e50f67c5cd756467b20e1113b321f03d55aea4ff17e5dd7f024e9c2ffb938744

Analysis

max time kernel
144s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

473de63c256f6b6760e96bbc012adcd7.html
Size

10KB
MD5

473de63c256f6b6760e96bbc012adcd7
SHA1

f7c1ade323b2dd8acd3a06b74e16c0ef3cdc6ea6
SHA256

e50f67c5cd756467b20e1113b321f03d55aea4ff17e5dd7f024e9c2ffb938744
SHA512

e78f3a43672306a07dbf517e5cbe3d56b6abdfdaf2d7dce5f2809ef2a6245e6283d61e18584828215dd3e68d620a31c8f031e8cb26b9ef128aefdaea068e8dc8
SSDEEP

192:csz7p/AYS/UIo1Cs1COQUg1Cs1Cv1Cs1CGy1CGyyy1C911Cs7PHb76f:cy/AY8UIo1Cs1Cv1Cs1Cv1Cs1CGy1CGG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d4676997c68c9dea12fc88d33aa6935cc5e4d959cb0989f02a05a5003f996f96000000000e80000000020000200000006b541602b8d1ce894fc4a31d129afdc1501e4af85a92df7b3c954cf6251dd0d7200000004418ee5ced72eccc8e80a1f5d8d2c40845f5b895725f03c1bd87cab504e0298e40000000d956bd6fd1a54a03fc5cfa80200b798ccca836d45cd3459fad891883f05512a41cc5c62b5f361744e77932ae2913db2218b528aa372572851fbbed3ea55ece86	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF0814E1-ACDC-11EE-971F-6E556AB52A45} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02358a7e940da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410739358"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002a571ffe9b0e540e5f32cc0a220755e0e20b25171ab9f73a3873da0fcd163ede000000000e8000000002000020000000a55b409de5c957c5a5d7f7e030ab2610aff462d7ad0669e9b878ddf15495d30a900000005c71173b2a06fe0d193168cc37cb1cd6ffdf71a5f702bbcb06febd37e5a3a5fd3c1a7fc95daa03aa75d2ac8cbfab75b0b45529c76ce85b703a53ce3957d27054e5bdbfcd2ddf84d251395b97d93e3d91a6a374626d84f7caf599e1a173bb018b1f4b49bfcee9bc5adf9bbb77cdd215c22b64b298f325db3d7d885536a15a74f61bf52ebc63f2f2f902835ca867c6586040000000c8daaf134ed7bdd71b46f9fca7b58c48675b856d1eff11fcd88227fa568b64a7a2e910c3d22078a2b9db3ddf1e7e3209856ca87d74dc9d443813bcc3c71bbb3e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2272	2004	iexplore.exe	28
PID 2004 wrote to memory of 2272	2004	iexplore.exe	28
PID 2004 wrote to memory of 2272	2004	iexplore.exe	28
PID 2004 wrote to memory of 2272	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\473de63c256f6b6760e96bbc012adcd7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01bcfe980a7e3820ea8aed2630374e1f

SHA1
94db7daac59fce52f408bfff205c41f35a5f8496

SHA256
6a1f599f52759cc49f2b22819e2691b5b979a8a081f088e614f3483a3e35e560

SHA512
0848c54838138d0946e1a84e2907ac86cd53f992deccafdded9a4333eae9bd3cee870930ec4bc4ecdc8af8bdcf128842bc88788b49cf7cd84809d7629b04e013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50ac230f282a3c51304aa4b539cc6c6

SHA1
1ac1ab7fbf0db5fe1955e32c1c6fab55b7e787ca

SHA256
cd8e01a0f59a836fd23ab684a48cbd8bdd7ade4e17e75f4eeaca2426f470a84e

SHA512
639518aa454827a9df40a10cb49b5e9ef6c9f1d4a00142fc2f316ad446d4edc7ed811d0147a5df1c6846bfbf89a3fb561a16e0dd6b30b5b69b16f5618450b3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0c3871e1d7750e957aff2fe5a51718a

SHA1
007cfc9dca6d028992f64c71e59f19c3b63014b4

SHA256
fc1eecf8dcaf889c6b619ef7eae80974fd823fd5ded758be487e6a0f3a8f1f55

SHA512
fe2f8af21d4beb6ed76f009d7a7db3f2c2e5962f837e13f61ed45bc597821d746d67074a80f2bf0b41522fb38048cd5429735c403b61101dd3a52e60a9a4221d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc695569ba91d9dde8fa2ea1d62489d9

SHA1
3c43baf7ca17db37b9a6f48759f968e5e35ef162

SHA256
b956db7e26229ec50d17b72b236c58c1dbeeb67d7eff08ffe4796f00a0651688

SHA512
ce425334610938100bfa98f9dad3298426899f3b26903d1b5535e7f3c1cf68402e7e2563b8c689f1ddb6cbf92b92922f0ca460c67471b0b8ad32f12466e0bf6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3e2a1a18c02af405806c3d058c9f9f2

SHA1
7ddf87db151e7fd7ea582eab84512801c042ebe5

SHA256
b131cdece281bcecdbb8fc2b17977be98aa6c615f18b64606eafb1d0bc6fce92

SHA512
70e0e2d6d7af5c4ced5b7b415c54647b26977d9f110577e8b713b3ecbc120553b553b9395f5a548c69f30727ccc609f228a260aafca8d082106a592b93a1172b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce14374511f8ae76f1e39ce92221a8a

SHA1
96dfa2a2f9305469a0699c793029c9a701535f3a

SHA256
039e176668479a376e6ee29ac3d5722a0e03f231e3fe2493cd9d705417744ebd

SHA512
c7170aa3d1d98334ac697d7f3e61760634851f66da4134458b0129fdec8579a257f2a9bd7babcaebbedf947a718003ef0a4e27583003bf9a72747ea8219541a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a7be62ed27f9e20d41d9be6cea06c7c

SHA1
9686368a5f15a595c9b9b23e180c090a215e8629

SHA256
0f5191997003b9cc10075baa6b1eb4a3f68a64e16fe256da89af8735accce87c

SHA512
806b812ce9ac79516088e77d6c1b3e9475095ed1052e6c45d06078b1d4f0f937461e4286fb3ca6bbfa5d0999ad71fd922bf314a1f8c6439d3a05e3f030ab7054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc62ea5b3939261237a65d0ecfb75ff

SHA1
4f564f937f50b059e429265ef27b602ee23b4e0e

SHA256
7bd4a9eed5d87bff542ae976e7858c7fa897ca16cf017bf3596cd4df941db430

SHA512
49ceee0a8cef02f893aa9920ec2e35e301a8d2725f0fdeecb7b88fdd482aad36eeaa2ba28d683419144970abdcfdb513043160ff168675b6ad1781738c1ff0de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fdaae23b3bf00a3a54fe2a4a211d1ec

SHA1
3f5142b7f17722e60b88db26a190756d81ced815

SHA256
8f69330e1ae37c93d95e59c80c6bfc6d1711962b77e79185754dc78d7fae511f

SHA512
ebb70ff43a06f5d8d00d0eab1791f68dc0532141b5d3c5d70d90a7d6f020d3d8d6520a8ee9e2b0b2a36586828316086f8a7bb143d8b26a83a52ca0114868e1c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e436ec1f9642af2d5f26ad7c9880d813

SHA1
936d13a2ce4062e1c32ec0ef362ca5989cff3e70

SHA256
440f10e5e48b4eb9cee46916bbbf443030d5f9065f8346fb8f12e413098226b1

SHA512
88a39576e1af3669ddc1272ff7df27790929e55b3ea5026f66824d1a57bfccc20d60e0878bc8f8169e2ff0aadeec9cddf4dc0da7dcdb9b9296d346d6d9e860de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9615fe67060148adb81829e47c2a51e2

SHA1
f311a60e698952ac9612ae5288fd537c0c2355d7

SHA256
7c67a86d8fd6d73400176bb744159cadf1d3acaee1ed9b33a76cb28ee15d8f57

SHA512
6062be21e2558ede94ef44b18c6b317efd9a6a57b94a3b3f239c3e69f7bd43289a8513543821a2bae0f0e0b0587eccb848ed010bed8b325351aafc90bda8e912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee6a3beafe7888512536f2c065852262

SHA1
1795133d1aaa98f38c014feaa29ab23230d23c6c

SHA256
61c27c1c66d9d63c41e8581305c9ee3de7e7b04d021b2b7f6e2c9faf0c59055b

SHA512
434548614e5355b2511f44fca33eb98a0256874d83c1168d2d3167b39c84edad7bce9dd9c87f0ef59e49858c08dfeed8b77906eba83d428367b0c1fbe153e750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eddf520e7b37c82e4e407c694cc45a4

SHA1
9a7a3dfc1e02c1b838eed94a3cbba14feb9eb7f7

SHA256
47f3640226107027fc84d9006cc96d4a1a2628ac04d04e9d8569ef60fb5f8ca5

SHA512
77435cf1c8acd5c6be57ae2cac5f8929fb5e2940e71823c2ab924590142b2381960d2f256a1f36a3ea6ddb2ae4eaed0be02294796503dbb24567fbad84f0b45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b75ffc3b0b93046c4afdbf6fe77ffc06

SHA1
a65a4db1651e1cf5ab38cf6c0474e7b70934f79d

SHA256
d09ea0518a483f4fddddf2bde4062b8ea58172c8a36fa43e7c274e0b5d4db91a

SHA512
3c52e3dad0800eb240ac2eab8c647721074db4ef594e5f635ef71f902b90ae4c27c7bf9998742b0c2caa52b70177b41b989ba80af9b4f9533e56e681e04b6adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9215.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92E3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit