6a3788f1bfe7af56fa3282a6083a94e0c1c64a7544f0d2cf19c85db6e698df03

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20f8c6cc539e5d0bea950ee503919083.html
Size

5KB
MD5

20f8c6cc539e5d0bea950ee503919083
SHA1

a4d88da4f90d142d5b1b5f3dc668f956e87825d7
SHA256

6a3788f1bfe7af56fa3282a6083a94e0c1c64a7544f0d2cf19c85db6e698df03
SHA512

491c2a1a35f3b327530372834c770c09d84e18787cd7ec60514b13d68a5ff6ec7f13a74e631a581227c2c580b62efdf21f96abd640ce8f74baf80dc543bee1ca
SSDEEP

96:0M3ew6OQpOf/OoFGVvPkFk2TwOF5LzqWnSwpEWFzS8Q9:FeOQpOf2zb2TJLLEu2T9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000993467bd3a3cae8ce3d34c2439e579a9b93931ecb784986f0347db07aab419aa000000000e80000000020000200000009814eae47408551f04448062d52deca508dff5980da8e0fce8d8aeab63e98b32900000002f3018ea95b8389e15d3a4b76ace03053bb2c10225a66864b8a73446523c2d01b97c522ceba7e5c77c0ad0ec61f371dec1fe44179b52304ae0617bf5e27b8967d94a42d61e782488e1d659ea7f4c820e4ae41fd3260ac33a720679774bc7065908a03cbb94a84995378962af30c4389f63fb401e7eee99482bc51e910d58304e641265b324166e591706126f29f31eef40000000d6e4e06665ed531b6110b6a5bd35d75673ed5e3fef435b645f8a9eb1770eb7fbcc927f772fc17f046d493598b681ffa4b225e35cf056a19fb057be488769d5ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000480434dd73c8a7cfbd1d8baa6c35556122b8a7ef5b3ebff0466b921a00328744000000000e8000000002000020000000d18a6a1054b9b0bf12fa60a6b668acd6e4f72a06a37e1c543d09eb0d6143b5c120000000d3f16cb0fd74394410bf0fe0f403e8027cab73893c0b391d4d5aec449540cf5d40000000f9f7f07fb821681959fd746b66662f1ec20eb6d474feb3d6355d2c92268f9c33e4dd3ebdc3ef4f1ea3ad5f5e6e6abc142fcde4b7f3493f17c8e11e8d84f38083	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410568451"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05441cf5b3fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFA8CAE1-AB4E-11EE-91A3-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1572	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1572	iexplore.exe
1572	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2468	1572	iexplore.exe	28
PID 1572 wrote to memory of 2468	1572	iexplore.exe	28
PID 1572 wrote to memory of 2468	1572	iexplore.exe	28
PID 1572 wrote to memory of 2468	1572	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20f8c6cc539e5d0bea950ee503919083.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
172c16c36a204abc7f4d552c11e7ec40

SHA1
4458e9d7f2cfe5d3c24ae340b73d0ce68befe4c9

SHA256
88fb4f90a65fcfd55277dfa8b5797dc7615e979f1f8f30abde697548304ad7b5

SHA512
572db4c7f792a5552b1ce6a0bf550daf78eaca3bc866b7c2e2b147c015a48244d991f9bb89d212676bd2d8bebe6c3f70370450a59f4d89bd254aaa251c0542e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ee65147bce94f6be391ba0001da177f

SHA1
b55e1c8fcf2e7a4e0b7d6d89050c10a46bb475ba

SHA256
06899f77226d0df38b4870799ad73b6fbd787292dd795ab7317fe1a0f0b5bcc6

SHA512
c85ccba34ab5dd92b71979ea7ff410e453738eda4211a2ccf318026d38c5c37eb83266928ffff144248d5f272c4617bfdcd916f749a3b579746c15999b0f8556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b85bb369cf2ecf3c3bafa05fb4020de8

SHA1
90e8ab7041367b255f088968de3e874d26e9ac43

SHA256
200fc686e2716e24899fcca22a788c9413a1fcc82af09983eb67b7f8e23ef4cf

SHA512
2308f8021a32b3c9f8c26fe869d5db6feff7a60a8f2be50c1b91804173bd440245cb25ad17201f149a2dfbfe4d00f69835ec211a3057b1536b33f2c1919cdec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b959d1f85a21534738c85cb975f2dd3

SHA1
49f713f227f84db2011531ccaac5c3a659621286

SHA256
5358c65302946545eea29098e640ec092d4d40f150f4fbfefa386ef2d0ad3b5e

SHA512
85a6e746503c02400713ab0e6e7825a1fd44d11b2695a9a668d9207bbc31dee95d4ff7637b32f517ca5319e875330436ac5671e81706dc1f6a2b5381edb0d670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cca6ae93f499dfd7ed7eb1409924f529

SHA1
6600566e9c945d9cd7d1c9c5d983abf6a0b406dd

SHA256
196ed6c25ba785924078defeadaed59f486d84858c043d3b7994355a8dada982

SHA512
e4a810ec400680f9acc398723b5a0838fd9aad4d19a2fd6bfbed88013d38c8be9b02dc97d1b06d6ea8ff879562cb184d6b5ad89ddf77e2f0bf8efe1d2f1d717a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f619a5f42b4875dfd7634d901b542715

SHA1
05db15342d8b6f5febca3ec5eb68b558599c9ec9

SHA256
cb04fd00155268468694f7030371801018f0c9f044335c8b379f501482051af7

SHA512
6c201ff7a6e9fe028a65bd776fb7d1dbfbbde6c5c2d6fd22359f570afe54d686a1640a8a2f145cb2da5409b11e8dd072f29f6f6843234dbd70a7ef6561a6cdab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b87028e805daaedc9f2bc3e8cbda73

SHA1
8d8d5d0ae122680565841b89716c285852cd7592

SHA256
26196245b21c4a2b17ca1d1f17cb240664999440931755b74b6f0f7fe7dd50ae

SHA512
02c16cfbc66eaae4faa4795fc8b2b01e9391a6ca88f0c79107fcd7c9bec0da8ea4402a748979a080f3f216fa2c2252d8cd6afb0056d3140251b3779d1ec608dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ca4bfd04165951613cb4a877148b727

SHA1
290bb8c5e4cf6f3e5d9c6f43cf066a7f348f4ef0

SHA256
b6e1bea7080ab214cb192b1fbfc32ccc4493a0e7dd0aaf0d5f02a57032e89684

SHA512
5f5f9f1921ca4bbca650f7f1f0106d68b26b5fd54bccf389cdf69d233f91faab4847f7952dd54ec7bec667aad7928935ba49a2726d2b5c84dd60a965b047064a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE312.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE382.tmp

Filesize
53KB

MD5
35b14ac5858ee6e7230ce29d31bada09

SHA1
b837a68bd36a3a5de6cbffd37726ef0a597da496

SHA256
29018054e3106087933dffc88fcbe95a37966e1129afc6671cfbb0fab40bb9b5

SHA512
979bd3b4620039f18cbfe8b05b3b9b2a1456d3f4b21b1fa9f82a00efd7b323099e592d25d74f90bea025d25a97f058e42a518487553261cf880ab46ecb9c1b93

Download Submit