46aceb2435a5a1d975a11a7ebc3b8c06289432d292bbe1a87330c30393b26efe

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1e6ae334051a08f920be44e909e806c8.html
Size

625KB
MD5

1e6ae334051a08f920be44e909e806c8
SHA1

ffda9b12da2e740d138fb8ef6796739d500a46b3
SHA256

46aceb2435a5a1d975a11a7ebc3b8c06289432d292bbe1a87330c30393b26efe
SHA512

2ffe0e3a01510f51eaa4dda4f88e82efd8d2b131e7b98ffd48e1f4226f561d54897b554a109541ea3aa8cd420de621d4db64d34088f18f127dcc01313c7f4536
SSDEEP

12288:IqYPsfdObbKdKIAnospUGr49rug48zX1rT3S+h1aha1AgV5XQa7yl:IA6bKdKFnoPGk9KgPXRLahQ5Tul

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b4c0fb37e49da4d10b65dfff7342a3be45cc987d863c7dbdfc5755ffdb276ecc000000000e80000000020000200000001794799c12b4c3734a637ba962a6c3010e7e670dd067926ddef0516f3a2dd01f90000000a04c5793130ad4537c5631e43e5c41b602c33a6da49df7107fd44a3d6d59168fc64b6fcd393c214ffc2e52b96837854cf72f615a5e949027cc8343d6a00bc563ec88befacb74634fe010860c03582abd1de2111bd0134b41ac1f04bb8c384c9523ecf39b2fb06516c56468e53e81ed62707e8e433e44ee375de583dae9c3fbeb6ed7ab196a82ec77fd5dcb417dc5e23240000000f24b39877ce26e101a4bfef6197c709fb79d59d337a8b0f84e443f6f0932ab224e37b1ff077f31831d9a12a0e14ffa04e7ec219162923ea325a1016ed6c628b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76AA9841-AB24-11EE-B432-EEC5CD00071E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005d112407177055467cced07788fe5c21325e4f94d78c362f992b99ebaa467480000000000e8000000002000020000000530ea3564920a5f88c04fd8634ddccbc20a89c1d0a9d35f70f5fa0c9197becea200000007dc6c18352fe338eaefd54dc94519ee7dd9ceeed45f8f0c27d965380c8fc90274000000098a571853ff0733e35205869a2d3b2496bad28b181c9e5af09783ccfdcbfea1f62ad0c860a4ce33de7f97ffd5450458bc9f2f2ddc5b0b0fedfe96a7a7c27bcdd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50784a4b313fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410550227"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28
PID 2508 wrote to memory of 1940	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e6ae334051a08f920be44e909e806c8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b3d06259f819f29ffb1538ed4d0c0b6

SHA1
f6b5254ea525845d58effb4d330ccc2e77da7f1e

SHA256
555e8321a7cd1b783f234a8b37e51c7461403aaeee10688315d0574124196f90

SHA512
00f6cd2cc9b2ec95ef9448724149b3a55a7040b88f98e48156b6da20ddae2c7f26d21fa4652a0ff767779a9066ad9f5480daa3225751713b3a1bcdf085d54774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d36d306acd0b864369613bb4e9a442

SHA1
d29f4b9ee54ca776a5224c28db5d84cf4b54ade7

SHA256
360c037589d30f607aec0fef1c46a8c33c7c91e0a2e0cef7268f76105c798c2a

SHA512
a27d07c3adc767e57235966bb255203c0933f203297ab012cc5bdb0913ebaebf0393caa1f9b15b2e828c3f9c39b4558884e5ed770ee06433fe41fd6eaa2966df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e862828f583a81c13dce0f7cf53159

SHA1
ecb1e9344689c2dcdaf40baf62df5ae403416692

SHA256
c61929ab167e7d15589201575ea88197ca73e57f9d1a19ab50577f0c34af7901

SHA512
6f303e6aab6a14184b408a1f446630b6707b4b9ff9b06bc3fb5b7a26c4075294bc0edb1fd824d869a4e63bd4c58fd04c1c07e5c220baae22141825f15d32508f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3cc22b060000a77ade11d5b4d194339

SHA1
7576fda61b5181b0d34bb8707d5aca1e7b826d87

SHA256
88095bd5c4f5f0d79d6e480ca169a628e37688564252efff5ce12b64a765b1d4

SHA512
7202836e60838742191398ffce89af4bd86bb618b1158cabb6ea151f465b15a9717bd5d5929844ea21dcce2c5efb4ece7238c94f765c83c497f2abeac5add1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec3c408ca16508b6445cdaa3af42940f

SHA1
a3687854670375664d8902f12f636df73cea687e

SHA256
b993bbafb1e5a04397ee6ccd2181c7cbcdd3e7f25cc1346a6088f180cbbff314

SHA512
5c76f5e0100bc1a7ee73d0d8f04d6550e1c47628eaad2629eb4d230d62a51c521f46464974bf94d0925d18a7b146023dad001d0d55a2e0a91f2ee878870ab809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fb85170830e81b78774fd4460407712

SHA1
f04d6664fb157bf9cc21d32619af1572380e6e44

SHA256
6e15fcff40395167271718f91d636293bd45fa21851ced92d2e74e10e0d4cdf6

SHA512
144ce4f29e44a86bf9c9f5fd635f476c260f328424dc0cad0326aeb19f1bab8a0d8fb6ea6af3a44c0702a7e492abbc3cec72d0570306316cef9a15b09d587bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8144c68cc78cb6eb77934487407a129e

SHA1
10922a27bc66e8b302828e215974120257b0386d

SHA256
f75830d8ed13657f864e9d80b75837cd5d4bb776982f2df488cc4ed345f69d1c

SHA512
b7a1a8d3fbc2d0281f08f3a561b708eb919bc20d6c6b8e9ef058981e132b9010787976dae21223297956ca0514ca3d0bc463741fcdd95f320b025691f910bd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79dc6d98f31ec8796afedeca020a31f5

SHA1
ac3b06be796653dda986ea432a3de42c3f5517ab

SHA256
6c0fac96a0952c61bfe401956c4da4655601b784781d38019f6ef0063c5493df

SHA512
d1045d3c1ff7136700260b1c55ad717136b287a291598e99f01a503403962486aa2948a850602f4a4a49812d14c50c1916e4568b7e23e716f5e0bbb232cf0be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db8f843a8d5446a0e720cc7ffbead16

SHA1
1814b37bfd8363af49a8c887e3bb241278fb14c3

SHA256
250945b47620ae6624edc98a97b9bc1335abfbcae6ac2d3bc52064da44c5c158

SHA512
28c6759da4f3dc11e8afe6bb88e6c4b8aecbf698d3d88d31b7f74ee16f63abfe4e095320010afd47665ffc5f52dd8d90ed7308df5b3bf184f0deec569192bd68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a9063a8ca534c5750dc53892378140

SHA1
b2142f921d3efbfaa63746581d438b9c8b87e91a

SHA256
8889f371639105583d2c08f00ad30294f9e8022edf19c61ae19b5da68099c501

SHA512
5312f61387b0320de84b420fb2889fe3488246b379b9a17f48a1180226b63666fd2b8feecb891b21ab7904d26f8d73db6b41f64da6486e3f2af4bfb8c0cf55f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c83927d2bcb6036a54c66ff676f1624a

SHA1
86a250c361a8b8a818b62ccd4fc143657a47b025

SHA256
07ba453b32df583324b7096ec6e71ea76e1a54f0a7030d2c0a36c130af30ada9

SHA512
912063482245b3ac765455387df62d4a5d9bbe9adbafdcb633eac1027548f21058d887e55ee4f99375c826bfa2a8f4aa0d4d322ee50e05e1abc9a52b0e998270

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3150.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41D7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit