1640 wrote to memory of 1404	1640	iexplore.exe	28
PID 1640 wrote to memory of 1404	1640	iexplore.exe	28
PID 1640 wrote to memory of 1404	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06dd466ab343bbf8a92de66db8aa44d8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7492b3ad5cf1ac427e51c84925fd4980

SHA1
25740ccd797384f6863d93dfbaf2fc74b331007d

SHA256
8579adb05969806057c776164a08830d37e73b3706fb15fb115df716b4b69400

SHA512
0eee9ff509d14881fc9e842e992e37e60c3bf01a5f57c4ba7075822c2bab8868ca1af82021cdc2968423bf805eadb3570020d1b4ff4ab3a2ca358463c43260c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad3f9eb6c3542cbcc123024d8163a6d6

SHA1
4c1d67a424792d7a213c3eac60241aa692e171cd

SHA256
bb98b8265dbd38751525c13673b53dacb5043d7613a973aaa3e12b0ab882522c

SHA512
df986e989eeb3ac7acae1c11c420a7ba197b6a3ba61149244e44342845d907bf67c9101232081c5ac3354c00101aa0c182d6b09234098c2c231c084a0d2b841f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf60b4dc5d009924b2f96391641e58e1

SHA1
2bda9fb0fe6fcd1948a469a2257213fe7dc1a9e8

SHA256
9e539903b43049f729664f8c0bd68b5e862c8a468db6b4130c0e0fb406975d5d

SHA512
1910e167c2c3f58aaac87b0b15f66b53a61ee26f45eebc8a00f435d7a29ab65b59b9b4cdc27c595f9555edc9c68b257d5593bea81ca0314f3f512dde2a406c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03e3244c5f50ee5279c7e0f35d98ea07

SHA1
a8bb54a6fe5246f5488542f5b1b3c0fca21b96bf

SHA256
5a4902829886d3f17d44f225ecf49e5818d5aa3a2eed9ef41667f5c31e09a34c

SHA512
9b7f939a4935cfbd0736680a1d9d52f05c1d0a4097b5dac489cf6b941b6afdbfab772a3931333950a4c3a98b2e62aa7e4a0d5932a6e8d681d34744d68eb07d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d450b3bb395ded5a7c5c67c8a4b8d6e9

SHA1
ffe99b31ea7d1ddaa7e2ae3b19608aebe05a0460

SHA256
2c0a8ec915230c37a96afbf5d67941282e4730424c94ee40960045ef88876f9c

SHA512
aba7d3899d6eae3cea2b89ae014d594b46033431557e9d103e455d38a84d1aa188b261f500f95f9e9021dfe71225656d9b45f965dd4bcd226f72df6e9e827c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34a52b2610faf2ffa22fe290175eaa9c

SHA1
c1ebeb09a357e23335783bb1da3b0ba140699655

SHA256
2ff4cf83f5736e64137761f1ff0f2041dfef71aabb254b3d74a71140e75b712d

SHA512
379d9816f5aa7ab02e04a4f2bcfe2e9b27fae66dcb84c972f8efdab9fdfb09ccd92d3ba7fa2566fdf256c5eea6fbf09100679568cf995dbfdf964db68909f80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4834be0f4e6a2d61b3438349b482ca3b

SHA1
bb853a3cefa370fff43de3fa1687dfc1a68e885c

SHA256
a987c401e8b3155bdd1d21e469e0529c2d9491af222887de855eda2b1d837e84

SHA512
98ebd156fe9dab6110bbcde3b5f16e173ac39f562a33b108799797898730b514ed0ebcc9ab6f428b3c5cd58e15cc577d2294afec19404e813eac9b265b162f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d8b25649a52cdd3a8eee0f40b2f599b

SHA1
7212f1d66e9b30ad979f3c67200cc7cbfffded93

SHA256
b363bb0f26dc9b591ecea1bf17cdb103a56ad215c15c8fd2180e3c03a95eac02

SHA512
3014f28481c502d4810064e74970a9c0c655aacf3cfb8671841d111c3118c5299ad3aac04ab571b6a4295cd84850cc9bdd6cb231c0b7cf4596609fb0125430ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68a930dd36dc3de3f37ab1fda15b663a

SHA1
47c5ce67279d4c52afa5c3cd52dc509b3024f8c4

SHA256
021ca5b6960705e2cfb82bc5e3b0c9cf41abd6d282e08b0070922f38f3f481b4

SHA512
e3a2e7cc663e2804fdfb9040dd2385d956902499548fbd224259f86339da83f3c3e4d2d78183d1fc98133cfd0e7865d7267aa24ca63d71cd39d888a00ea95c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc90cf852f822a6b06517bd054b095e6

SHA1
001572197138754bf8a2824e96c598867c317e18

SHA256
3c1b206fe4ff003cc48153842949fdb08ddaecb3db1026af817cd62bece0f95b

SHA512
636ff6ac0e07bbf20f2e8efeaab426dbd70c7cdb956bee72455370cab385dea34639622f5d639833dd3e72a7993e57f91fadbbf9f6c3e347f4c232b4ff63551f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28ae15868ff1c7cec6560acd056dca0

SHA1
97abd0210c28e26869208649b22923d41f2c049b

SHA256
f349681817e371facecca49eb7d0878b72ce1053b18674c805f1932973341ac5

SHA512
efbdfd58084c751a90a9a958183393bae43beff4e6a92cfad7a34db58a5cd0ae8eb7d048a69f3dcf0fc43f21c1da0317f8875fb9023277a9b207093beb2786a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0698bfe00c0a4850e3b1e26beac7bc

SHA1
7ae6dd72e989fa01a0efc5c9f5961e1a29025e68

SHA256
1b97b68cbfccf1a5dc479ab4f494bfa5f8c31746a36691816fd27b07fe2a503d

SHA512
93b348c4e56ed21d0b645f9d510840ab24742c8f2710b1b7200b614945f3e68a222dea6def0b26f2d0133c9e9ea5b5d2e42d6603c07d6a3fc7c8e5865a4d8f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808bbb34285868aa9ed9c97d9323275d

SHA1
f71f20f583b194e6e4a4543b1cdab9a82d77b1ab

SHA256
f5fcab43ead68b7d7279c492ab992d85a0bcdb9459e31764ea9c14ba125f6922

SHA512
2543f75b42c2a68a304aa25465ad0ece0844a07e1f8696e503d7dac80ef2b99591bffff6e85c0a04642343af38ac5c77a7486e17ffaddcb63cdf9b88e40ba917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2784b8ebb5939eccafe4096a385ec34a

SHA1
7fd5f079535f936ecb64f8fa1bbd5f2f35af5497

SHA256
1da45feccac2c9d3d163c8d6f0f3217c01c3ee3240cfebe46eadab6ff0b22a59

SHA512
14fcd2267f5fc3511f722d67e488da1f43e43627e24628840209d7bca3e80568068d0513a44917602e192e28cd5de159ca2b8b8d6cf28350300757253da3e62b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883ed9f22a7d2380a2631f87acd8696d

SHA1
4f8ad1d08ecc6020f4749779fd9975a8995fc93a

SHA256
a35be074d5200a8d20eab3979489069a3aafa9e85ac2170ea908845e6f895d77

SHA512
7d71ee90d27f2eeec84219a2db297f586a12d70561934ec45b1d649011cf0b5bc225b23ae85f65eb13499c1f7bbd7f79c5cbe255dd5f29a10e41b67162b04f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB8E5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBAAE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit