e4cdbe83ca5f21bcdff2b1c1649ddbc6ea9bc41a37c0eed4653bf8a2ca660656

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6373239a95a1c134a8c1c8b73a620715.html
Size

6KB
MD5

6373239a95a1c134a8c1c8b73a620715
SHA1

2629d4d0cb37f6fbd2fa55de57bffe4927335862
SHA256

e4cdbe83ca5f21bcdff2b1c1649ddbc6ea9bc41a37c0eed4653bf8a2ca660656
SHA512

2ba89d2cbdc56b7f1d2cc8f298a9b2a44b1fec6e7207b339c138844f750f60b62d4278da229d905bb778c42c54ceedf2b527716cc1f32663adc212cc535071ad
SSDEEP

96:uzVs+ux7x0LLY1k9o84d12ef7CSTU9r/6/NcEZ7ru7f:csz7x0AYS/G4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411682819"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000150b0208110db26cb4f342bcf8d8c3aab6062b7e833bd8abfc31b221012bb80000000000e8000000002000020000000566a375c48413d4f01ed3af1b3c8c79f457c78fd6a5ccfcd030304f5e24ef70990000000f7507133885bdf6357da895028be3b1f75015d802e4b99306e13ae9bcc6bec57cd4498768ad97339167cb88195ebc36299117c8b0006a1bf8ee844fcf26aef50266ff6efe7ca078a481febc31c991fc43b03d03aa7200c4b581bd4d2e7a08cfed52f7d1c107c9be9cf074a0f363057cf2286e01c1219b562a2adfe16efd3fc5c641e31a83828a22882c9c6e65ac8c00740000000641f58b932702f17b0fee51670332d0481c7454203aa5f39201b5c915e04ff616f9b405388796aa2795fd88f4a27cfe88f5da9a446ba9a5e0244f08cd15ce51c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C21DCF1-B571-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ecfa697e49da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b1f13418b2e0db4bd3db319ea468a21d4fa9e8bcfdcd965532390c873138e17b000000000e800000000200002000000031e21fef69c8584a6c80e974e24b3b2976c4d3959c258469b203809ad35b917c20000000fee5fe8088856ea8cd133e49d47e466b5ad3363a3e497142fb5bed1d0a4dca37400000005af8142f23021bd8441e290dbc16cc846d8a1e054a57771de0378bea3296460b752e0d1785e68e22f7b37528ae5241c16ba9b3ef5dc0b541822423669a1f66b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2728	2544	iexplore.exe	28
PID 2544 wrote to memory of 2728	2544	iexplore.exe	28
PID 2544 wrote to memory of 2728	2544	iexplore.exe	28
PID 2544 wrote to memory of 2728	2544	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6373239a95a1c134a8c1c8b73a620715.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cf69609c1722921e63b9725053fba94

SHA1
ea60b337479da7a7f1bc0d6c2c87c1167a0d3515

SHA256
94bf042bd15dae167ded06ad8ab91747fbef35dead9f314233c703331d868f34

SHA512
a2fe15c50ec0babe8dfa685f93de6be82de6938c7056df984b9094c6e3650b2735c9c57b1711f1a50fd7cc5e87eb04f6f981c8fae64d47edce0b0d1176daff68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40132318e0bc14d436acca796c251541

SHA1
bab6d034fa4d1871e831deda52fab2a08b09f4e4

SHA256
02dc6fe9b280324ec90e18428a52a8f1ba6e8178c0567d973f9b8971330f5a51

SHA512
fb23610b60520104bedfd07075c8fdf301c0bd8c8f75423fd1d575782431cb081540348605b582c41decc1f427ae47d73e7e8d553c0fb8513e3352aa611b120a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea4c784d979c60557e776896760e8e9

SHA1
c480b3f154688ca181ea4402f6f35c50816ca7e5

SHA256
25d83f55f8a205f7514e28d22dbebf19311748f98fcd7c99a465e1c80d07db73

SHA512
18e03b68eac0a278c8d001250d1a04a10d9db3f1cb9d2626337a807bb286d589fb2c599f88d3a5d377e5cb839a7150e25bf023ddd4f4733bdebc2bb27378b6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf90e9aa492cf1862519afe56ff397e

SHA1
ed342118e56a4bd8efcbc448afd3be641d204b5c

SHA256
08fb00d6794b4e37121095ef2225fcae2307f59618c24da9a817bcd469b33b40

SHA512
0100e18b4a30b827457aff096a7da67f1a4cd045fc6a0bbaabc420f69c499ca7fef37e9269f1092eb9ee38401d47c2294dbd96d3bc442434d872be872d175cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c69fe59f0e0897156ef182a0d3bbd55

SHA1
0fa80f6b2e04501358f1b0be97cbe86d5f711564

SHA256
a0a93c3a177288216310c62510fb9fb00c175f6fb5c13719e67bdcf30e6e9004

SHA512
7a6d6941c8e95aa515670845556c09bbfb8322ae1fe182697ebd80bf28d3138657c6de8bd3ab4ee153015f3a5031761e2e07bd6124c6a11d07e3429680ca6ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc6361925be26556d0c2bc37eba29ba6

SHA1
dd46a8e8e731661fae4d532f0cae2eb1249924cf

SHA256
7decd0e244540f0587ad02b00e3e18f5264cad9c396eff1b46f38f69ca9fa0bf

SHA512
81c0b9a7c7b2af91b6c185bca64d62ce09c3c4eb425a5d23c27033b7f9d88b359e75d3e258a01823412c695c326e3bc264544bd2ffacce4351e3313d269c1b70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b48df3a1a3e3903eee42a63da969e3c3

SHA1
9456cf9c5a97a55a8e05741ae39b2977aacb9c01

SHA256
805d1c4272a860b660f8e8a785d10ff59098a374b0c957084dfa146a42035cd0

SHA512
2c0ec085b1131905d0330e9458b2717a9ad42bb7a9438863cf1ee59dd134e635fdd6311c29af6ed1e1dfd858313d3bb436de928fcabfb3c2a05d483bc144a051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73d0212bc4f12d45c901043751da66d1

SHA1
ef60f381eefaed0cbc813ed97301345c6f0c8925

SHA256
b67fca43d5c383f9cd74b33b4fcc2e1b4cad79eabba9bfb8058e2b68ff171102

SHA512
dee3334992932c5232a75022bf03724596efb3ea8ff477eae4bba7d8f823ffbffe709a96f89d4b9fc3ed8c51d51409dc72b5ad25bcfcdf6455b6c51aa26b4749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2633539f0cad3729f868929de100d1

SHA1
8b76c496867ca275d299fc56e03ba4f3dbaaf2a8

SHA256
628727dcbe11c2ecdabd798dad9aa0456f7d61fb9811ef984cd7bf2c5471a5ea

SHA512
7b5f5dec7d83d40355260303aecd5c9011773a98c0f19b3388ab9f2e1ba18f9b130d5a1fba6478700a9eb761b6b37ff6448bb82a0bfdcf60ee25334c5c071237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f382a9b3d3625a010c751542316a3f6

SHA1
789fbb1018c1ce03e9a699787c1f1a6fef89010f

SHA256
46b79d2ba45a263d8f514e059b1eb4a47a6411169bc7245bbf3dd26cafb36320

SHA512
157cb1f6c59a58e38b3f3f37002885829900543c94729e62fd3dc484a9e00f42483050fb9b19dcbd1ac1dee9b7e24ff11c11ad943af8ac6e982497afccf4767c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d4c774eec813167cf726812e4d24a40

SHA1
77111e8869a792c20eb2762d3fbb24b6f32961a0

SHA256
8d9cce1a62abce186fd605cb52b5a6c6aedd93be67735b6866697e54a044d27f

SHA512
581a3fd8d5721c3b6eefc46feb55e999ae546b9310a0eda87a48bcc7cb6e74efcf5bae18c0797ea779e92b39f3cf70bf71db51e6b2efda36506210f5d67bfeb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ac6ac287de7eeb6253bf5b7b2900c9

SHA1
844ac8268f8e768d0b4d01ac687eb6c64d8a3387

SHA256
e0304d337938626bfcabbf977c03cccded7a60a454e2269ca485c77565c188b2

SHA512
213501acbd43b52a08f42c457cc6526634531e0592ea08b9b953917278fdb1af7d25f2bd7411a43bcdd6ae166c0e637900aeb8fc43b45a76038d11a80e5ab8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74b276c2ee864fc6d50b012f4483b0a8

SHA1
9b1f1b05e411400a1f3f7b2c20297d2c9bbc3c86

SHA256
1d3a10fb98537a247011de2cf19b144c2cc29d035c7c258f628bb81619dc4c6b

SHA512
f422b63d88499416ab9327fa2f9b438f2bab5d350e8b37da2e0a0d3bdeb765e94e021946565dc1855c0c150d437b64431e49d16d05cdee832703c9f0c9ef4b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7C9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF859.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit