b6ec0a9aac3ed258602981fa591a5ede2114df87ffb5a9619147bc21ac1311a5

Analysis

max time kernel
136s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fddb6d85e1702a36c6a93260dbb70e4.html
Size

11KB
MD5

1fddb6d85e1702a36c6a93260dbb70e4
SHA1

c93567f84035b324869c29f47e805466c5ee71a9
SHA256

b6ec0a9aac3ed258602981fa591a5ede2114df87ffb5a9619147bc21ac1311a5
SHA512

fb1fdfc9ef13a0c5662be076346718ab6b71f6ba43f975a0b42c3739c3687797885979383836bf306bde623c51abc7423b976ffb300d71267e69ef8a5de1841d
SSDEEP

192:9lSoH617iogbf9mZQ8NGGiGUx4TUOHV/pBshnsVRl1xZpW4LMDHZTfLMLsZBsAMa:yoa1uog7eUxyLMDpLMLxAMHb9o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000000bb711b2cf67327ca836ad90fb62140ad2fa1005d21abb92fcb02e9781ade720000000000e8000000002000020000000b6a044996b06fc66bb9d5bb7d6f978d6fd7fbc6d39b664309202bd58db992004900000005ee0c1926f6c42eb6c95b9924f5adf5d58eed1b1b5d1c47669a282e3d6400b47180378511ebf45a6d02de2067fe541eb23cfce045c3ff099545dc8b58348b9c57f874961051ad01adb1f197327710b2f3be1c48a0acce79d36c8b35b492d6541c42fb5f070a5420df3142e9e3d2ce309f24174f968e231532579f5c566e89459a79858f74b692036a8291a0b752a04bb4000000096a4baeaf94353ea4358ce9b9a0f20bd954f4589f3190d9b219e1452d5e9a0abbb1e00f0d369697a02a6e4d30660a9bbabd61df7f4e4d0a1fab3a6d62e24ceee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410559703"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000592bb361f7bfab66ebf89d52bb59e506ea69ebe018cf0b688650b2e60b596c6f000000000e80000000020000200000000476fedad6c24fa5ce68e16547a0efc7da3cf57b69546d12005518f53c06dcd920000000b414ebb501ea2e660f1c8f1e111208581b7f5b5219506ccc325dda3474655fd340000000329e90cf39a7a3ed536cbaffeb967a305437c97ca7c9c6d2b95065f641669c21c84c196feb4cbd181e66a0df13f6c9d410108f5e40ed04e5320155b28d73b6ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cf9465473fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{859E3171-AB3A-11EE-B459-56A82BE80DF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1068	iexplore.exe
1068	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2148	1068	iexplore.exe	28
PID 1068 wrote to memory of 2148	1068	iexplore.exe	28
PID 1068 wrote to memory of 2148	1068	iexplore.exe	28
PID 1068 wrote to memory of 2148	1068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fddb6d85e1702a36c6a93260dbb70e4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f36cbb037c6028b1f17265ed17abf11b

SHA1
8ba18c5d0b1502f6c60ec80f559f057962c6fed8

SHA256
3022b6919f15b9c177c0a92063379f4fa1a4ce1e7adbea67a677ea61a492168a

SHA512
ff7b928f5f88f52a750f2508c6626c93b7e0981067a16ebc9b9f12aeac597c5838abbf493401807d1e4e9a11e46ad37fda28fc8aa0dfcb810fad805c82e1f891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e47d7018ac38a10dcfe7ceac4080c0e3

SHA1
4c44fd2c71633649c7ffd14c20f9238d100bd11c

SHA256
2d9a22da3d92423e51b88068f576d196f8ecafc38af140ae1025ef6197cc01f8

SHA512
aff9c0dcb6e6368677c649fdfa495e966672b67c238a7cc91c90acd3757a86cd11c30e99a2a7ad6482fd00ed437deaea53110bba181c9236211bac4c4fcd769a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
309f1a1a53d07a68b721eea8228c9992

SHA1
67f148ba1c45161eed3b3e1369eae0c551fe2aa5

SHA256
2688b3107563117ced97d4539dc272a8d31cd87e6e266528864c7a755052ecb8

SHA512
d4841d7cb4b8418a462155716919b670c9584dcd147fa31ec4635704e4fd7e0f4435f4d37918c6e09c505dcab2b37dd9ace5432402ec0cda98f460cff69f12c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c2fb9a166f2b41611969ec242e1edf7

SHA1
6695723c98c89d9530b18ac709c2a68d0e968545

SHA256
d7f0b290c653d26ff850fbcdd157d4aebc2db96102a6f00048f1cce32b616326

SHA512
fd190e51742bee6068ff5a6225254584d82c3c96a895b7ec8ce7f5933a2b7d6f8ed0d18891cf605d09b69df90faa7ff8f358ee236b4217263ff0f8b8ade652e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1722c28dff25213643cb5e34a4c705

SHA1
38b97503fd08cfd628029320eef48e2331862e4d

SHA256
b6e03b5d336d5ae4734889e318fa5753754988558c14c8726ce14cc6614865f5

SHA512
b0558c8be4122fbc9f7e3182fcd36dc4206c68014441a97696bcf4317fd3ccb00c6635310cefa7aa878a385cfbdf2b30e667cf5d696f0f14707f17812d11abae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7df2d41bf1b6a8166236360c1f04129f

SHA1
8915d0e023e8b1d47cbb20ded702817c00470969

SHA256
ecbcc51e46ac5895b66e80768c0ed36906b30eebe69d6928f16b97b0c5215b14

SHA512
acb14fe285478d387a72aa5c8fa36f0464795acc520b8f41e4b1d8eb92de4093681ce6b5a5cd323ef6a273923265359296545339609d3f069721c2987e784c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0167fe12bd99c8a47d69408cfaf2eb8e

SHA1
ed6695f1682b8ed2d5a41e639e616098dbe83234

SHA256
a3d9aae11f4a600cf010d29c5bac31d4eaa667d50116c18b7fc49ff459129970

SHA512
e3b9e84eeab21de0631ad85030f878a005d66d291c45574e328a01163b2ca41e487b4acabe1fdbaa80115966928863512ecd9c126bbf5d824b894579ceb8e186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43e9fc81f4a98ee9896e6fec89399fd3

SHA1
eb9c0c4934534c02946c91d28ba6c7ad98ca3e47

SHA256
bf67b7f744455725c7cb0dfea88506eea7cc5a17c138f20d0e3eb3fb71bf972f

SHA512
acaa6dff343d9aab52a924aeec9b581ce5b53256936e544ffa60ae390abc04af6a8724b66c95ae8d44e2308519420112861e86b364a4e3419c25d32d750c21c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d65c047b0afdd9dde22517ed55484ce0

SHA1
d412086bcb297d23a2f01e8ea8d46b51a4e09819

SHA256
6f8adac6e11e38353b224828bbcdaee3011aa4ba82c0f5a5322821c135d27cce

SHA512
0c1f51513a43bd29af894b8fb6c71cd13353b3b16fe911ead70a5f0c9e14b7f7d5582f0d2ee4fef73eb4ee996d0b6a1b027bcae7cde6988bb399cd340feb842b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3162.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit