bd129308d8f4eff54f5af1f2178a3e88a3240405a30c0762408d76f7c730210c

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50b365099af5ab3be5727902c2ea9da1.html
Size

121KB
MD5

50b365099af5ab3be5727902c2ea9da1
SHA1

c8e20b3c353624452253df5da015900fe70f70aa
SHA256

bd129308d8f4eff54f5af1f2178a3e88a3240405a30c0762408d76f7c730210c
SHA512

45f6cb41eac7e2039f5920737e66fbdc8f667f0dde87775f6bf2ce6d37127ab8450ac0f6be8a7a0a1e24610bae00035616b6cb6e121eb7d0f7986ac5a6704567
SSDEEP

1536:R7N7NmyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:tfmyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 70e6ee5e8d38da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003f5b08a1bbd09c03b7bbd3ea921109f6c903e5a1bd63ef08c43285391753967d000000000e8000000002000020000000e686e96612e969fd243d489e1cf3a65f5fe1dcf124e9ef38e00e1414b1b70c9c900000002a2a171263e718ae4f55161b378157154feb7331861690992679ea43e26bc491bde9e734588ceab7f7a69d9243961f1fb75c483a868abf3c91ae276f10da50e9777c1bc59063436a92577957735e9d18887f88d6edf94631b4f0f50f09e84a031250c344d2d3aa4b1ff354547bae7b6238f5d9d2ffb5bf476df020db4038e2ecb361131149926b7d1bf4a1011e6987d74000000092f72b9a44aeceb40521c04db5d669ed5bbfd4e17ac7c1036b5c210e0393e0715ff96fbe89497b75ee0355517cdb41b36b059eac16964d30f5620dd14d9ac8a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409820139"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000fae2d7a27c07637a0b6fee04c7d12e8cd42e6e00f09a7b071d2f4b195f302b90000000000e80000000020000200000006e1b47b966e7de207d3f7d98c5657e68311a5589639a4dda09f3bde3f37f8ded20000000a007fe19a997e8b28da5dfafb0593ff6259ace7a028b901ad7a0dfe9f2760bf54000000044017a8c4ef7416336331f5ab82aefac1cf48ce1835b3608da184e675987f7ef8d6618c69d1b0df64fc126d3fa06cef4dba27c8efcac9c0c6615c7dfbf0908ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9795C481-A480-11EE-AE7F-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04702718d38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2752	2160	iexplore.exe	28
PID 2160 wrote to memory of 2752	2160	iexplore.exe	28
PID 2160 wrote to memory of 2752	2160	iexplore.exe	28
PID 2160 wrote to memory of 2752	2160	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50b365099af5ab3be5727902c2ea9da1.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1ad21f46b3a45326f4a244c8fe838b8

SHA1
6ebe64f5ed881bb7e540c9ef49d0f74cde3743aa

SHA256
efd9944499f8adf72d5a4cbac2723eb15e718fb842aaf06e560b085255cb5bf3

SHA512
4eff3c6467a14f971dbbb4afe6455ffec1a22f4709e75520b207a8a2b2d755d270bb3ddc7dc8b40c3cb03ee47e7256d20e772c887499d4971371d6d85ed3e8e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc432e19cd73d8e18c279b615903e007

SHA1
ca05f05281993e39bd0bce289d8e688bb8c67c3b

SHA256
42bdfd8f9580b9f7926cfa7ae00b8509e1238a37153e297611f55a221251ce88

SHA512
1f64281f964afc9f6af4acf85c6f594305d4d2be9d1aca81f1552ee1ad2a807af64b25b20748eebe81a0b0535cc3c39449218cd6f572857d732f5105c310b19a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3bbb1a7aa6c62c9d92635d7aedcf0d5

SHA1
04456050ccfc426f237eff0497b22965327b9554

SHA256
e76b37b0d334dcc1e8c47c793fc6e1a92e84dd4bef0bc06a6b9a3988e2cc441f

SHA512
1215c2dbeca190363e3318e62712bbc0390253c65db4dde2768c3d5b32557e3bdc11986c9df03c1e7f1ca1c604485fc7feaf6813f6c4d1ef05f8f9dcf905b645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
609131dfe5e87c570e2d8b492fb5a67a

SHA1
c5c612e1a48e807f06aaacf4323c0e739d33c636

SHA256
56bd8e78f8b0d01560854a272680deb0caf6c1bdde3786519c89fce15085a645

SHA512
ca95c37045609e9b998ea0bf2b257818f1776fd407e3e88dbf0e05120d396c48fce34423145ed46594586f4d4f830e9cef1aec440c536b0625bb803719ff146f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4b66cfb36e495b60e35256a8323951

SHA1
b271dc4fa775177bb319c0dc9c710ee1e3622048

SHA256
5cb57d9399dbaff92586e93586c59fb1702d8f6c142b963cbb9a5b8e785fc23d

SHA512
e72d9cf44c01aa3595b99e46280ef33d044ccdd41025254f67646aec66c84a5057c3d587c10fc1ac43260378e2aef2946f160f290d1d10ee918d0ca77c8669fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a126f20bd3a6cd2a70f786b70e9f7cd9

SHA1
c25ef5d86df12a23012324540b2c4ce5cda3b25b

SHA256
00c782a6ba409126bde3b59bae619f6907783a73216fe27c9887ac38f7b03cec

SHA512
eceb0ad4b0f24370235cb76f6f3dee932945fbb1db08178bcffb47d2d7ca09d8cff8243d8ae0a785923768e114549a2da782748c0acab3db9726804532f88038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4bc14ff7e6c11a850a15fd725b1f4df

SHA1
cb8a907cd7adc71386f0d8765d8d7bcab6bd9b50

SHA256
64d5303c64b65513f0884b08258ed7c8a50888608bb9e197cce50a662d57d645

SHA512
2a971ed1519ec1b31adf2ca1fa4b76f62d1434c293a8ec8d18b4db9f37d93c4f8add6aa220d63ccec39de312ff1cae6ca4caa8ceaa0f15722779f35cce174b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe80b9f5aed3bdbba3a30e6e60492038

SHA1
7205b41a5b0e05a4e4ed4c5bba6243d1403a4b8e

SHA256
88f704c5fff8eee42c97191720e183cf475297a5ea395a702c7943fa0192ca94

SHA512
f5f809caa9ba3c9487ed3ca168ab18e3c02944c4d2279613d27fe6d62e821b8613f374cfcc2b1ed37c89351f5e0e4673762327b751f0d127b9dd76fddd8d9ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f970f988940600fdd8a2a481f24b57f

SHA1
b2971e01fa67ed708a9196ce3bca35b5d574131a

SHA256
dd7e6973e06d662dff05b20de0969f7e3fd4c09c2a85348d352f150dec210117

SHA512
6720ecc0f6d0b985c77956d402f4cb756dce253d1f1a300236017582bc642152fda3dc67ac4d83fbee6f1e26e77e710cac6cfb7f8c4f891f8d628292d796f6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21bf6aea4e8d271acb67138c53806385

SHA1
7b3393fa88aefee469ddc3cb885964b0b3891d0b

SHA256
bd3a67f1219c97dcc2f8f33f3d8ac4aaf2e014a0d001a6056570b3f1e5d00145

SHA512
393455e65d157df7ce3c297cd6b5a2e68ba218a121fef97cbd2b9ddc0dcf740c814fad7b62d4fbd0f0e6d559e88afd562c1515e2daa7e6a3100d408fb79a528c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5419f952e710498254568398a8325c5

SHA1
5ecadc640289b20df748b6e9f7a44f9b09933841

SHA256
506c53233c49c02c50316f22c03a904aeeed1a9020cbfb747ef09a383601dac0

SHA512
1b99788ff735a7bde9b7db4efc6509716362861eb55e743536f199767619f986f795012245310f041b22320693137da4a82cd3bdf1a10e74b2b676d3af3bd6ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB760.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8DA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads