af56fa9afd7c1f8aabda1635cddbc3ec0c9844e3e630cc3b7f202624e53b8a7f

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b6ecd294958163cd06c6f1dec89542c.html
Size

36KB
MD5

7b6ecd294958163cd06c6f1dec89542c
SHA1

3b702d8639b65364e4486391cbb6fd6bced157c4
SHA256

af56fa9afd7c1f8aabda1635cddbc3ec0c9844e3e630cc3b7f202624e53b8a7f
SHA512

7df2c5f1a21e6312a5c6046bea05971f3a0addd68533c06740b4f0c3b87583d7865f14be749c12e49e04130e0ab44bf4d35fe33c59afdeb6d77c568c43d22c0e
SSDEEP

768:VLB01GYfoWz+2+xAXBihPG2dS/L4Bn7vFZ+r+kOS2G0z:AgWyAXBMGIScha2G0z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412555943"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90bf6d376f51da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ba5f5524e0a5e4dcd379ec392a669693a7bf07b8ea6bab4223763579e0eed411000000000e800000000200002000000027edee5c6a0e05f5c950c96d69b6c7a0b172e2bb6837626bc4b6e47796cc5e7590000000319db1ac4ee83587a79890d5fc7f78ab8a98218bbbad3ed19be2bcdb17d78276e950251a691f0c3a8934e5452a77a59bf350b4f6cc8358c58b1f42d1b79d620b2910d783d34b23337434b4a2fd6349efbdc2a710eede66f307a54cc54a9a02589ab3e1558c3c52420f5430a49c12c25193d4ee3b27fa23625b51216c72fa88603e3af897b514378545f0f80c916d0d1040000000bf727c34ba28869d0ccc608856e6aa5451a4bf3845f3cab4e460bf19d611e321ed59484aba8ed96cdff05dd05f3a38f12f90def9cc842549902d0aedb5fee712	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6257B581-BD62-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ef9f242c703c3d4708d9bba1c26f9dd4b42db92671b083eb924c8082942bdad2000000000e800000000200002000000043eecbdf4ac58e560c28a0f92654329d26a7a1613c90f70524e958ebfb2959922000000076e4e5fc97145503bc91fdc4e19e542de3f551cf9a0707a1cbe0694512bd7e3640000000b47a896b03038b301051096ad387d518362f378233240c16bf8a77b74f93944b9b40f5e110b24c8d66b74280debc85fb4ec5352a2d46d833a9a08741e03d5238	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b6ecd294958163cd06c6f1dec89542c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d2a528295d598ed8d89f563b6fe4af3

SHA1
8bce60ed3da9cb0263cb3ce19513411dd0b72421

SHA256
c792dd0fef072cd0c6e74da49b35979e6026bb071ec89048c173d17d2a3bbd45

SHA512
c82869df6e4fa22de12ca5eb60a8eb61428e61d41d89799d7451a3e3c460fecb039ec64338aa390f7112b459564c43a440f6f6fdd2147f584bf56ec6c4093cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb37dca328e86831eb08d21fa99a87da

SHA1
a0b29ed4e98264ed08119445a76eabf95909f38f

SHA256
04017622307257f0fa6bf23e3c918a9b531afc54d677b9ca073e5cf5fe619bb5

SHA512
a8282db189b4f08632d866ba708a052a32a027347f32b7fc14641df5616912c55f21c48aae018a8d356dd92285c39bec8837c0285508c5c6a93d6f7d03ce1157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
169c0c5c3b5cf744dc2895909be45010

SHA1
994af2d11b1601091da0bf649a6173278c6cb970

SHA256
8117b8a76a523f57eeebf76514333c3a463580a8a021493d1afd2f102ac8c145

SHA512
81e515054ecdd35e4ed13b59e0ff7e31af132764b6be25b20371a037b710591e8b47c955fff87150379acdec1bf46864a1a3310e164518761ae9330fd83c6b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dafe5d39e8c70a9bc049d4797a2ba8af

SHA1
bc4bbe1dd6ea24214c9b5b8c09ebcddc5c91f90e

SHA256
d67b44d2847d91bebe39c660644934e252e0d11489e37dac4d804c080a584bdb

SHA512
fd2974133cb8a2ad31ff94f55012db00cf45a2185499edf05f4d40c696ce56380bc2b8554bb357666e9de7909b0aa5d4643c2dfec7419a8ad5bfdc7eba191038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7daa001288bb4d6c0232e0a47ee727ce

SHA1
99a5e2e63d9aa99368a46b499825c311b09ffe47

SHA256
6f3a24ba800903e9c30c34d2aae5b46808477e1980bd3acd5222fc9b35792c89

SHA512
8b8095865530c506fcb5a0112917ac34a0c909d7978596a43d444a776fdbb8619a23839e595c8b06fa031b8ed739110a7486d524db56a8f018b123d28976c6ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03a0be6cabace5e1989da4d176fbfeb0

SHA1
36baca034f8fd2360af487eed31a7a5a5b5d585f

SHA256
5bad99e406fbdf56a532c8d67c0204ef033124ce0e3f53fad6c2d41f83db54fd

SHA512
ed41d04ae33c2e0363e71b98e4a0bc2d62dd9e00996a291ec17183e819ce5d807641f7701ddfa6ec8f73d874df132b42b1770d52bfeba1adf3e8c6fbf957c933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d333d3daf6fe3c22043fda923fb7e32

SHA1
7788cb8dbe2e78aa35e8fdadb051fe126f6d82ca

SHA256
1215c17b9971bb5cd9dc470bb5b9e180a19fed858b180499be01c5916eb53e4c

SHA512
7d51a866db50bdb99ad779ff2f445bee6b5ff79c47f7bd6e885a421931e17c20b60ccf6999e36b32e39102cca0d7f7a7754ee3428356138a461c68626eb50f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2244d3d058ed016596c2f5a96c83492f

SHA1
a1f287fda2859924adc30eb349648f7cb57be1ee

SHA256
0077078fbf9291533d5945ec934be88bb8ef74cafa9c3a0fcd0888d6e11d53f4

SHA512
7665811c096e6d3f99c526955fd483819e9524336793f8387f8686e3a95303d575c52969e8993aae8fd714c7b85f5e442336e5e2577a6e66d7af0b9d2c041951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ffc7a09961af5ca824edbe50d499b7a

SHA1
d224e8240f0518aff20566d047154caf47eec105

SHA256
843164bc83897c46e174fa746f0a7bc70016492f06b1dfc7446aff298e42e4d9

SHA512
6bf9821283782a33ac6682a414af88bd3fcd30e431dbdde092dc0d12f9f922c208558eb61da61b7e2534b45ed88ac8f8c03b709b0ada1f3be865ac19873f6200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba05762033bfe6480b95781070b5bee6

SHA1
9c44f2f455a10ec71340e2399165591be0f0e355

SHA256
c064cbb3ff56a0eb0b1695259718f37eab8eee31009d0bde439c2c90d68be8e4

SHA512
6b34f731e15c936dc0969127511572b135fdf4cb0c2020b5bbae418864518567385a9479db38f856dfad1c3c2a6d95a8a7cc22d8b2ca7498481b146fa9ddfaf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
713d3b1015d715be7b6dc02bffa51d1c

SHA1
0c6baee4aeaec4692a10787bc26f1fcc3da15c88

SHA256
db1067e6717e3b373705b9bebaca747d46ff31fc089598814fb7754aff34aead

SHA512
7229c54303d1e413acb68f96d0c37d326eeef46396e97dd3bac27725f3db23d48caf7fad268e8670aaad0dc66426c2459380e6fe40bc941c28532623c18979f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF46.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF77.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit