286cd9ec51f1a2a5f7bb06b8e7c92f84d8e5a2d33c94cac8320b05470dfdc976

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55ec890024858cb2a56184a271776867.html
Size

9KB
MD5

55ec890024858cb2a56184a271776867
SHA1

945c2773e91911945d81a5ac08b50bb06eebbdc0
SHA256

286cd9ec51f1a2a5f7bb06b8e7c92f84d8e5a2d33c94cac8320b05470dfdc976
SHA512

7bf75e9589fb65ee7e426dd402c2c52b8c0b4a36660eb02daa269e3552e3262dab3e87c1e4400a1650b5082a09d8e9265f300f487f11da30a6636739ad885fb6
SSDEEP

192:OnXyOkpqVUDDku5MflMZX9/Buf8xpnFSWuZ3szCWJ8Ka8Zd1LAnA:okpqVUDDkuyfeZdBuEzJJ8RYd1F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f6f8d22540da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e9bfd8764a9667c8fb317c8019127a8f358590f34b62507d154f6108ad5d611f000000000e8000000002000020000000651a023669be071a45188d5d5fb8dbdcb6e2ac6bbf19454b0e03cdefecb115c320000000aa6c21dd973f24def37a659f8f38e9c6de0737dd94b766fe758ed152b7cda07b40000000b25fe94176ff2e8b3ad4e82662b17db546a5131d5930858c9ab301a211e86f2ea0c5e7d099be58c788f1cb30befa9ac22d83712bfdc7cb8d20f40a45dae8326d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB555A01-AC18-11EE-B751-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410655228"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000007286290847353ef8e40b21f4e1d4da116c7e6ff208cff06b515bbf10be62e452000000000e8000000002000020000000d6c52a9d52e4c470e5976ac3d36820583fdf2e9e59325ebe5709d7b746229461900000004f06682a0f58fbe9a3b50319475697d44915a9975bb181d796b96feaff4332040cc048e8cc7681d8bd925ea50ca89f1218e80dcbabf7d20e91f32b21597a546023f29c5bc4af1f5c219f0ee245a748a7c50fc3e08dcf1bb5fe04e6d2314fa855d490d5287471a24230470dd5b80cc69833c19258c02dc4f7787a0b15fb927c64f65f44a21c726092a541c47169a16c0a400000006a5a715bcacfcaa540e5d8c48894c4e7ffd816277d355e4262f089dce93eb57c0621f501af50bbf6381b437eb89b9bd1a8e3285929e779aae78b6ed280e87609	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1724	2968	iexplore.exe	14
PID 2968 wrote to memory of 1724	2968	iexplore.exe	14
PID 2968 wrote to memory of 1724	2968	iexplore.exe	14
PID 2968 wrote to memory of 1724	2968	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55ec890024858cb2a56184a271776867.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201f2741c7e4f79bc4a5579cef6a25e1

SHA1
7a08a68b3192e5aa9f2b6023166b15c7e3fe7f98

SHA256
efd118581078e5ed412d7d409983addae41bd684bcc0669818adfe21950bc49b

SHA512
630452f00fcfaf8360ec3db73f7d00546ac22b7207d016998167c64011d809b874b5d93504357972169bcfc66e827b77cc6d4ee81965d1b8828049db66b07421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd871336ba408948836b50f58ced403f

SHA1
33a764bce3ca30f4675ba7ad1c22fac6847684d1

SHA256
744aab2ea760508740bc947399dee977adfe51c4bfc9587a3bc99ad90f605c5c

SHA512
8d7742bc5aca5367bcca374007cfbc600d18119f2ea2ba4bdde3054f76b7f45b75184cb02e6810bf818be86151bdaf2fa561477962fee231a587c5e728b9fbd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b64b82e02db0d2845ff3025599ba69e

SHA1
6143d748f8fea2a7ffa81724756fc24525e5519d

SHA256
bde937e44027ef8e7b4fabe9a5150329196aba6dcd14d90b7e32148a33d9688f

SHA512
0790d8436987f5c129d305b97cec631d747cde5f4decaaf2613c4a6c4cc7cbe55140779c90be368a553bedcb20fe5889cfe5ef2ed5ab389b215945beb59d0789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f665a0ff5a1ac68311efa3dd9827030

SHA1
ed292f9cd74b312e1b2f403848e3f3191048d4df

SHA256
bdbf69526f8e6ef5fc1a7316b912fd015f30e109a36336f068689297dc1b0f0d

SHA512
454a8d41a337fcf6c956b0ecbf9f0476bd78e76706c86bdfddb2526aea3832809e39f3b1218292ac6017773a015be73bfa88b633536c37aee9f6c67bb3c4fb32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7012e591de613dead72842810ff90780

SHA1
396f743b3323cd02ffef93b496a06085a215b4e5

SHA256
89bcbc66da9e3ec85b5052f7f856c158d482c61b44c1210473c6f87415e0c60a

SHA512
5f755890f832647ae7f57f2d66409127c3354d8e3cc2f2cda12159b25e8230fb4c5ef0d2f1fe07d31fa61135912b2c9807ea6d4991b81b80bf5602f355e1eb49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94cae72b5905c3dd0ebec072324718d9

SHA1
192f8f78208ab1d50d359d3bbca8eb37c7e4d43a

SHA256
78514a67396eaa4417ac5f8584eafaac59bc1f8f1639210d48e8bf72c71ddad2

SHA512
a92eb38e3763ad81e2ddabff98dd1e2720e2987c2659cc5052160eea788853992f944888b53f922bd9016a172c54d717b38e3cbd5af5245159018423c4bc32ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
344ffec40ead9e42f6f96558e3706066

SHA1
94f2bc023c46573a31faf5a24089b005cd8a5b30

SHA256
72692636767766d621d42b41036a551344bc9d5e191027e0ce529648fded1495

SHA512
fe1b6029ec1150eb2a00a0fd7754136e0e68fc6282822593f03d44fdb18ffa054ccc8012462865eca4e85a287a25230dfb2d6ed7cbd3e509b9de97b1bc75c47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08a09d17324057e586646b53d861c5d4

SHA1
745d8a9931d2f33a5cc0289e092868ce9f44758c

SHA256
1d4bcc8ae19a39a3b58fb84c176caddf488822108603d1c2efeabd5e0d82c6f8

SHA512
f949c8a728e78a4cbd41e5964aa78fd3ab82889499b3e85802f6d7a0eae2636b6320043173a9f1b80cde1a698bf3134ff70e0d5f3f2014afa9284cc1917c631f

Download Submit