57d261af4e03be45625c50c358c6d9314878f1ebbad34f903779424afc3c4d2a

Analysis

max time kernel
118s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5050bf96d119b0050bbcb7ea18372b2b.html
Size

28KB
MD5

5050bf96d119b0050bbcb7ea18372b2b
SHA1

c6e3b389c302691556035974d56aa3f1565addb3
SHA256

57d261af4e03be45625c50c358c6d9314878f1ebbad34f903779424afc3c4d2a
SHA512

568185318937d5d3792088dc8d0b1ee6d1db86391322bd3808b410632587b8a58c5b48f7c711e380a623e50baadef14c3dd7c193cc497855f10eb1dbc39fdc61
SSDEEP

384:CZgfUhrNPycCHOKqBfBqzLV45JnxTVDGlIlE6SG+4s9P9XR8H1TGPGI:CZgf+NPycCHOFqzxWSlJ6SG+tX21TGPh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000075cd6cf49671625d7867c43ffa36e545c32a9c51d12ac22caddf14d2fc52b94f000000000e8000000002000020000000e9fe289c2e79ab71d51667445c06e5d67713e656418a5df245d199a6c053bb0e20000000bb7d26cdd7cdcd131ef517fc09ba472293415cd150a71e33867eeb47aa7c34a040000000fc9907702b925ac0b1547e548ce83d96aff42570df057f8a0dd6f3ffb04ca2c62cbed041146c36e9dab15587ee9a2b7ff8294f98368890e8ed405022787dca05	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411044501"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000b43f8e40e11ff3bdf135939c3cdfe0ca253b3e16fab55b8014d101bc0421b95d000000000e8000000002000020000000d58f7521bf644c77316f020af4342bc39e4c2d702b6129e224d75d3fb467e9009000000088fa9fae7c4e09a00dde982d28bb82bede1b665bd9ef83a7d06f86397be57b9f298b8f0c1effe7c96d3da2e416920f3fdaa66a391010632fb648585c968c51e2cafde37b1804056b1b898eb530d3593f1d3a708bae0a2648cee55f441ca63ec12fd8b87229c4ba2afdb9c329e27a2e133065b9babc9400c1e229d07722c2b8adbb4e21ff92688bfd65751ae6b6012f3140000000ea1b750d864fcef7bacec216cc6dbacf19aedb1e825d24ac348b8dd43623e66a878b2846ba82333af52eecb128bd6b84ac4c9487b8f674f4dc9f9d2aea4f5156	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42947E31-AFA3-11EE-A031-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001ff728b043da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2004	2996	iexplore.exe	28
PID 2996 wrote to memory of 2004	2996	iexplore.exe	28
PID 2996 wrote to memory of 2004	2996	iexplore.exe	28
PID 2996 wrote to memory of 2004	2996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5050bf96d119b0050bbcb7ea18372b2b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e927fe4e00855d32fdb368a5b33a2c29

SHA1
2c8e2283ef6963d08f437fccf857946cd0653fb4

SHA256
9240a019ad394d112588a4000f044628f51943e75d7728edc342a61cbc67e642

SHA512
dc3d36a1a91c59178573d0b779d0b152f06e71a8065e5bb36a93cab77eb719a02e40933a13d5e4f989ee413fdb41a68d160be034cf50e643493000ffb5b4ca39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0477a64525f54cefd213868b3085b479

SHA1
6bf5f3efb6f2c7b7911f07e2da9839e410306b21

SHA256
cbc0df8ebb40b35b55ae2b8ce27d409cb7e71f6a4e3578a8ebc054f44b1f081a

SHA512
1bc23d926d99ede4e57676e73a98e6833092db8c49d3616c71c864a79b88ba58e43395856e04e2d2c73466aa7f19f09414cdf556320379ef24c98838127d0ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d335c6a5544c85b01b028e987e86769e

SHA1
a34f981889167f6b6a13b8251e39775ade844a40

SHA256
69f43e350b3a692df9dcace5705487df06a1ca45a19304c164cb42f6cd428ff9

SHA512
6c144bed074851201c58bb16e6b324a09f0e4b71a0cb6b1494fe922b85a5b50a541419096c80e7274dfbbacca31113d934128e8f736b99832004921e849d51ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf90bdbf19d41c3a0a89fdcf5bcf3de3

SHA1
b37316277ca9b336a6835d00582a046db768e0b9

SHA256
e2fd7a0d7dd9c4354858826eccaf217d63b052c409b15cb8a47ee511910888b8

SHA512
eb057c3cd63b4864b22e6f781e351e930df0d5035a8aa61d490fbbb55d3bfef0a4f78187d33c749ef873509cac015df22e686c949392b0b3353eb18ed3b9c742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f1f047e7427aa5ea9f1b380fd36f09e

SHA1
0cc096f0d57c58bf63aeef37e2c96b80c95a2243

SHA256
ce7bc690a0028e2dd6eb4c1991ecff600c69dd52e5c2ebd614da99fc3231dce1

SHA512
dd9d60015c80481fa191c6d1b01a347fad80ec0bff7efaab4810364bb4150bbece18e40b28ff5b2668a483b9fc1d27f06d84502dfcb3141a80a6360da6bcc860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d3b577a9e6956f2f077efe201f18643

SHA1
e29b1d3817bfbf8958c7e7b7a24698844c2e4a23

SHA256
febd8879d6acb976d620b86d1da9d1fc178bcf671e78038428a7ef5d360160ab

SHA512
3f216ae918fc22c46d4f16866f47b166e0be2add7ebafee5f377f5baf0c92c5b1186c9838225ea01e3f577661258d6b602899ec583bb4bbc8faf13d6d12f38f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d95a93fa552acc24ec0bb1210ebc4a2

SHA1
d6ebc1772a445f18c111e24d50ca80044b60f33b

SHA256
9dc5ebd508029fb0c50449e2af1512bf05e8998563a5d29e7b1a5863680dd441

SHA512
a07aec0db060545dd29320072d22165f9a06832d0e98b4b318ab14fabb7a88786be2b3f7fe9cca10f6d2d9396f6591ec983c88ce3a799558af08e1db1a3dc0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1185b5a4b271f771d09a814ebd7c5c80

SHA1
76c2ffac215d00d84db37bb11bf8bc21019ebb10

SHA256
beebcb1ab64ac318a5b3d63f4b073933065931b3f7ef56689088596a092b5e44

SHA512
35243232d92f0780d6ece264350fd1183d9a01895f7c9914bdb761c5872472138f79a171e73806eeeec0b84b046c0401cd8fbf7577d39a577e202e4090154f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1814ca95b41c61408f95d2c965f28d2

SHA1
12d3ae7a299e3f641d265098a6fcfa0ffb8b7079

SHA256
79b3519b19396b3b07f71840835620805927cee150a5bd247c62a5c8b861f912

SHA512
7c96ff933b98a320bc444852d1cfe83bec0bbb54d2b07f797a4cafdc05e80418b1e1ef53477316df9e8788c4e27b3be9deb7ec3e2ec0b8ad8f7b14d1cb0bb392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59bb724f098cea1f574895e2b9f2e841

SHA1
a69a76225b604471c783c1a499a238811d71cad3

SHA256
c26d23f0ea4ef4db1b99f3d3c3f18a193d7687f89ba1d3fc52e572cdcbc94472

SHA512
28b39ac5c5c4cff8886fa9dd71ab81b29088be23b1375ea418240d8b2eaf835fa11b528dee8a4fd60f83a1f76b9dac3c600c84aaef19a4ae69392d5326fe4610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45fddbefd1c1d1822ed897bed2f4cedb

SHA1
b88a74b24fe29b077291b98312f4639a5532c58b

SHA256
2f7991bd4ddeb3117c0b85d62da45e2ff1141142c722d4265832604ed5601926

SHA512
c2bf1f39a40c92f03eeecab9843b1431b458415450d9aedba5b3e6d130af127bde0464c0c4e54054e428934328a7537f69df4eda441042d159d737e0e497958e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEFB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit