e50a7f2fc287e93bf4dc2a4cc82abac44487222e81896643976cf44b330fcd55

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50984f6331121734f76a760e8eb43a59.html
Size

29KB
MD5

50984f6331121734f76a760e8eb43a59
SHA1

2f864deac8778ddf299fe9c0807e5baa8e7df282
SHA256

e50a7f2fc287e93bf4dc2a4cc82abac44487222e81896643976cf44b330fcd55
SHA512

a7587a20aef00bb3a2d354ddbdc921de3c7c576fa04996bfa8ae02063ec4bed386e70e8ea2fa4af477ac304b5d56613020a46749858ada2f87e8f4f2ac4a994a
SSDEEP

384:FitsZqDi0VuZZuDXRU3OahankIIfzQaXNvxiBRk/VSShTovR3yMCzCw92ki0LuZo:ekF02AmOahaSXNZim4+QdyD00Eo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{486CE7D1-A480-11EE-B696-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c9f0c8ce929e425db383d142849c5b8fffcba7cf822a4b5b304f3664403c5146000000000e8000000002000020000000635096f341a2d9d73dc05813ae015b9be9b52757ab6d7d642412a41c05e1fa5b20000000706d47d8e40b4f41bd0f427347950ac72506427a835ddeddec7d5a6230056808400000001bf734296a26878fb376a88b5113d9dd1b0a01e53427e1bf623ab95b9aab01ccadf6fd08a7ff649895d2c13730daa76d464e8d78f45fdd84db2b4108815f3608	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b91c62e0c5521bd39fbf724c5ce881af0979a976de761c2fbec11c57a7a68d29000000000e800000000200002000000096e047db3044f08dd2ea02fb8ab42d6ecfd6754495852e917050cf024657492790000000503e623c8104a7d07858b330fbb3e7308640fcf295188499d6ac794fe3cf18dc1b7a843805d10fd1d1e9e6f1e80dc6d9a0d45cda3c258f188256a445f1085ad808713e27bb68dc3ff58ff804c61542e40761fd1f4bdf089a13b8b7b6f26d0161c75c03039373591e964b3e85e9e4f8a5d70b2174558ee2fa57476be7ce370670f9ab23af0eb619f7da46f78219842f6940000000a9db3700350c7b11bb94e99542b500eed839eb00887d98f4725589c5c607874b5f75d2e13c07e40fb498ddf33deaa4e97109468b58a144f2067c900e98a4c5d1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409820021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04501278d38da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2140	2456	iexplore.exe	28
PID 2456 wrote to memory of 2140	2456	iexplore.exe	28
PID 2456 wrote to memory of 2140	2456	iexplore.exe	28
PID 2456 wrote to memory of 2140	2456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50984f6331121734f76a760e8eb43a59.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
983c1630eb8401e6e9550fc4c2ed83d7

SHA1
692a44daf87c2303411ee92a21ceee44a0edf164

SHA256
8e9613bf46431ea5e0019525b417c283b5d921c995a2617c17360cbf04d9e4a4

SHA512
06c345d01e19f452ea79c3bba9347318d3cb95afc955237d09fce8981a9c3359c466cd977e18268cdc7d513a1ecb9c79067895cb16eb85d288de00768c204dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc3071aac0d03d9b668e425f0db8f4cb

SHA1
4fdd4648710d5e3ff3f1cf60da1fcd254a2c3731

SHA256
6ece313f606c06a21e289e817f1fe8b8f66c9a37bd9e5e2486f5914744852b85

SHA512
ee5ef485b6ba8844238deafd59a4baecbfe81a21f84a9863d2fcca51a641f58e0592086e00802cc6dd05f24fffc56a9b3564f032b96bf1869cf7d0140deacfcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c2c6899218947beb25d61db5d492392

SHA1
1200c322262a95805d95cdc4f29888655d1795ad

SHA256
d5fc22eb78a72e4aaf318e658cd53efac465ad08b1e3d586354fcc684d00f466

SHA512
fc64ab9d8f49f25f0ef4a184c34126c265174d0cd7b72d58856627afe8b5ebdb9911325c1af16683687cc5d3f84fafcfd75098c915ff4ae61fc95e9b75448635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0af9364e406b25220013c2122226ee7

SHA1
14adf5a7b330d8025d4ee923eb8da2d541da259a

SHA256
eeeb5cffc79202c3a36d7159fc31f768c4ab983eb3eb1e22de9ac49df14cf0ed

SHA512
5bcd61a663a138e2995f797ef20ea0b36dc102ab9b34d6435d968be9d7d49c9e4d032d0e571083d5a2b2ceb530de0a1a35806f892f7c4ca06785214712856a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6a3c95f923d20241c27f463b53b163

SHA1
1e781c3a23b44bef85e3b020368fcf09aa796c71

SHA256
5097f0c3110d4fef1a15efcb6ce888c017ba2b0ef33739290208bd5eef665522

SHA512
2acebd26ad3c768170406a4c99cc5b60e498fe6b295c1a6ba50efcaa2bd3a53aacd2e0c91bcde22ffe9ed3b664ada87df48a24e5d93baec367b4f38d1cc56d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7e5d288b6ed275f3299182eced85d83

SHA1
7db8ae168123a8af02decc7fe05ace39804c566e

SHA256
a8e7db00535d48686163419c620261733692afbc9b3fe5f56475e62d0b3fed97

SHA512
d62e30b8c1de7e6e8dac1d1bf1ee52613743c6565156c98e0474b5b4baae6c91b434f4ada2d1e5feeac64846d6f82d069c736b97e731e2daf27ddbc11bb1533d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8048185203f159a66cfc9bbba1ce722a

SHA1
52eef01e480ee9622d2e4e754a50c9f7470661e9

SHA256
cba5a265ac163a7b796eb083c335c2ad4bf8df795d2f823bfd4d6cc7f53bf660

SHA512
c27c571bac36b3dc616418592d157c6dce203e66433dd02046be1bcaad7046d70338396158a22cd3891ccc4a8d80097324f5fa0226f0d03134c505dfc29293be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65dbc8d7deab9bbe916925cfd4004259

SHA1
c71d4135b0a73dcedc035e651b107074f66298c9

SHA256
5208b02a2c0aadbcffd20047e9c99fcea3f9bde11ba24bef552c9ac400964ab3

SHA512
28f61a03967e41fb00ecc65a8a89cf0b42561c75c37ee332c37113272281cfba283c404cb347f89278c289999ed77120cc2a27c22f37160ef25bab9bfd78f839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fd77055fcd651ba73e3d41d5d3c8128

SHA1
582af35777b793b04230f88ac0652ee31fc5257a

SHA256
849bc6845140432d671d9f0390d3ce75cf3fd33e574d8c5b0fc68f0ae68bc9f7

SHA512
b84ba83d7ffff1aad83bd5bcbbdb7678cdcb9be31c1aebbce34bf3dcdfaf489e94a5f62d9049d391a2ee3fd4b0f1314653ee3e9726ff378a660824d74a53f206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f660e9666008f79a844dbb31f0a932e

SHA1
b17ab390124f19edc49855a918e261b1e7c6d254

SHA256
905c5539b0d44d42a73123130a589a16f6b60cfd527612525c4c307aa902c954

SHA512
f1343c3bb9dabb956738fceb403d3dbc6f188af6c86bdf6317158d39a98bf94f9d222639e082dd43899da2154b79369eb5574eb3980bc6f5cb072ddb7ef65d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfac268c2cbd419b927bf9f8c6735fe6

SHA1
a087bc750f19dae2997664aef76c7cb1d6a11d08

SHA256
d28496e6529c1a540e83c06670c467d5d2de446d581778070da363baa47d1e56

SHA512
9fef054ec44953529e8a0ec6cd4d6a7e789790ba58562411ad5bc6b9353a25e50098de85b71ca082e3125540ff3229d9cfa72aeba0aff2e871361f5e7cd03d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB399.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3EA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit