2b32f8cd9e4bbabab151856752bf272d725ef6398a46a8ac6082be576a0caae6

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50fc7987727913ef8806bf9efac4a58a.html
Size

17KB
MD5

50fc7987727913ef8806bf9efac4a58a
SHA1

9036dda86275d51861a6d5977c14f9ff0f2072bb
SHA256

2b32f8cd9e4bbabab151856752bf272d725ef6398a46a8ac6082be576a0caae6
SHA512

b50a0eda1f21ea38e723aeca23558343e41d413371e1c2c6303b9860eb21bb8bb7b606aa4039fa665a5c0e2fe973457c45b03a0c54d7484dce726306c7a1d246
SSDEEP

384:j+IXKRjnpMtvwISBM+uHrbHBJjvHgMpPydaUjKdE00bI:j+I6dp0vwISBM+ubhlocgaiKdE0MI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60faa043b13dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410385299"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000620e7bc42b27bef08c4f1256e61dfc5f18bceedc5f8ca8581fbef70d02abdd3b000000000e80000000020000200000000a0fc002aaef46d47a1a1e95e05dbcc547b86542d93021b9ddfee8066fbdf059900000004dafe09de257e377183d1e6db0cd0bd8c745af37590703f3c400825318829b42fb84aab3f681958dcc060a0662372e021c89039b7abf809144a4125e92385ab47224ee1466e1c79bf323d4130ea0d716cca3b527f3cc6f5fb548e7cf3c2af8e66f52443d55a588ee241f0cedc9f1fc3679553110cc7b664edf4c3f50dbf6a65b236b59883c89f4522228d161347949b640000000e41cf3384de5561c85cc0fdc1280cb35242f7f1ab34187416fdec32e28016a702b50488035352861685ea65a086f6c142d3abd1eb83f4c66dcacd5362a92e086	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BE97A11-A9A4-11EE-8A38-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e1fec00f63426ee7cfdb1fb721c8e549cb7dec78bbb9aa10539c512cb0033431000000000e8000000002000020000000c7154da1952131354a2a5fed71335f4d6ed02a1da457f95a91567b2705c3d9c520000000012f90b6731f5c1be175aa149ee2da0981eeba0416d5d12bd2b7b82a484bdf76400000008660c198f7a678d22865c66d064737409c056f36d3e03bc28dc7da81ea3868353c299ebd08ce8e9fa7955c4897be7784a52f69f123e1b5617f4e91c2a3fef398	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
928	iexplore.exe
928	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2620	928	iexplore.exe	28
PID 928 wrote to memory of 2620	928	iexplore.exe	28
PID 928 wrote to memory of 2620	928	iexplore.exe	28
PID 928 wrote to memory of 2620	928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50fc7987727913ef8806bf9efac4a58a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33f88ee5490a3361083dc6eaa132ee62

SHA1
cfa3d8dc1b87d0f89919b6ae0c03891ac26c80d7

SHA256
64e9921aa7ed1acfccc5e6b1e499c91f68d8b813c576a48b99e49af99e7c85c9

SHA512
a93aae8ab2201c50a58f98321366871bac7f3baf68dd4798fb50068d59fc644d41ff53367b47680184e01116b8c56e706df8d37f2c3f265bb9e2aa2b02aae5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60bed6abade964c6160270da0204b6c5

SHA1
83ed8de7dd47464a32f5557bf30864a824948c17

SHA256
26e6de9b3c7a74ad3d8c417145f1af756a4db4d7fc63af786799cf252321c5e8

SHA512
6d0b319cba37584a24dd16a17852616968f70c3f9cf10f7b4d2049029a20b13ca02d78496b5f2a36e56fcf642a40b446007524703219a195adb7b097192d367c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42b269eb60115318a3a67398839205e2

SHA1
e928a36c7edbfb393d5303db0063d1871edf6145

SHA256
b9231964e7b04a40e36fb698a17818b6f27b5107f2e5705e8bdf40352c23f126

SHA512
8537e4f90b7d1dda8214634c7b72ccb799e1cf78de76796dd16d68129ce94078a297bc3071ca5014f8b10eaa3833bd2cf0917322764703fd047a47aa4d24eb78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72ecc5f050e8ff9e3ccb652e3fec5839

SHA1
0e39e51ec1a5399fbc5fc960ec650e1059cef39c

SHA256
961f65d9e0cc4b279eae41299762cef1fa4e728dd31a1d6983100a4a2173c9bc

SHA512
7d7e41db21ad036a77181dbceadbfe6846664918c2e81263457e1883aa757061bf4bd3ae5ef63b9899d91fd6ff739bd2018de9faeff5d9d1b63f20b93148b3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fd8b33a93b210cf0564fbc527a155b

SHA1
44f9ba4378495628f84c8e0d82f5770b6524452a

SHA256
d6d11db48318bded3fffbaee6652e93c9fe32b5f06cf64684549d9846d32e26c

SHA512
061ead57d69246dc2f390cdc3b2064e9db09df5bd27d864410f614658cf7551610085baf4f40aa90a511b2ff555b26f20e4522796f14262a0759f794aa8dc37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13887d88058efead84849ac6d5cc1084

SHA1
7107bc05d6b2ff1184cbd7a26996ef1316ede88c

SHA256
b6baf82f4d3b288bf2830e8f4a0554e8d575b613a786032b801ad42b29b8ac6f

SHA512
bb12f50daba44ae84413c235651c19f9b790cb5d02c46292a04a222d3600b2660a1cfb7bdd8587270c42cd8deeb2849ff53f79b1f669b08e03e7c7ac12cfcf02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30f730bde411eb9a6dbba21eeb575b8d

SHA1
c591475a000368216bd3c72211b51fc2d2e58a56

SHA256
a6ff50fd75890d5786631e560bc65a1c5c4949e3b493956fb1a36edf51ca3569

SHA512
43fde2e23a9c923d64e12c3e6f10587525a15bc696e0ebd806c1af1df36b180a72b02445282153da0f10e83834d8322e894c6bc03543e2a4317b04c24f21b16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c97d55c0a94be7ce2aafa7f72be3c4

SHA1
2602b215e40e126d7109d66885597c4ef7963e93

SHA256
33806d0d81b26afe6b9776aab14c70142489d9fbe42669f26dc73420d2195d23

SHA512
2f4958360f87a0dd2356e84f243a86a1140baf2e80e586facda100951aca4926407b1a21612e262868347d02c7a6fabb55fc7716a022d6e1e6f473f82936920a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518ad8ac45b69706b2a3de32ca454830

SHA1
ad91197536cd5a7b7306be5ad75df2dc20b4b20d

SHA256
cb215c15fc2653d2bf14167a369837ac677fa27c923856d4c7c9c99cea46eff1

SHA512
82911c31c5386929c5941e54c514a8b21230af163623011375518a33815007ebe2a9db1937fe56d35100db589f310444141e01d3723f09932221316d873dc633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af8205d6cf540e14c5ab924a29d78edd

SHA1
8a470901fbb94184f626f829db7495920e76c183

SHA256
37a555b24edbd2faecffc8cded36f63f3750344da7edd19596451ae32f58eef4

SHA512
33dc23fb18369ace52392597231713226ff90e99f91fb65de9e58d4d35af20600fe086aef2a49445ed8b6ddc1d879c08e0425a24c1ac434e2bc369ab6d9293b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b86879a8dfb1a573e13c10c0eadde4f

SHA1
e19edc1ad3e697af7dddd383ab386ccf4454f7f9

SHA256
203290cf8b3b3e9dcd3f3670a438c71b711277f7c179fb3e9418356fef928322

SHA512
1429e2c3cb1d27a2e18cf36af095e1f65e5a24933765252bb2ce9999bbb4ab8576248a9daa339f7cc0c5d281099deb0f9f6e82ef2fd2d802095251b5507c601e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
941383a06ec2bd42f261c904586608c5

SHA1
c15e8947ebfc3f0312233d36957c11a19852a3f3

SHA256
6aeb2c0c463f34e09a245df0049451697d38bc03958277c6b23f8c5e00815a76

SHA512
65e97a0766a132bc2b5cce33035e4e1b0f9c67ba54086b8e9ea482802f1d0c1208af05adea6efd64d4661a300ab3fdf04f63b08ad5ac6e1c69a75b57174b63cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87f3e19f4c8b3f03f4273ff05f090234

SHA1
8ae94a86b21685e9df2294098e1dd5e929f47770

SHA256
4863c90ac40517d6f003feffa28f80817d0e0e7fcf8a7cac4fcfec41099308dc

SHA512
09cb6fff9638317bdc98343336d4ed45d7f792c9b7362ab7b038cf0f2c9dd33f621fbf7dcb5d4e9a4f0e24f0045b6ff045dd55aad7c291123ca72a518566431d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9899.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar98EA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit