e96b00fc3cfa03fbecf1a6e52710fd066132eef8c06fb011cd0761988db24242

Analysis

max time kernel
239s
max time network
286s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50cd7740f3881ec016e1108229ee58f6.html
Size

11KB
MD5

50cd7740f3881ec016e1108229ee58f6
SHA1

35653618e3d1efb123a44ed3dd79805fecd6a714
SHA256

e96b00fc3cfa03fbecf1a6e52710fd066132eef8c06fb011cd0761988db24242
SHA512

81fb50775c02f7c2a59608f1380b7d0693d4ca6c2c705eba2f4ce55b010d9df471e43485050f89baaa1780adfd6f55b083de9ab511eb8b3b219306e0a0ce1083
SSDEEP

192:gXfstQeM4KtFW4daiVIJ6t+mAoxp0ZDTl/5sG2H1cKkJJqjrsQr4qfH:wstQefiFW48iVU6t+mAz5RhsG2VBkukK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007353e4342258a65f32670386a56c9b5d48abe885d081d1ada87d956f0bff2bbe000000000e8000000002000020000000b3e4acf08c78dda40fc3e80375abb644a461975b39e9dbcc8e5a6ab627b65bc790000000993fac95098bbdf83714d470dd462d13b2d7368dfd0149597b29848311f4f3f5e0048e2d79b8a290e693feab6cf429ae1c96af91aa138243b7b588fcbdc72a1cede96a6a3e2d9a8ff74348a7b895a8e3a6832a5c5aa49e73a6898b9d41050294887fb01cd4857e90806caa5ce3893a36f72bcace25d13c6eb5bf1b0a7e79b882bd261f2092ba9a63336a1a87618b72ca40000000be6333163dae0647dba0f037d4a374d79a06299d6b6a2aef0e8dcf500d9d53760e092f9f7082fea01f9d8bc9bccd56cd7626e68dfad91d9c1c5abd23c7644748	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410384862"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{632088C1-A9A3-11EE-9B2E-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000015f23a37b1ec184b509c9c46e96efdcca8dc269577078d0f1558703c2546c4f000000000e80000000020000200000001b7f359c928192be20ef74ab314b2c1a79dea3d5476d6784928129133b2cf1452000000059ca13ece9b1c922ee0845ac8390c78c6cbc4c22b51491644e365acf9028744a40000000cb5c94b9e7de6d3147c656dd439981bfff288065dc5a5e5a44ffb613e022d8c5c1cfedce8e904c13de4004a0a41aff20631de7c371f08adc9e34c5fd63191fde	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d52941b03dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1992	1724	iexplore.exe	28
PID 1724 wrote to memory of 1992	1724	iexplore.exe	28
PID 1724 wrote to memory of 1992	1724	iexplore.exe	28
PID 1724 wrote to memory of 1992	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50cd7740f3881ec016e1108229ee58f6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
220be1751771b3286c185c000795d0d8

SHA1
9c59a2445ce9b43f2896c7c7f9cc98b9e381c47d

SHA256
f71bbce664a4a77827497fdb211b17d12e111abeeeccccc3dc9a0ac49967e6c5

SHA512
48e0904b2f170decf38446a0fc85d5b7cdb8a4aaa50c525021fe36469e088b2234fe634fcedb5f6eb7779881db43254941d1c0b0fd412ea0a04b78fa42831011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77396f73cb9b6c59237bcb9d67a4520a

SHA1
b17124aedf36a40f81b2d48a5260d1e2ee0fa1b7

SHA256
5b5260587965dfacbb618347371cc60ee698b382a30d943083c708c8c23cfbb0

SHA512
36ba3b95cb484fb71eadcfda9e6ae23cc37088f482ef7c9623bd650fe98a549646f0fc564c9d1f7912345e598f674cedba1e61430e7d0b90208a589b1a6ca3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3696998c99e0fe1a8e87e2a00f41f292

SHA1
379259932d76f60d17a168597a7a68deb3e2ffa4

SHA256
3c71c52e0cc537d203547e904b90a8ec5899d2e7289ff87cdc19b798ef95818d

SHA512
e82d59c36ffd07d4a8ac5d54617888c1e4db2738eaa3198f4432a02df0db392f5f2e9041bfc99cc3d52fa3551a953f800d5897a5f65ecedd9a56f670273ba01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e1a082cba2534d9bfcab718a305f3e

SHA1
47e69994a27f93e18876dd59d6a09d9ea50bb7b7

SHA256
018732d9ccd3584d962881cde7d2165c935646ba1683570c5013e3242bc97d62

SHA512
64c7f1f4a59e2a1a7a982327b1f34936205f00113f890da5731f4066df3244252435dc4f10a2059bf93f31e3e40bbd3b05bce19910ebaf8b0b3800cd8b8f177f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdb11caafcd43ce50cd468ef9ca9498e

SHA1
27273297d61660e20b20aa5ace53106a9aa26954

SHA256
9aa340f8812a87155e8fb640a44eb4f4169899677dc50ed74df0432642bc81b6

SHA512
15c79bc30355b01cbd2648aeff5b9f3b8bf22741fc0131ca7e489f5558b0dadbb672619e3e69f9d7f7fa0c0eb36c2390acd8d53a94e81e9db737a490ddbb186c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6079628d6f4f4caf02a879c5aac9ed9

SHA1
d7d113aaf139e7dfa35497b45a4c8e2d3307809e

SHA256
82a3ea4c24b9d013988abeca995d58d3f9e734a6aa2ca9fdc7c13337b71012cf

SHA512
3b42bd4288339600600011dbebd009772c0bffcf8c1cd839f8db263709e0336c7a4688db62a35377fd5606bfeedcb9fd5c9493b27dda86436b5661dc25243de2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0439d2cd7a25f8494d6a339a79578a27

SHA1
949d281dd0ff1bdec6dfe1db38fff88e7ab81921

SHA256
7dea14299a3756fb972127b1a361a52e67af90e5a999745716f3571440c44710

SHA512
5d5084c2bd7ca4f4e8453e7612093ebd6a6b76b3adbeacd2a8bd6b27e88e116af83c3b8bba2e6c67229f2a81bcb81525b0e531b1d77a2ca84d83b5f440c42940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
976fa57d37991601eeb676645c1adebf

SHA1
e870ae894d0636cbbb588cfe485db34f3a0b3cf2

SHA256
d2839aa8cdd30ef66bab5727fa81105e67a54f09babf8f63e728ba6e40342424

SHA512
1ecf42392b3bbf81efc3be27fccaa372c3ef17ea93b53541c2124d6e8de4fb2a13edd714f73d245bd0a4c5a5686003a876279be7a78f4828d0cac010ef7ad152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d22f1e1c9243dfc5dc4a98133cc1a23

SHA1
04345e99da52910f13e84931f41ed05155a084bb

SHA256
3393abe480cf858d6f6b30114e88c03b2a2d0604268ef8e06a265eced79eea05

SHA512
80094e40acd0577ad278021e8453bfa44c44f25db4bec39971d1b7f6eef58926b2a0a3936856fa93a0838bafb6968c7f6e77389a700c2afa850bb4ad127c607f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbefd23ae018fc62ae2cc26607b57b2d

SHA1
c07bdaa02ed47f3169886f55c9454b821b826d4f

SHA256
1ffc4f024d705c2f352462b857b49d74dd85d8fa88a7da43b4d00678d7ebe79c

SHA512
9bcddc0a4e7f238c823313ecffc7546b48394212ed02fa6e4c16d002ce3b661a260d84c67082c4a6205b600623c2333c25aff6011be441d9abe1099586027dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2649df412cba2ba3fca9def2b93f4a1

SHA1
a3106c0a11215a1d803d1f4a2056b0c1e39981aa

SHA256
2a3a278f881a7fa96e42d0d302f33aa465a939eaa6291d86e3147db202190a73

SHA512
21100372ee6ad3e0767cb4351b65dba52c86d78f797cb08e0814d5897e74d5c7dbf2f8f59a939bb16f5d6c0da0b528162ea133085115e3d4cded5c33cd399332

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f3808df39a6e6620254a2ecd10350f

SHA1
ce6e4cbf50d06975ea56bd65fec043b48508d32d

SHA256
32b3ab0f33770a925a17acd1cbca4b7eab30b63b9c3b63389503b4c7095f7292

SHA512
66fabfc528097bd5bc6d59baacec2216fa0a13d8362fbf19206ff212a63ff9d5a9cd9c920463db5eff245bcb9cbdcd6c61c3ac46a86b7379c1311358e1d6954b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95630d68627835f7d7d0aa9910a78b04

SHA1
33110518f123b6dca293e55b77e4d56c7fb5a0ce

SHA256
9b9819b0922c8c7ab6dc7e5c9582d1a7decb0e9f57ecb545ca7084c1df518286

SHA512
68782c86613db2565e60400143696f9d5d33beee79c6083e2c92b0536db268691571e7f59caaf09d0bf387b138844ee7768514d09673cfaca993dc32070e3a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5465efea716a1277ad3d556a110a49

SHA1
83212d589ae041bf827d6ba5d94d9b6565d4c689

SHA256
2aa07f4d9c8863f505fd928628ea64ea372c31f1de5f70971d769d40f20ee221

SHA512
61316174ad05fa516c5604b2a4206ef5728f9f0c056ab66172fec1dd2c99c43cb6c7ff9006282187807fb7016c576607cfbc2bfb05f8cc6b10d2270d001fbe02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d3958296bc73d61d5980513b6463a3d

SHA1
e9d147af5763068ff5712ed59fe8c24902e0b013

SHA256
b2e03ceb04dd202fa8347b5cbc1e7dc6371e183194eebd4f2f723da23560eee4

SHA512
24e29ee58899c64a80f9ef6c50cec52cf92c470068b658021b698d996f90f9e8cb8b8b2f936ce4ecdb85e5647698dd58eb8109b537e92d58e197e1aefddf3332

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEBF5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit