6a4acf0f800f7d50923f5dd17d29d310d54d9c9b43f546b761083525da290236

Analysis

max time kernel
119s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25017502e91bba1fdbb710feb2c01c6e.html
Size

7KB
MD5

25017502e91bba1fdbb710feb2c01c6e
SHA1

b29ad17b475f05dc253d59e26fd5aa4029016822
SHA256

6a4acf0f800f7d50923f5dd17d29d310d54d9c9b43f546b761083525da290236
SHA512

f8bb5dcd9f9fe247515eae6e788d22c74647b8d4ff23267d69e031742de7427a77bb78146c3b441fcd9069a7738ec11afcd8175f5752bb5255e84ce5a3bb0463
SSDEEP

192:Tmmgxds8iC9ZYT+3jJSXbmWbrsqEIC+LJssJ2ZITKmj7F87hmKUuk0QjUVgUETvK:S

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000018b0aa86eee3082335b411a2b8c68286b0d4d79f29190f26a5a85daadfa90c67000000000e80000000020000200000003a4d77701f844bba04d5f864194efc2e6399c22d0231188fa47faea751a74ec520000000f16ee7f52fb09a2f4f7ef035737072ed784948792e6c3178ba79d5cbec3ed16a40000000b6f40396ffcf4668e2e209f470488fd8bb00a26162f9ca846129eb4dbc3661705521708ee43a0d1685d92d2f6a02e26415e4cb4ef1f6d79fa524204db010d0cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE92CFA1-A903-11EE-A0F6-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410316303"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f71aa5103dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000085e97340dc53d2e108d256d7a2dd391aa791837a5a2f2e2c11af5b3157ec8a4d000000000e80000000020000200000009b27fd22e7c9677526d0594f24c47530b2f21e034db6adb78f8e6c2c22e8bbf29000000038b69c60948102401f9db8cf07271c4b4e1c8b758a433b864ce93c8e6228b6e8cd2e10371682237ddc5629d1fb9eacb520bb173dccaf1cc8723a28ebc7acfff037bdb845a5f10a5335c5918ad670f50e529a71b0b050a5cb467e95e17652f42348fdc24a9e0d8954d70cb5363243b6e65229abca1239f8581b951b393eb9b6b457fec695b514a0a34cc4f1a56f28445b400000004180ae0b62b72d5d457931dc35f8f0b4ddf083b798bee8ffaae7a18ad4b0dcc9b31ccbfc208388f094d5f3ec83ca20d2b5374b3d40c90ffad3859529e5c207f7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2908	2168	iexplore.exe	28
PID 2168 wrote to memory of 2908	2168	iexplore.exe	28
PID 2168 wrote to memory of 2908	2168	iexplore.exe	28
PID 2168 wrote to memory of 2908	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25017502e91bba1fdbb710feb2c01c6e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80f58cfb06a5fce7f320eb0851dac61b

SHA1
5f0f116dc910657840da0aa6efd743b026363fe3

SHA256
d8567703535ca0d4e2c213d47f2677c6cdc209416f0a47b4e63a419be988780f

SHA512
f9362f782e4d504b4db1ff61e44eda6719f426c613f1ce80b508e7a03b0cb33abbc8b202a9413317e993e830e6d10c737eb75e19eb225b6d16d8e0baa79f282e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a167a77404d5eed0b435df7c742804f

SHA1
751d172007edbbf9ac933ea45252b50c0941aa30

SHA256
7e3a5c6a37195e3c0ccf20bc7e1aca8fd2d431bcf0b275b5a1a43148703f7a34

SHA512
b298aaad0a0fe05d36017b9f7dfe51f66e96f7ebaf6a75f6bbfab54e749f6cb57036fb30d1dff2bc0ac4f1b82bf01cec771632dfe7df7fd45eea72ec5bf8a95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2840a3e9f5d7336f8a1fa8220a80b2

SHA1
3b75ce60f1ef9f5afa0637494b0738789fb8f697

SHA256
30343bf6be5ecbf9d55356920cc50a79450a080c982e3706960ad83c8c860cc6

SHA512
b483d21a766a54b81c3e9a0bf775297f95427b391d59858be6e988843d8c932d5814141ab8c41bef9e7c1fbdcd0b8e067679ba55c1a429aa6a45c7836f10739f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
296b78481007b34133fe156fa282484d

SHA1
62eb67814727626b4adaeffd36cc16d08b665103

SHA256
b1c91a7aaf7175b24f409abff76afc7023f2d64b47cdca95d705cb8b7349c4a0

SHA512
3ff2a8d8f31a2866cf4dea316a2b7de71d3276d6f34da13320ed0705345441eea86f44f778a502b4feff3b8aea3e67b466bf6c39b2d948e96ddd371af72e00f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae480610cfa4b6a2621c728bb8baab2

SHA1
5fd8672751e379428267fecbe6c606b0bbf2ef3a

SHA256
fcc862ab03b04e4b267a2711d5dd3c91425042bc725655faaf9d5e91cc026aca

SHA512
acae95c447bfb325ca88c4d7038dd1dfb3697ab868d68ea0b93d28ce1b2da4673c2ae90ce55b93541a7a67f3590aef55a51b9c7a3a603babca0a330942536a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1599f65b4262f16ce89d65a7f2f750b

SHA1
e601e3a7a1ca1070a4bbf3f454315af09f473fba

SHA256
4d1f565aa7615a683b6ec0a768e77af282bb783d98e54444a933c4769a17c325

SHA512
783f7739e4357a2354bbdd18c6cefc4c37d3fb635aab99169de3c1ddb9bf6845ad261db89550ff86ac35851fe80ef3654a5f593ef2f673c96fa6ab1d31f7bacb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
972dc8d7ea8c589530851fa4c134cb42

SHA1
6aa6c29c0a372c649bf627e2f32dfba98b3f4a83

SHA256
3b3d4be6774c8dd34d656143b419b99eb13b198d5154220bf5218fda4fdda216

SHA512
17b974a4f2ff2c465152327d4524c4dfdabdf562f4119e3d1347c07cf377525e56b250508417b41189f67f1e59f9cb6ef7457d19892066dc1c59a6657ee31d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76f01f13d26dc7d31c87b099855fe2c2

SHA1
50eea14f18db6dbeb753288ffa261cf8525690e0

SHA256
f1af4c366e1a6a80927f23b1ace7e50db756473f8afe410881fa4472ab2cde50

SHA512
d89dc42e925d5fd9e38d6345a2314eb5b2f2cea71a4a2b4253dafefcc6c67e4411e9b4d09532eee0f045dd8896c4ab79376c527a05fba624dd9f79b3c38b0250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe19943b39132aec5eef0250808676e

SHA1
c026caed34c6877e0a9876e885d00a0b6c732dbd

SHA256
6794f031640e258261a5c4efc504cb7cfae2f0d58c72043cf1a8027e97362cbb

SHA512
8ca723cd75fd1f754206dcd87c1e726fcf8ade211ac6c97c402b5bea2b2b9eadc2cd46be87593fe84cece553ce9cbffc8273e673b081cc2c4a36d6584236fa37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D18.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F4F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit