d3ac95fa3d8fefbd0814dcbbe3da999cf90cfc2d508bb8d24dc5f8962c1cfcdf

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54e27793232bd8cd488da7861a7c342f.html
Size

15KB
MD5

54e27793232bd8cd488da7861a7c342f
SHA1

ba23c82f12699df5aeb425699673d936d98fb0f8
SHA256

d3ac95fa3d8fefbd0814dcbbe3da999cf90cfc2d508bb8d24dc5f8962c1cfcdf
SHA512

bc898aeb1cc4016b3263c3fb3b9011cf04dad48c1f6838fab2694ae289f37cba26994f2a6707f91e1d1de19b07eb0eadfb3a5a94f9684f9b20149e0438fc3ffd
SSDEEP

192:I28ietW+1mqTD32kMeN6hWbZzgH5zKTe70U6hWbZzgH5zKTe7bwn2A2wWGzAIivO:MtytHVKTeytHVKTefpmWxLqbH6U

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a82f7f00e65e9a2de060ce82d70e7713ef70317613f69728b11038ec5b48af8a000000000e8000000002000020000000dfab4091caf930b9b91ec92ad5eff70e26c0bc07a56f22f2055a600e7930511820000000d1a4e77b60b3c636ddb8a4fe5503da25cfcac5b958f11b98ba8973cc656685cb40000000b3f4178bf8cba74b2b017264e5476f998712b9ff88f10ad785be510bd244dcdcfb6b40ce3e401b7f1675443ea89a8cfdd6d79c8bf73c9429eac870d9ac6e083d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000122a4084e355850008549c71cf410549e3c23a7dfabff7a259e24af1678bc687000000000e8000000002000020000000e78b6aebd5f095190b3d2921d19f7e521e03990df8bf472664cde0d14cd84a6e90000000ffcaa83d06a338e509eba50895654964b2f7d23b05ffc9e55a9b08871e67152d41455470895852663bb32f2a7059a586f0dedae025d8229c1205c01e0e9ebefaf6987480b062088d8f8d9dba77ad8c9e965ac55f34aeba593334e14c49a4b9c7a24bbee8b8acc4e0bf62beeec9a52500e4cc2d02826369a92da3ba4694e2e7bd7a7f7d436a168451b3191664b1f9681c40000000525faca88e59dd568aa8853d29a126bd7416f45f8268ba33c5cda151b594b16bb829a969dff71eb8b8274da53cb4bd4ac7a634ac71008603b9f08e0879669dc3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAB4E5B1-A9C2-11EE-BE5F-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410398360"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c028bebacf3dda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1308	1708	iexplore.exe	28
PID 1708 wrote to memory of 1308	1708	iexplore.exe	28
PID 1708 wrote to memory of 1308	1708	iexplore.exe	28
PID 1708 wrote to memory of 1308	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54e27793232bd8cd488da7861a7c342f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f187fc6b678d406a0557a7c5fe09863f

SHA1
dcbe4e15c73edb3858c3adea78151927ae12485a

SHA256
316b4dc2325ea8bddd1433b0391c72dd628352dab52fcc564e4ccd2b5e42b0a9

SHA512
c3e7484a74cf4f305b35a9da30fb94a470dba67d9f0b64b09fafbaac76f859838a7c9f8589b7b8b1d012a01150908f4bd4be1d585bb5d79218536f6c187d4112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94376716be2c676415df086d33a96b2f

SHA1
18ccb0f1b64f7aa894fc8c941599a85a4a5792a5

SHA256
b56c5679f8bd30aba58f5a34ac0f4979fc5f47faf3bac81e324b1d60ce32a6e1

SHA512
55ae9b23ef3ef7cd352f7c62ffb85f471ab2b1ae3187809b55b2adbf4f1f87a7f96ec6aed494baa1bf52817881270c7f4f2bc2bfe5d50692fd8dc5ba791d0233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5df55ca507f313fafe535bdd9705a9bf

SHA1
4017ec7008cb00e9534913e44c8a5dfc072b1d2b

SHA256
00601fe11449d6e456819473cd320cb87ca3d60314c43208b8b81d30ec2e4ebe

SHA512
67056bfd8c9452f36e6b3545d334abe07f30cf5e98c4d37a91693bfa5b1bac7c2b7f3955d6785acfab5346d2859a0feecd3fe014350e934f62ae7f3448ae0f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77c678cd2746e3e381a85f8fd014d246

SHA1
5c1f1688b1c2c2ba5a3af6abbeebe195cb345362

SHA256
cab2904b2efc269782e93e2008ebc5abf7433c7c67d3b8476d6927bb3a1662db

SHA512
619058b77c13bc0e45454e45a5f13e6d154c197ef06fffb6ac95ae689e20e593109f370308ec9d416db3bd96bd0053b293f5ed95312012176c259d2d97c3b1b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd755eef04993624ac504b812338cb24

SHA1
a5d4e58fe3b1deeae3da580dda34962a1c0a6629

SHA256
eeb73708d779661245bb552073b6bfd63e8e0c8a731579bf7e51660f11bfa4ba

SHA512
26d8a0545f02a2028a7bbb4724513a94d653359d8c13720690fe4fb2b4b66cf55ee82fd02f08896ab5ed3035c9a3a6b6cf14af020034e64f9e97644e2ac827d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebf92924684610a755ff3ca6ecf7ff84

SHA1
26cacd6122dce30d6e99a9d3dea7c621a0d3d434

SHA256
79e575af0826482dff87006528ba4497fd65c054c56d79d39c52a1d84b27e3e4

SHA512
1564cad29f7a3a5117c5e1a1563d5d74adfadedf500908cdefb5093bf3ad152475b1fe0f32fa80eb808c663cdb637315cb4af8b088488d98f2eafd4f22530cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da0a5824c6c30c72d8654f9145faa88

SHA1
6ebc37abb13a71d39c25271c4eb68c22a243a0b8

SHA256
43fd1585c72ad5e88ba9a8bb325dcde65852f5c6c20b5d6d75bcd70f5d50b714

SHA512
44548add87bd7f71ce1bd39174b0bbfa934fe51c18244579b663365a3973422879924b0b21e7305b43138bfdb0038885bd481476344050566d3cbe670fab5b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4395dba674687341c21a878ce6bbd83e

SHA1
9594d2f9111d4d99a062fee3aa166e7d294f016b

SHA256
688c9f1f2c98bef2f4e1d50ead88b595729a9c21e9fd762fb74dcf04b91c4702

SHA512
23def2f66cc8ec7751254b904e629e11eb88b92b9c4328c11b1b88be4ecec4736a28825f73322e142b0b2cdaa4ecc75865ecbe3f8aaa9d8b102a3423f59ab531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d8fe77253065c805349402b8f9e8e91

SHA1
a19499047cb24cfef26a0e495fab51cbc46091c1

SHA256
dc44e3f33524264b9cac070bd5b0797c219cd8bb4d280d1b627880213844e49c

SHA512
fcef2d00f259895477d08885f16616d655df15d4a63cea248f57f8c418344c595fbcca39f1dc75302f715a0a6e76306e18a6258b20c7ef27be1a3ac0c7ef784c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25dda7dfd1f8ddd85fccb3efe560c150

SHA1
743d2c1bcab7ac3f6cfec0e4195e2ce226ff32da

SHA256
e246db2742f740af755d5314d1b57273c07b2792ac87957ff28e539a192d0016

SHA512
2c7488f67ee1547aa9277f122f245191642846f51eb30ae42b3772f1f4e6f97ac33013746ea13e9f26f14344c8df229181fb0a9131256c9097dcf522aa09f895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82e8ef65e0ff0bc25463c97f1efc8003

SHA1
44e576b27794c55496d96e0a86f605ff4ac055d2

SHA256
fcb17f22b6ef618412b5f3345d3fa16835dfa3f6062f2e0791d42841c3ed4087

SHA512
84f1655b7c515ab6c529f5e291183da98cad0cbba2c15323e87eda470087e47ff95be5592b1c8ace6efdea35fd6e91eb8cc366644b637a98eb65680add0a521e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5391eceef71ec614d70a6583527b7a54

SHA1
f6806c31f43ffacf549c9f2ab655feaa95faeab8

SHA256
5355fc3448f0ee62be8a6d9b8f5c770a4af2c6128ddcbfa7e9f186adb9d82835

SHA512
639cac209eb8eb5d1a722cd47a3c7e769563dcc4bb26b5c55e2fd8ee6bc6159c543c7962d9f4a9c1e806d431d539e11c0f5eef95a8fdfd26d00d4336f4b25895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a905613afc50e00d3cebff1094f35fda

SHA1
86bc5be98d43830bcfe49857f693fb17e9b5b7c7

SHA256
80c27b344d387f19d542d21cf02a21bf3d46aae8e9bf5b4975069db7c4e9292f

SHA512
acb9c33856a3ee85ffe9b6c6b8a5a4afb1313e22a64c1d0c2001a0579a29de5295c72553a379c8dfcad0d657ae123863680a45da04f9a65091cc40a3d6fd2723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe4486d6461041e106934563dd044eb

SHA1
2e52807cf99b7fb5cd9843d8d762a5af6c840477

SHA256
20f59311b08ae66085ebc2161160ddfbfb56bbfb3fd73422660d454a9f72e1fd

SHA512
312f9d225509aba2df6af154e2dcf7c81d26c12a6f28e01fdd212b5b6dbca6464b996741c5c9d92f8340092fe619c4915e314f77894bf43525756fbc00283bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9d7e251f642fe864b5b166ca196d84

SHA1
72dcc69befeb3e6949605f5eb3047b5ff92d3f2a

SHA256
f74476ffc44cfe1e4602ffb1963f0777dfaaad6545083aab03ca9c6857d77b2b

SHA512
3a8ae0bf0c3c5ed17c4b19f0bb8bd557ae2134109437f98a836ae3c7005e312a06d6ddc305d99a684ec6d43155042472d8f1217e6edf13fa8f468b7ce7debbac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36efa33f64d114bda396361235c9f55

SHA1
7e3f7992b228d17464e0430d8e3a3118efff1803

SHA256
d2ff138780894a437169796bdd889cc60e45b0846589a85179afaf5527b148f6

SHA512
92aab89a389b3329a635b086ad971253ee0c637e0a9a937d417276d63b9d544fa1c9261bfd55a51fbe662d904c1681ccfabd6e6efec3e2520a56f8722613ba7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50890f21b121c4b88845d1a76cb3185c

SHA1
359fa6b05f389ba6dde59ec0e394d2041cd0ea5f

SHA256
3788abbfabf647005720484ad0e9bdc5248113deaac07f7fd93b0af5212d44b9

SHA512
8dd598ceca705f21a1646d98b900585bfee26fd1655e1c9612fac27504a0eab16f75a91ff3b2236656a9d380e6098bcd7bc03d39c12535dc5acbd3a2743257d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1769.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar373B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit