50e841ad8379ff4543b51ac1248b1e72ad51da6124b6fdb6b87aa834ddc5bd82

Analysis

max time kernel
137s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50a24bed9ff5015c277baeedcb423642.html
Size

1KB
MD5

50a24bed9ff5015c277baeedcb423642
SHA1

527c8512bb36b0b143131b1bf68596c765e6492c
SHA256

50e841ad8379ff4543b51ac1248b1e72ad51da6124b6fdb6b87aa834ddc5bd82
SHA512

c2b8fc3dbff5cbf6126c5253f635121fac93654e9bb1b8c19cff74146baf04546b0d6b6c83359db96535947292045149080416f4d4e50007a9d381a810bb68ae

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000cbb872570c6a9c18f836de50bf158b661b687dd5ee1519fdf4374fae6831f17e000000000e8000000002000020000000a48444a40a70b868eaf3c069c933f1fcc180f69b1acb16deed8afdaffc7bfcc720000000947ba8a2eff159e8bbf976a65e6f1071a7db61018cc9652d1faee29711041bdc400000009c4e512c78f524cb670771311dd414049fe8f301424f15168c6023c106d25063b9443927b31fbe0797a356d16ed48d73f94c4bc2d52d1b4500ba5ee84f651655	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0766ACA1-AFB9-11EE-8D93-6A53A263E8F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300b26dcc543da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001aece11a124cea1f4ae7ad01240e73c5a0b740318e51577835185aed11738f68000000000e80000000020000200000007cdef17bf9373344fcf6a8ba2b675ded7da6d96d0404d2b94e97f1e385751848900000003e9864b254751e9f15a839591f2351a129b5ecdfff5b296588cbf7d93dcd118013c98c29d34848c856cd00e64e7da2abc1323f8fbd0c53573a5d65df9a8910733041788762df944c5e87cb95c3305eee574bf560d71dd61bc182e3ac9c057c6944b9fbcb166877e70912eaffe8b581e4490ac67c5bee12b7d35bb97fe07bd9f60a013f1712de613bf4d2f523e1518e9f400000000dcacd9b7acc362b25236d024b6866a8e14e5b1c8752709af31ccc915a16f04ac5cc12c1cf24e3d4f1fe3678c2670a88ce6be24759edb711a4fbc88ff77379e1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411053843"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2148	3052	iexplore.exe	28
PID 3052 wrote to memory of 2148	3052	iexplore.exe	28
PID 3052 wrote to memory of 2148	3052	iexplore.exe	28
PID 3052 wrote to memory of 2148	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50a24bed9ff5015c277baeedcb423642.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0050f57bf784399502be0d08fd49c4b1

SHA1
b804dc3924b9af60e592ccf7c3e344a81e71eba7

SHA256
c79c5af150c1e6606f43dbb4941b98017355bdcd11cdd69ed2c4e36e6bd0cf0e

SHA512
980e0aeac6a63191c74db1ba4ad440b5672cabac7f3b35b95dc1cbd758da58f64aaea1e26bf2db6ec29d590cc0d4d0c391275ef7c0b6b5c609e548b981029994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1097324bffb5539027d3b4ce280851ad

SHA1
f7782d3493a2a313344c8edb7a1c58f76841d49f

SHA256
8c930e85598e8884dfe5d841f4561b5f015f19805a0f326bd6c53bfd523dd401

SHA512
3c7da823edfbc312f27edb07322d548e2dee16f2a984789d14cca9cfe04120e11f50a470f79c38721e7f45e23ba31ad25177687dd3dd60c0160b7daf537c06ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
963f16cbf4eee1baf8501d4540152a71

SHA1
1a6aa99589305773bc794a4efcb1b9bf4df5108e

SHA256
1f17d769958efe49626d14e3cb29e96e0873f71d279b16e10a7fb724b1603797

SHA512
2fdd9cb1a042ef6e886cb91c227d7d56fe38b494f9d43c84915a42927ef54078fc6c90340dece0036b8ab61f7561b9bfd579b9e9d4a5c495f6235af66fddcfb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aebf9ea61326074ce9c0e95972580b6

SHA1
777a5422eae8812b1e0cea6d09fc9b06ab622159

SHA256
8e9280326ee1261606ec61a50d217fb81ea08ee6adb5d7c04d5c1dc8995bf392

SHA512
819b5af3b5cca60d01099c2446ca986f6bfbdcfc86a1ded21e68a7fa3067b14a00c2798f0601bcee2fca758797a0b60c5a44d44f67b910b0a871b02fe30b85db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d11ea372335b56fe2e2eb11e6e48b2c1

SHA1
f4da5c39e3877d55e03e90323940d3fd9bf730ee

SHA256
c83c663fdbeb5ba34cb363eec11671bc97e3db1ed8574ba5d5b7b75139536054

SHA512
01d810fc509aca5827e39fe8024fca12d281bb5b20bba4f4999c6536f83f58b919faa330ba702d1439cd2c4804eb2ad1f50876105c8f29e813024f82bfa67848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f737bfa245b15818f7c0317808d48c

SHA1
059a3e266837190a82f22d40c4b0e786200d84dd

SHA256
93ca870b942f7efea0e1ebccb475f52904ad2725bc2301c7380e4741940e2274

SHA512
839e75ce140847ec406ffa8ec47ea1cbbaed6a16c2052abec0b681f919a9903a8b5d87eb71eeddfec783155233482703237ba8426d2308306ce3cc0498090e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
217b68bef15730aa8b7921dafcecd3ab

SHA1
b838d5a3f0879af8b605d5111acbf2bad0cf083f

SHA256
29d5a5d061dbe5344028af9cd3278e483f33081481752b508d287fb374374fed

SHA512
240e2e09d8c7280a5eeb4837cfeb94bded4f8e4c1c4956b0edfd70957465bcd08c7d60352a9b4a164a026773767665f868d4186e240c456fd94ebfe1a5f04d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab3dc5ae6e5fa26601e25840147e0389

SHA1
dd55c8ae8d7cc774423ff4944c502bfe34f2efe9

SHA256
f1f56c35b05551995a84756a5e95f3b4dcb531ba8629b1fde68cf715577269f0

SHA512
45efee9dcf831fff2b8a978e1a0f66c329d65dff9ea36422fadacb3373f7b69869491f8e0da65d6501c07f44da7a2961b1e280a798478d5720206b3f28d20d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9b1c9aa10e0911686e69ace8e3d2245

SHA1
deec267c7b9a6ee45e6d0c1f0cf5209cf5554b40

SHA256
291f4969c5b69edf42a52888a23da06f95e11a9fa568bb17bd728610b4a8f211

SHA512
208c50af014c5083ae54666f48ff4f0bf7cbcd950d12a86319424b341acea96b645bfb548abdc919dba42826b65d92df8269f7941d7e8f579a6a83f1d41042d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a9577ed8c67f00998023e1fecb0e40a

SHA1
e55debf4e68225db69d9c11b06f44e8b4e25a201

SHA256
740e3c3377d7058b0a8b2e19ce728ef6463acda48fb26f27c384ab0399f5ec52

SHA512
75232ded890f7da53247d27130c6b83822399a20862276f94679587bebd7661c33d641df85880caf2c6070c8c7f7eaaf87783527a7dd683fe745f2d4bc8c74b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fcd95ebccd0ebe79900a0b70c0b374d

SHA1
5e8c88141c0c500b0216ee35e655b965727700cb

SHA256
7548c46526057bd27cadfee58111c14c8387ef4dd7ced65d5e209dbef66efe91

SHA512
ec10f5dac2030df2042087961b62057bc1c41fd875863ea17f4ad0ea30ff7674cdc50345039972dcc20dad2099dca5ae9b1a647e30c67db2346911d9a216cd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e99b5d0f8bacf629bcd809438f924d8f

SHA1
00a991c56adc49e18855f9dfff20592d5196395f

SHA256
b3037a3f80b0d689f3277bae9aea7bea0baa7d13d0870253d4127000dc68dc2a

SHA512
9ee96cc9134e1e2079ed126252c532bdb1165c26ea5f86f2f00f2d185d0033c1992438d6e2a3ecfe7de06dbddceaa379af630bdaa7e232853c4b105e473368bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754884d453b1f704c19baae1580dca02

SHA1
50881f38188886064dd34fd34b61180c9e315de2

SHA256
b7652a08a79fcf5b2d7479c30075596690a6b51eebbdcb15bbc552a98c397828

SHA512
7adf3c538ce51920746be1870a76a1e8c46549d0aa3312654dd9d0a91e62c8eda7e7490f3370af941ff38cff74717c3bc48601ea55692c67b43b6c2863122c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27BF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar288D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit