60fdd38536f28b786015b0bbd9908dd64d857197c52a5c0158fe1d6d9cf93590

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2026c78f6f929cef9cbf6b1c6c58a793.html
Size

16KB
MD5

2026c78f6f929cef9cbf6b1c6c58a793
SHA1

a4f76a1ea6c8b0088f5a73a1ddb063a4203d526a
SHA256

60fdd38536f28b786015b0bbd9908dd64d857197c52a5c0158fe1d6d9cf93590
SHA512

a7d84ff03d7f0a70bd4c771e60dc9eb2863d32b53e696c35e871c691075e8018e96fd76d14b53273f5939c9afa0ec6e6ed971bba18d49fcef9e554d38a91077b
SSDEEP

384:FNwchXijaIfG9hLW62pyv9Jw4Kt9hOvKnizMVDQHqdziJqftSOAl255ulC0IZG+3:liGDUsnKbNoOzOutlwXz3xY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000058d12b0b27ae9800f5f6312a309003c81efd746af51529328b0c735df53d776f000000000e80000000020000200000009644086aa58b4e47e18fb8a2bf75011caf99cc27b655984a20bcc2522c0ac9be20000000c4a778e403875a83edf0159371da416d4825263b51ac0623f325adea535b170b4000000086015e27885340cfc6dd2dabdd5cef1c908b9be2f435079afeb7b8eb3ba13989d11c5d77f24a03c23dea6d65b29dcc22513425ab5a25c3124f81fc959eeaae65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C31A481-AB42-11EE-BF7B-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0beaf464f3fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ee883e99012dcb175d13b46c6fbc43c6b871cb375c21dbb0e5c399084899e058000000000e80000000020000200000006f7533fd3a855b61c42ca5cde5694892efa53247c639b53a5c0f8fa796c803aa9000000093208f188417302f5880ce8c57ee2cc366bc0eabb0d72fa0957b33712c6e5466b4070d99b378582983fc48ab2614fa15ac8175cccd239896d4d8cf8f49d655354159e9e022b5b63e48350cac27e0380e7bcde909e65913b6d8866ac9500954bc67c1755909e44288617eb69d6a5a6fd3bb89ac6b2bea858d7aac6f1b9df1671aa04f4824116e50aee0db414cf8f8ede4400000002b0de3c513b049e28caf73d2e19db35c7370541ea1970ea4ff78b0a951be087a5b39ff8e6ff828e2430d2a6284fb90f0c5a3b663b78a17bf2dc43c260d31fc51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410563117"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1204	iexplore.exe
1204	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2688	1204	iexplore.exe	28
PID 1204 wrote to memory of 2688	1204	iexplore.exe	28
PID 1204 wrote to memory of 2688	1204	iexplore.exe	28
PID 1204 wrote to memory of 2688	1204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2026c78f6f929cef9cbf6b1c6c58a793.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ff14ba88e8949fa0803045fb0d406d

SHA1
8d53017b4d263506b4d023077321aedaa1dbfc88

SHA256
8d972b32ebb9c9b5aad22325e745a8e3500bd826e2524d063baf253620d7138d

SHA512
074ffc7b427e1a7a35dd8e20f29bd7bf925743bef7729e74c9adb7b4ec25f18e130d13b585635fc63a22e7baf8ba02c99b29e147c4eacf97866dba98f494a641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
475c93c3ba41cf43e2331677bf997c83

SHA1
a4a2768fa81577072407e9048fa5d030e3c58066

SHA256
8b2dfeebe07f5304fcc3cec64db9802380d6050d5463c0bfa0fb221fccc3d38b

SHA512
ecfd275aeaf3f3730da816d20bfc3858946a890c933e2dae551450c113a24b7de1a22899f9343f31226ca8724bf96cb6363de8804a4c94379834b4b35ba3025f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a791881be4136b85710e2929b1630ed

SHA1
41ad53c2984495ee0048f73072032c7577e76be7

SHA256
86425b42cdae8a591d764d80bc4e56c707bd60b1b86c3fd84411d15e407d8748

SHA512
16f8b07e8301b3f7b5bcd4a9b21e9276f4bf39349ae229322acd300687ced2c79d39b83f951b2d47396ea567ba8ca4b44b48ff2489652c589dbcf030028bf0b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a59013fe15a50afb47f1f9982f57c1

SHA1
7e020981f6f5a2a561d68881d2d171068e338a63

SHA256
0676b9944da7000ca01c061bcfc22d49ab2103c62e6261b41633666a008c08cf

SHA512
10725d1040d768d8a88138d12234b13ff8d8a7b45b968fc262dd010f730a1c3423f693501e07cb245b384d48334e61d458bd51c3e95499a1cdcc2d22511c4b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf4c66553d8bf1784758f7f503b3ac76

SHA1
dadde4c3eb0d423fabc5727897a09c866cf3eced

SHA256
66b6bb20af2b33aed85b736d6c6771362659559d3114d0be964e22e704ebc261

SHA512
8600cb6fb29c1ee6984127e51e4ce6dd163c17ebbb9c3486a694175365c4fe50d3e87b850e1400f90e52ebb64616ad6ec364fb324e4905a9660fd4bf6c4c82ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
445f604d0eabf2aa79c7192ba271aa57

SHA1
ae1aa94f9fab1c8a09bf2c5d34cc7dad29eeb8e6

SHA256
66cbd3105db48949fcb9192f00919f4fe7fb2d7fddda288ae70f236c264a3695

SHA512
bb318bcf7c4b7177e2e77e31c578d12656ef3c53159040b6b0ce88c58c877f8bce21ad1224fc805dddff4b5e3d6e2e6198a9e3e74abe2be0766f4a2118c816ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c88385ac75532304e3fa6dc0fd4a433e

SHA1
4b9d3183f47140e6d8baf44382535feeecbfed83

SHA256
719a718d0dbe2f69b3559ae82e7791b7b7acaaccf45ae24b6f76aaf979162e26

SHA512
1fb1af94a9fe66c812537843f155d27b70644998e8d119fc262de43c71861bd3db36d90f6ca26a362d74435d05dee3651b001a1c2f3555dbc38900c4d1fc48db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c747dc3a96a31dce73025424afd77e2

SHA1
357e4c0fcc3e1c53b0aec4509f84e4b1ae6cb2f6

SHA256
ef03bf95c74110082fc725e70f57a6989ebca5ea4c431bf8aa683f4f0624f5fb

SHA512
cb6275fbb7c8aa4ce7ee733535a109e10500ca5954cfcd27c1c9b0b10a550d54b83ce6d8203f8ecfd897ac60c6744a40f254f946936172cd1d1a0e4cb8754250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fbde580b8edb73e9f0addf1ba2ab74a

SHA1
a402729a195d97d96ec783bebd83c7e517fff551

SHA256
4962b778c7e8ad3ae99a0b40e3fd49664d49362c44367702bacd1e966d8b61f6

SHA512
c5f774e65c0d119a3873f5728b007c368dd60efe8cd2a78294516b9e7bcd2c935099cf29798426705bc12c291718d664591ed8abc6915c2cabaaccd10c31e98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb7927a740580bcb926384557201e68b

SHA1
8b76c48e444e2b5d11ac365ad0097c6cb29f032e

SHA256
c6f16c01bc9c263e2ec64a58e2a3117ed5f666d4bbdf82f71905011c56e64c5f

SHA512
5883e625bfb33a4a13495bfe99d88090f7c7e348a3244a6954ed8b67550831657f9b9cea47b2eb0261a6e3ccaf6b80aa7c88a78d05bf7673029240049961bdf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47fae982d501a81c3f7977df452295a6

SHA1
46a3f14a61d086d993230cecfcbc227b19df95d8

SHA256
143b84e24989f4dd5cbf3b3309fe7115acb665afec6399cbe62718c94969a974

SHA512
42d5317e2064a5e4776033cea12c65bf50729d351d56d2a3d447fb828bb96341b82bd4b71115f876ea4528ecb08381a601d121f242bf59412508e763e12e4c92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe85383ed45d3a3e446b285670f244b3

SHA1
0a357e0a532102aa7f78166105b609b49777ec75

SHA256
c29a9110e966b925b6c9822a243b7ded75a98f9c32543edbede28b3a2d76c3ec

SHA512
2d78728d2fb7c1ec676aeb8936c37cd32724b6f2db7dbd75b1116767af9dc8d29326597448699c3c160e21a980450380f403f87943464615b703e6f39da3c3ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab71BA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7287.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit