99ac2c1d532fe9790ec41f380c9c6803717de8e050edaafe74cf9bb3522073aa

Analysis

max time kernel
122s
max time network
165s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50cef02f6e1648b558dc79c31aa86fcc.html
Size

14KB
MD5

50cef02f6e1648b558dc79c31aa86fcc
SHA1

60d30b84eb2beefcc8ca100e3e05cbd460f96068
SHA256

99ac2c1d532fe9790ec41f380c9c6803717de8e050edaafe74cf9bb3522073aa
SHA512

1c24033f642e1c10050f228ed690b0ef543df363c02c8ea77c70b7696c31e51f7b42bf5725b0771e166bfb08d5126672973a24b962fb4c6ece8c5e8fb2b200c3
SSDEEP

192:Fif59NaqCx3a3YCNrRCxtiVwAG//WIaSJU2AJdbg5DYpE8o4C:FyxCx3aoqlatiVhGGIzHADbg5cpE8tC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a777b029553ddad60ca828cad9f184ac8a0488aaff7264aa9a6338e858ece89d000000000e8000000002000020000000c94a2710c7ad3faccea8278e6a70c19d5dc93043e372d37ddb0fe08a7bed7983200000007fc2f1d18fa2949057c3b363180eddc4273dcd002d1cca8757c39452239a4e6e40000000af6d9750578b8700c54365a729aa412938d420be8163bc7a8b88f3c1db16bde3bc71e8d73580947a067d2a1cb028d9cf4d354a08b66dc8796ad639ac53127a1c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96E42911-AFC4-11EE-BFFC-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411058814"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ea4cbb21a5d3a798a4e54aa34530aa069b92342c4c35517539cf81cd95c21581000000000e8000000002000020000000029e8e043ec73f39023c67fb5fb4130fbb5a1474a131ae80b3637d3263c62ec390000000886a7503c4e555e0c368c8468cdcf568ad9c41fa31b7b5180f13acefd8406ec9cabf1e96e65da30dbaa8798291ae1b0ec55729c1d7010e7f674e259e3fe20a9bb0496db06b3cd77bfd1eb2eeb004343bff447819c451e06947539b5a656aef81f852a8ec0b2092056f55c28fe242bd873eaa68f8e5e6e780937f16777fa1ee6c682ab083e3f90ed4f45658c8ca7f66e040000000aaf46a308177aea75a48ed21a29a738dcd7678c7007ffd8504ef59099cffea748865b09b467a0dcd8d04ac189ac5bd092600134822bbe67d6b01dcfd82a4dc57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b6a77dd143da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2884	3016	iexplore.exe	28
PID 3016 wrote to memory of 2884	3016	iexplore.exe	28
PID 3016 wrote to memory of 2884	3016	iexplore.exe	28
PID 3016 wrote to memory of 2884	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50cef02f6e1648b558dc79c31aa86fcc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a42ed527d2b8d2a2e7fe0a3ae32896

SHA1
6539fad3d73a5cf007ca21d64bab7178ac156da8

SHA256
cb293d52813ae5ebc95b032c2eb4d9500c7bb44ca4283b3c5e92c435eb18782f

SHA512
b689545f173dc3abcab58860c4955fc2a6d40bd335c42abe93a0d265244ef5d49f298a2bf77c5e1613c2dce6144aefae9053db4a41398b3e85e59dd62ed72035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dae9249b33430c10157fc3c4a1b49213

SHA1
159c79dc1911c23abeecfab4bb9f81d9c9947144

SHA256
3ce6d281c2b5f73d191feb94935e5fb33cb3562cd1051de22545412b13141b98

SHA512
671607a6d2f273f6d70715b1935c904fa421127c70a46532aa8e2c1d2159b967abc0f186e87fd1e3bbc2b378c283ef3de8b43c6e5c926e598848a90650856caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac08572666c5a14e1af1505a43dbcad

SHA1
c3b5ad7b79b2b6a24551d190cd1230779646e1e7

SHA256
157abf0b1b5f4af25397d6cd8b5ea807052f68f987707420bfa2a68216a91d65

SHA512
75ca7bea940b52b663dc1cb982ce5dcd111219a1886d36c9f2d738a63092a776cbb30d6a2517a516b1049819978a0bcec88fb4311d6c4b60f5b1fad999795b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc7427794a387dbebc70c0fe15ec2c9

SHA1
9633956d1f3b86a0ec0844ba55ae4300e5c04953

SHA256
cc8420c3c4ea9a804d4f6b67fbf4f1f1df27e10e067c632a37538a0ddc095979

SHA512
15dce1212a9fb05801ae0750d861788baf23fcee82c806f6ac894442be293ddc722368c79135233e43dde474fd3b946f222bb763f6b3347c85c1f6dc11c08d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0ebf41bf2dabc0615dd07e3729215d6

SHA1
d311c5c3c2ce1070b1f1729af4b622c2efc9a0f0

SHA256
6d60bcb5aeaa2ed0ec576f450afb228307cfeb2a76d280943bab08d95f935d30

SHA512
b8ae4c3387b5e6f88435c953c56a04e53d2512d898ef44173a5c1ef74a08f91cb3b83942c0737f365d225cba7c5cd4c19ce0f788b02e33d5e1ca3c1aa4cabb60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf47827fc01c7ef102ce856a57763184

SHA1
906d42fd18c24d3a4b035a67d77175b3ed2fe45a

SHA256
7b148011ea071100df3fd10a3974324be9803635ef3911e5730124de4a9d40ff

SHA512
ac3c2052e17681d86b3f0604d33917c66b4745fd62820ce6640da04c1ad120bfd8c56f699649fea0c508228d97a495ffda9358ee50c32aea35c3684c2bb26472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf6c35912fa5d4f93be5c5099dc38ff5

SHA1
e34b6b2b8985b3a4e008ef92db82c450527b22da

SHA256
a3d8deed6ade33db3dc62197133ffc0700729ebb07677984907101f007c76ea9

SHA512
4e230a0d0091b33818bdd106d488dec01d5022b1d2ffd52e7081d88b2b27290fdda040855af78371aeb573b274c94a709cd470ed043c9c1fffbb16d14147a3b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ac62986ebc02ccd39026e06a7efe7ed

SHA1
14d459ac05dc7b7f0b8b10d162d3100c983737bb

SHA256
e525f47874b1481e3cc3a4c2211d8109cd245fec70a8bda4e542febd797d099a

SHA512
be9d3f069b7e791eb2fde404725598c94768618c1dfed8c25e6b4ea37bf4f8b8f57715f127d2349b2a23174c97f00c2f6962368253ce6a8bcead722c5e37433c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc42ea632d6922912dfd6cd0cf60597

SHA1
7b6577f4ce1838eda0e319b3b3dcff19401e9870

SHA256
f9fa37aa241482c125c1b131e5779d56828a56dc0041e39e87c3c39e5395e492

SHA512
9ed8501ce059db279f1ab8fa84921ad4e20e0952f566e8c0df49c923a4e0d48eddc8a1a35abaccfabd4086a0b0e2c137c4c55dd4d35893b4ef148baf0d50a171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d255df7eee204f1898b28839b3bafe

SHA1
e51fdae4ca0bf00d09d0bcd53a702ace2e38e3a9

SHA256
3cbfe4189e52a726134ef24243df9a9b9786e9e664286181643e44b61c35ecc8

SHA512
27516100f90aeb383457ead8b4cccb9cd05e300fda56d756598a6ba41f1b4bd204ca5517c9e57733b2a25e13b473f396ddf628e25f5734109535c4e568a1cec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7334679d4be34381f2b39e35b006b2b4

SHA1
10adb2d67731dab909957e659f2bd7b311ba5937

SHA256
48dff93fc2e57cd6792c1baa7f96c4f3a957bba6a61d18115d58772460256ca9

SHA512
365a027a427f1b034103f43db4d1d03def34e3e55bb30d0c07b9b7fe6fb455b220eb991082b623383f92a77a759ae72d8187bba9e4dad4df49735f66587d99d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5d91941b29e69154a32cdfd2c0d8d7f

SHA1
cfedda9dffaec236e554123c9a973223fa58dfb7

SHA256
ec901e4dd53f6b4bc118c21fe6f6eefb8f69d1baf5c5ed60203dfab3150ced75

SHA512
6a0ced2e0331913ebb5cdf2f1c59ecf759b1966dbf123c326ab6394b2ffc3e37e1257ac1b866e3c822c199abb93fb47c28cffe61141b00ce5168a5ba4155aa51

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE072.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE094.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit