e4c2219be02141b53ecbce9337097bd876e0ba52963e0f2f9905d67aba4dd069

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55a7c2531bce25afc229bc3b7bfdb14a.html
Size

12KB
MD5

55a7c2531bce25afc229bc3b7bfdb14a
SHA1

3860c736d12b2691b0658cf385cb091409d99b38
SHA256

e4c2219be02141b53ecbce9337097bd876e0ba52963e0f2f9905d67aba4dd069
SHA512

bbce55395cd816db1e450e8e54c874d2c785443ce1e3c1dcdcd85def7baae84c8dc7fa6302046e3e927945cb3579d3ca8bf5192160125f323890f7daebceae7e
SSDEEP

192:csz7SvAYS/logOHPfUwVpJ+zuMpOpBpl000nPHb76f:cdvAY8lovHPfUopJHMpOpBpl000PHS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000005950bcc1f3da4956fd8e73c13aca0d1355369a341722e8192e85fbe7acf352b1000000000e8000000002000020000000f56da9c79cfe6af5250cb8b15bd36b1d7060125632422a1d460a7a8a11b9ec90900000004865bafe08e52550cb1bcf172d3f84a17f337d99379c3e1e7e24252cce058ec9d16ed5e9fa0c32e40de1ea1063085085853e1b19b6cde17b916317e98d9b26d76f3574b2cd0eecfb4a2d977c94304bfa037593ba90d289a6df286bb51d373fdc93214784c15d8e3612c84374d486c2ad5d17e25db6a8d26dc9dde42fea358314609877fee8a5afa9e0efe23b7b87a8f140000000996c39305e8cb7d962201e664d8e963ca587990fe3bf540d6874ae375a5a0a3b1cce152a2af89a18fa0a3c2e11a7db273af069805a22ea6555a42020cca482a9	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410654260"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000004b5468ce28d1ae332c32e39650c5b757814b5060c5fe088831d636945f580cc7000000000e80000000020000200000001b3b36aab81c0aa458e37aa4a256dd9e59a41bf929272f115816a081b8e6ea1720000000d146eaf2206868a87c720e709e82648a7e94d9e2d6f54859a024c5b335d310704000000097b1fea337dc9bc0ba6eee4263680736fbd5537120ae60aedfb340e1dc372e9d51b9348e59f688bcc7a3b6452be149851dc92e5db0965315391c268869e0a1ba	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE969C21-AC16-11EE-A497-46361BFF2467} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00a14842340da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3068	2928	iexplore.exe	16
PID 2928 wrote to memory of 3068	2928	iexplore.exe	16
PID 2928 wrote to memory of 3068	2928	iexplore.exe	16
PID 2928 wrote to memory of 3068	2928	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55a7c2531bce25afc229bc3b7bfdb14a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
110f8658e20d2be73ef65d8591f25075

SHA1
133126621dd78b8df4415a0caf64d50fe89bce6a

SHA256
dee0db008f588749cf27739d2c47f816ef183251ee63402d52f9c4b69c8c43f2

SHA512
4d0d717f09509e58e45af265d207fa7a0a21b1c498060212128454fd70cf2fa854a9a462ca9b0868d0cd75c49bf770042c21445758ed36288c9ee7409aecc147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
577731c35ac7a3bf75116695dab2d52b

SHA1
a642c6936d1c7cb682e0fbb6fcd5fded7df1985e

SHA256
20509bb37d3792081deb6ff916de13a463dc69069225ad7c84f981610348e7a8

SHA512
d25ac5690fc9ebae9331091e632ca6ccbef526633415db95167c4f5b62794cc371a3c8c9201a3cd085563228a8e4a16b054469c1bd9db2a31caff1c163b93eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00bd7397e682482a25e2a2d15a19f332

SHA1
4042c92a312ce8fb502df162573740b1b4882778

SHA256
e03aa74ad0771fe54a1d0b276a378a28d24e23ea2316db048efdbec9e1d6909e

SHA512
8431d8cf68e78a4efdb59530e41010d5d4ecabf3463deae44ebac79f22879ce4c73c0ed9bb51ed68ab1b49df1ada757832f0878f394904e015941b0ea5d936f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4c37ae55b76247d08a1ecf7454f3572

SHA1
70416615a4314ebc7e6cd1f52d931de2abc6c41b

SHA256
65aff18585e7601ca4b9b318066850d7548a64785b4b92c39589cf6a2d67e990

SHA512
a998112b09bf407410c915b7da4d09fb4be7228c2dbd84e6b9543f1829a71f9615f73ef9f2450634133ba0e03d4583a4ee7a13364050df347ad2be4bd7f30d32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d73c408f8145e1ede733514158aaff6

SHA1
e39f4251bea95cbb417d86f9b3d8bcd769d6acba

SHA256
daae02bf98122cf3721b108470a76e9ee409846719888860c4a1a21c81b8d392

SHA512
625c8eca97a6af812cc62beacd0153286009d28b77b2821a43db2d132ab77f63ecff887efd5ddabc55e2ae39126f86194735fa14aa0d14b0e7982633f1c7cd37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf1d0ec4b3571134c251c359b914d526

SHA1
0e9fce8ff95566154c3a6dfb62bcbf6c85071d91

SHA256
3f21338b91822abe231821cfb9975db845149e15a33eb09070df43cdc4fae2b5

SHA512
3cde82c72428b457a62eab302613a61ae10e000607fd9223c69246800223e96cd3d1762c7be6ccf48b8070fb789de5cb9f7d40a86731055ddd986f98f3033a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit