c606a1aa12158ca48243f4816ad0d2c9e7ea1935ebe1a0827a16c8a14b050304

Analysis

max time kernel
117s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09c6a0242227ddae61eee7e178c50e33.html
Size

35KB
MD5

09c6a0242227ddae61eee7e178c50e33
SHA1

6b4c06e2e7c6a35905679fcb1265b7d28fc47a6a
SHA256

c606a1aa12158ca48243f4816ad0d2c9e7ea1935ebe1a0827a16c8a14b050304
SHA512

e7503c63da89a8b0c999f1c648cc4211432ad6f012460ec38d2adc49d4e9dde48906fb31501fafe77b5d07fc99b56b2795f2b92dd8936ea3fe2813254bc8747f
SSDEEP

768:/E13pKVAqnd+qq9o7B2sG/SMqatrXfdA2SbHZT:/E15KVhnd+xmB9G/7rXfdE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000675922a21d338c90857e3fe5f60e242158e3dbdf3b820e02b836cca33bd1a8b3000000000e80000000020000200000009c2cecccd5505119b37688ca6de3d475a72355d6ef1a6d504180ebbda196d447900000009a4f62ee7bcf23eea8584e286d5d1c78517c131f9c5f2c3b919be00080f10b6ff083972ac99d1fa0b8161ced62b8fe8175acc6d327aa6d487fc59e8a3f7a72cad289a892d60695271094520ce45a4b83420697c4bc1b5b3a06bcba409272166b5fbdbe3de5af0beaca00f1fe6a6180e7186aad4d623bac3ff687aad2ba2cdd2fa3fba0010737ed49c0f167b514e537c54000000098df4e62b96026c8e71ab1ebf69f28784b9bb5afa3d592d92ad1af5a77b8e1563053744cfcf76a5aefb413f2d8b4f9adf65fa8ba23f0985755b36b1123b6012e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95B9B911-A713-11EE-AAEE-523091137F1B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c359fdc71477d1629264e92704994c6e9286e53c982a320f6acabfa7cd0f06f6000000000e80000000020000200000005fac335e18a3f851c167d4cedbe1b08d377fdc1e42b5a83ea1b23bb274391194200000007d0bc9fb6dfca2d57e2fad375d787478815acb275a10a50dd75cd8888616c6f8400000007f3be2e6e6141bfed25b89f66c79eeaccf0e9a8f1edcd37ab0e75d8adc490899e22fc022c23994f8991239fa5c99b9d0187335ed8c3c35ca2c88c02ee0fb120d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b13d6e203bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410103187"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3000	3040	iexplore.exe	16
PID 3040 wrote to memory of 3000	3040	iexplore.exe	16
PID 3040 wrote to memory of 3000	3040	iexplore.exe	16
PID 3040 wrote to memory of 3000	3040	iexplore.exe	16

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09c6a0242227ddae61eee7e178c50e33.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fe89bb78538266ce860d340ceb776b96

SHA1
c7e920da2e8e78aaed01072f2155d4d9950e59cf

SHA256
36168b05d3093543ff28857c0909864b56315eb7e4cc7f1ede836237372f2b04

SHA512
66748e14fc05c4d5588acdcbc8d50033e84f5072368911261247d59c51f68e3036f0101ceb19f3d516958867c48fca60da264f3a7896fdb2933cea792c18352a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b05813a56a4843c6afc52dc8099c2bc

SHA1
22f190865bb8bcab831b8072f3460b70a594e1de

SHA256
47d2d5d0d6ca8ded37bd26bc8e48ddf5f7c1919bd68390d791dd4cb012a532f6

SHA512
07cea1658ead462ea1cd54c61024460fcf4144645fccef7c98bb1ebe9a2122144ca6f78ec5a1d309d62e327a3c69baa890fdbc1967938be403a7fe9bda32fff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b93d1f54591c54c4682d63c7a2d1b299

SHA1
56dea1033f81b2096e3273d87dfa1cb44ea37073

SHA256
cf0e2d290fb4dedffd04646bb71011d278554b5b5504d0ec8665ce6d42b1ac6b

SHA512
e61e8e577386d4b5ea62c757e880e71cfcc9d6dcb11c74334625a40c6b0c233a932156c01ec8077d8d759717b26796a00ae4773fe07cf3c057bb796f3e0a285a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b32bf819c7a1446b8f6a872ffb8707a7

SHA1
53be56804f8de93d8323e7db33f9b50a38412513

SHA256
75bcefc888500eb83217695bc10e1c1d4084d16f92ecd219248d98b2a8036d78

SHA512
81252d3b4f4d42fa6f0590d3fe9e2b778e5abaef54cdcf1e295a09efccc061acade02466f5f0112ed7c256bf30c9a38d2b53beaabfee8acabcecd651344516d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caabb374b840c59fcc15893cc4f0d486

SHA1
ad04dbace84b6ab071ef7091098309657b7412e2

SHA256
cbcbc5afbd5ea11392758ecf7b9227fa61b39f7780c44671cdbf13d59ef0daf8

SHA512
7de73330a715ecb7d89af48b8e1bcc2e9f2b92bf0082021691ff31388930fe30af55c631a321ae25b858350f5f1a5481aa838c492f01f0856435ee70fdb0fc34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
601efc46e86577c8f8a97c86f766f580

SHA1
320ae7c61d276a4f160a2460f155f023fb162250

SHA256
0049f6b724931ecad4f9f8ada671ad40fa5cf70694453474ab05375f137ae2d8

SHA512
b62cc7aeb0de3efa992efec9a3936ee40745b509eb3363c4975dc47bcf85d0e358675e5b2d5196c4e6a2d043badfc5f7451d88a5a8f0ae966558ce37f56ea9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7516b6a32f2dbbc09701db74353dcd0

SHA1
a96627ce9115ac5399d270d076e56aa21a6570a3

SHA256
61116de6bb31fe2c5ee165de2e921c4fa716200e4ac95a137112176a6e314e4b

SHA512
f35b45b3688b34b25a455487da1263463800d669ca91d27035e1724e9db8116723c6a1216c9c6feec2b1081ea48b9ea3ce7fe935917988ac647cb72447ceda87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d28840e386377dfeb52c38c167fcbe11

SHA1
3bf0d48212d7b16050a1bc86d6ba21349324d9cf

SHA256
450e9a46f1746dd6f3a311b8f6e1bc5714bce0fd131be19cbb1e26b55ceb5a3c

SHA512
38295cd0bedda41dfedf55a10c28904b7d358aae75e7a9dba678d8af02ab677d44f0d67bc43d40b6592b0d7ea6f853a37eabdedd6dde0f797f44f6d1974b6ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36868387fb89fdbba3839909ab0095ff

SHA1
14a096de424e03a5d38fa6c90944e6f11e1a2d0d

SHA256
9ee4f3515c094384f81e337e32453cb868d1950d00511d13b11e2e362fe1da7d

SHA512
f1045899a529d26ca51a67d382e00591f7aa6c97782d8a37eeba7b80d96040e81fd663981c75444939dbb5274794a73bc4e2a8bbdfa33d1f9d954d685076e146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edd89a5b0663c314c6f3f0cc78a41019

SHA1
fd4648b48293be3e7248890381c991a60debe5d1

SHA256
bba81b8b2af9c0e416b4cf42088a3babf9365192350ea3f4ff8c8f993879a713

SHA512
99ea04058ad03e00c1ab8941cfba12d0c41d2d24e8f5712ca47dd11c0d254b662cfc8ba5d4e21042ee88a477844ccdb94831d38b4b0d59117704f6c944f21202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52ad9dd747c52ba45a11f99b695fa4f0

SHA1
800e1d8797700a52f5d049e6696b2fa7d4c2dd53

SHA256
a2d0b5b93cb628a84135617b64691e372a6172feb69d73bdee8284809175c5f5

SHA512
0d7b6c5b8b9969f324b752de81a94f65622ea427f0b2fce0f275866210f3d8eb1ed1e93f764b894c1609596f19e3bda3a014975cb6c88bffcb438e3299c9efcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039f09f8cdcdcc56b8fd85f0a93d15b2

SHA1
6652f4ed685907bb475fd4b02697da66d501b39b

SHA256
ebb9550c8193d4ec2b1a59579de15377242fec19c858b311a882ca5d9c5b73b2

SHA512
0cc8e3ee2f843a1d1627514334bf27af0c5aea752975f0641e92c5a69be8ecfdaf65bf99f50337931d186bf0889aff8768b71d125ca2f5d3427978326b425cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47051c4baf20fa59ab7e8c08cac926d

SHA1
e80feec18f3033756e2ac1c64b565e6ea5e74e09

SHA256
63810fc2d42f6e4e4cc0626fb275414db11d89f713f48577370eae38896198c1

SHA512
cd6e9a5cdc9a65ef5fa57e4031958622aafcc540430936eeec9f4d6198e80a1b7302d0c0d5cc477bbb4cc05f16bf05d990414fdd39bcb1bfb2f4f2a9c78d6ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7490e32be2b99f5e331f5a99176a9655

SHA1
81717cda93bd0646a2e6af44c77d7bc8d5969b4b

SHA256
adc8d77b04af9a8dad68043ab0fc7fd4450acc9d5d170e780fd12ce8a5f5f7d7

SHA512
b70b2c3eca7b3d0ec63c9fdf1ca56c4b42419ab1e798d90cb92d151b73118c6d0c402d7c7368de6e5f1beca0ffe2c87444b747fd6a05a5c7c42f815ca7ecafcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit