57a1cb5ff5f7f6aa161e22d3ab6b8b08eed673a56c0eac6b3ce64b9ed230658a

Analysis

max time kernel
142s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

501eeb6ab99eb9d3d983258be0ce90c1.html
Size

7KB
MD5

501eeb6ab99eb9d3d983258be0ce90c1
SHA1

4b7f7172e56c27aaf5429415a0b7370b0d736cd6
SHA256

57a1cb5ff5f7f6aa161e22d3ab6b8b08eed673a56c0eac6b3ce64b9ed230658a
SHA512

c37eeb8f8bb2edba2aa1dac49c33000faae07229f6034d82af8907ab8022926256fb84534a3d923f10ac161e501636df96399e3ca9aa630ffe8a49c14a774f23
SSDEEP

192:vqIzUUpEXVg7nVhiBfpIgpCh4W0Cxhnl4n:vqWUUpEXVg7nVhiBfp7IhZ0Cxhnla

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c1a7d19f16e41bcf315aad61bcbaa4533285d6d9575765e64d08532d5bd01ee9000000000e8000000002000020000000160a9c754a801b6aabe3643ebb07618c698ac8b56b932f44c1478913076a15a8200000001a0cbb3cf78d1e013da5d3d1aeb6216808d2268817f92e204571ae53c71342984000000048686348a78eb931430cd9e1aed5f426af38b5504df8b95318de5cfcbd25a609dc2111ffd4b3a47adeb52f9b63928e10fa1bd70f00edcdb1662cd1062fe48ae3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603158e1a143da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B725E21-AF95-11EE-8420-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000648b5cf528d0849a4455f926ea719e708ae7512dcfbf6920d28bbf874dc95454000000000e80000000020000200000000ac8c3ca748a0c89379f224d7de0eafa831858a9c01845fe879c3d4f704804af9000000061403db2a539922f4f570bf3667377af3ba900e13726a05b41f104084d148390ff9064fb4d9f68e0f89d0fc009bbcbdd99f2a3676a88ea2f8cf4d356a1028849f0584959c4438a4ba4402b9f0136ca460aa4c75ad544ca8cd2efafed309b52aab85724a9f47fd5b124bce846aa6f7df14ddf040331193122a44f52f700c4692b996718e14f2f5b50eda0ed654ee05a2d40000000436f2664da1c734f950895eebe3477e72f3d92626339986fc0e6372caca594c9c18f471da54655aff9621192029249d918255cb62ac15185ad0c3fd7c625911a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411038412"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1200	iexplore.exe
1200	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2736	1200	iexplore.exe	28
PID 1200 wrote to memory of 2736	1200	iexplore.exe	28
PID 1200 wrote to memory of 2736	1200	iexplore.exe	28
PID 1200 wrote to memory of 2736	1200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\501eeb6ab99eb9d3d983258be0ce90c1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b71337ccfdef7f1c3f80ea8af138d23d

SHA1
6063f403caee322d7ff915025f8f959aa8d53ceb

SHA256
95b19ffa3d0ce0199f19b8c3e06feb72071c666330b56895f9d09e7638539fe2

SHA512
481bd44d8bcbb4baa0244e6d04d9024f01cdf4326c111e78dd098c37c46e1361c7fcddae76a93cb713c1e57ef4c119ef234a4dd5f39a8cd25c8f4ef9f1faf44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7048a5e53d7359222439cef88adc330

SHA1
17bbed8cb3d391ec0f6fa9781eef89bfec7b097a

SHA256
59a39ebdc00c79ffb93ed411959491a302745a6dded93e95c6bec83ef3f98bb9

SHA512
bb59b1088fb0e251b8dbf7d963b98c981c4a7fea6de5a9381f3c8cffc838f3ab964f3e41b1f5bad4e4a31197d40940235dd6aea54cce80de5be4a8600bf5fd58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92f5ec882afc23d26bcccded5df21fed

SHA1
895a3cbbeda5b119065d42d88e90849a590c6793

SHA256
93a80129a965b9d2e0abc44030129daaf0aa6354b6bf8416538d2f27d6490fbe

SHA512
7f8a472a60a6b35fbf68d46c42361754aa7d8fe46ddeab64c7abd1de9f07b7ebf93b5e3281c00d62d8d9d530dfb8bc8c3898234b616d616eb6ad3687520cf9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b5afeab52139121108a8e9debc55c89

SHA1
470339d9b7562b7af350fdb25b2df6c2b3946e8f

SHA256
41635fda20f86bc134c09a2ec351bf6b1e7f9559ae39c1d659d320ffbacc8781

SHA512
232f55af8464711271571cec46d3507b7c0d8fea0ad5729fdb6ff31e824e3d4966b0c11dbead4985a5b50e09f0a6f15767edc12e03863d3911d69519b44bdbbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a37218ca6b5a5455e1e70984f5062ed

SHA1
70ca7a0309291e63657a4156bfafe6b0ca8d8547

SHA256
d0dd747e59641836369d7bbc789977bc280d1bdcb60b16b4aa6773e413c7718a

SHA512
6a63f8a8be5757947e3ccba1b6c87a162012f1c2a4e5a1b1d124c889fb5cc193a9db196bbaa19b443bac88dad02f971d4393db26841270a61fad2fcd7eeaf8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0035505043083bf3b67ef6edf64c16ac

SHA1
1930baeab1c53d47aeec34c7a7a871d30cbcc324

SHA256
41c6d6d868599138ddf817194958a70000ec65f9488ed72da389955da41a6350

SHA512
708c368e349eeedfb0961e676153f260a7020fef81445fe3573041d8b21df23865270d0fd169d6bef4e1e8af780c89d2fd1c582a421c56acf2352bddd7967b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d768f963fe653b66f317a73c6ab558

SHA1
5e9ad77c56b8e0d76a30092254fc2c50080cd8e2

SHA256
b079139861b9b1789d360473f596e331daead987eb4409be88a507118be97663

SHA512
86d5dd82d4b8162ed979670eae851948f6336806c8a06ae0c3e223a4b59a3bee6cf34b85e2734d8249f55211c639c666a71dbebb2c045e37de82f510ba29d7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99ed6c7e96968962539058bb0add3c33

SHA1
447e6b1b33e6c943cca0d3d2a925a52fdcd5a60e

SHA256
87f884c7951e01383cf1523c10d673d6bc52f8b77d812150812cb44017d53bbf

SHA512
59697b6a5687b52f4352ac35e1ef0854d15b666bb2dd0f3dd962637877830325d3ceac5d3b03519e38177d1af79638ab70390b340cce0007fe82d0de122badba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b93494c14694ba241b9e4791f1ea97a

SHA1
5a1a00f65f11386a9f474cd3b244321b7c136f2c

SHA256
d25838ed4d3316e0924a2db320d1b179a9bee573f8f646641dc885b67c1e8194

SHA512
fc14954cd207dd3ca517c8ec617e84aa97fa03ce0ac4ee378e115692d0319506a1f32cc46ea9d7f0b0b94f87244b80f6fb68ed3521ca786cb7f81f7b7c54d3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
836b61060c7a628fcc1544ce549db714

SHA1
e7738a3535241d5da16a825b54efaedc076612a0

SHA256
64dbd0c29c6602471c4aee992f813f65cff9d724bfe5a163068ed41ea89347de

SHA512
7a2281f7c5cb5c2ea60fae6fa753eec6253f8734c742f4b29b8ebd6063df004e15b0f05de498983def2f0fdc8426c1bc4027960ede3e6c85b5e33e5c6af0f4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae85ecfc00ccebd169dcb71e61fab92

SHA1
217f35708c3b464b90b3d6aed0569e372d3388c3

SHA256
66d5decc77583ffe428432a837fec7cda7150491e0fac85551b38f58e6244077

SHA512
d11eca26eb83a8878666fdb51f560dbc6645f18d3a5aa46ede7f15c30b96ae5db7ca2fded944a80a89354a30d00e6339228cbc9c39bb8cf8f40289d135f1c130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5017034136aded0633f41f1a7edfead

SHA1
e47b45d20fdbe541196264d5c7d34846295628ac

SHA256
1a81d6a8a9d45749660235568f298e1c0dafb30726aec86d3cc518f484219fbd

SHA512
3df106fd984d8f820efa19592670608608bccc1ae49571c2bdba7a89f6a70b9b8031398c45eee787fbb60a7e23b1edff0042f84840246f7e3b56c98345666fb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a400383828d124f891e5712b7d62c3c

SHA1
d31d71f6deb1acd81387d6a92e542212857356c6

SHA256
8302a0b901a600e8ce19ffe3616d976da94d7576cc9ac995e01c56ba7fb57257

SHA512
8cc70b0147dd02bad15a4a7f0f2f36213708e4f7ec3a21be4b8f01306c91d1970476c47269327897612a163454ff87ebfbd8086d28a1379e76686a831936e530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\bnKxzIvdT[1].js

Filesize
31KB

MD5
59322eb1e702e43fa4d4104c80d7770b

SHA1
eba102cd3fef8270e8703d15efdc3d0d0d4f1da8

SHA256
42789b56ef9ea52e8ecee805f214f4ce21beed10147a76cf648399f20318ddbc

SHA512
9e7f21f9d0cb51f916db08b23eaca13bd9ba77d235b670d0f85e867e6300b9c9974da21fb3034b5c6158743e71cc6f29dccd26332c282184c105308236b3c7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab909F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9524.tmp

Filesize
64KB

MD5
69b8e2fe3bb7142b759bbc3bd3092cc2

SHA1
c55b032e44415d77a1a2f3f6c6c049b7cc32afd7

SHA256
d31cf766104ab57466eca8c74b0b1dc3f7729270b60df98dde747087ec3e8bb4

SHA512
c3b3ca6861a0e35822f0c5b6085f7fc1444b051548aec4362723d1b7a14b72cd832335ca29eea23ce8f9fb71f4ac76c6bf2b58a220722e7843461bf095970b7b

Download Submit