e833f6d180ab89527ae432b3388faebab8d02c6326f7263aa68d5aa720da4be2

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50fec7c1f757880ff96dbc3a0dda8491.html
Size

432B
MD5

50fec7c1f757880ff96dbc3a0dda8491
SHA1

887f4a8838f51ec140679eb5b515eb422dd3a852
SHA256

e833f6d180ab89527ae432b3388faebab8d02c6326f7263aa68d5aa720da4be2
SHA512

2c91e05d6d00b8b3c3e1f3fc0ab0520487960c7509877b0e8c52172c100ad6ae592c2efe19b12822798239264ed2e700d314a6fbb148029481df816244658b07

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000dbc4d43e207240bab13ea30aa8afc3731abaaec221f87ced4f8771716201efba000000000e8000000002000020000000b0a907071cbcad8b75a57346cfac72de536796e277b5ee6f7382f7af0d679ca0200000003c86e72f7abc5f59d355f2898fe36947929b7137820c003bbfda26f4328fefce40000000e4ae85043fa3eb3af831e5fa89e12fcac8eb1de5db4e00d71df67f14fc535eb3c6bd9e0ad10e8054f7d85514e19ce3eabfbded39d48dd5e0e1dde5da1bebe9fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ebba19fbb6d79d01721a10772edbd14b1d900ee41f4603e020a6f04465910a29000000000e8000000002000020000000156cbbb14fa61553530910d920a705aa2edc12977f5e62a896277cd3a58927589000000055629f8cbc049303cf8f53fdae116ee525e46592bef9fa9c979dffffb15ad8555488d1af181b4bbebb7885a46be6c2bb94a1fc3e9a8b626cba8e3c595e115374d509550746f661b674600cbd5493d2c6a4cd219ddb6c747bd1564b69d19006f071a935d8d9360c57b2feaadcc68a21f1ed4b763d6062bcc4e8f3dcbb2e565e5ed07d48008f89d4d8f88c86ad11addab640000000938a2f8ffe9cb088f2295c23fbc4e8735886d180bce03f7b4665985b62ec1b23c6201b7162a2ffd8bb7b8c89327385d6279bfecda683ba98e1ab3cd16219832f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d063fc08de43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B4DC451-AFD1-11EE-9E53-EE87AAC3DDB6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411064246"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1748	2208	iexplore.exe	17
PID 2208 wrote to memory of 1748	2208	iexplore.exe	17
PID 2208 wrote to memory of 1748	2208	iexplore.exe	17
PID 2208 wrote to memory of 1748	2208	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50fec7c1f757880ff96dbc3a0dda8491.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17bdf8f3ad79d4201642bb36d36818eb

SHA1
4c235ef0b4da66e1e3ad67a4f2bf1740ee5b47fd

SHA256
3bb742fde6f4539f1d24b69be84c2c7a8932821adbf9d5e8333147fdfca20dba

SHA512
2cd08783af8b83a719f2e2b7a345f1c84542f951d9cd1a4c0467c3cd8ee1dfe601d99d41f7de79c358ffe178384802f416f26f7e337a0372ebd3efc841e0262b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae7e775e9144f3bc33e0f9fcee5fa93

SHA1
80e40fadb5e86e914c97ef62a9a987d43af76616

SHA256
4e9acfa43b1750882ebf4a69c07959f559dca10c2b4e2d745547ee84550d6611

SHA512
ca1a03c799fffb5b361e1ece65dde946aac3c15f52c4e2c566c7437d0e92a88d1d2aaa092106e87cb8c533e06a1aa02ac289d99b2f025f73d277f89c1df188f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90de57068b5c7dee23669af4882b8617

SHA1
0d997f67d748308b63f436c879f7d4d0cf0f2e3d

SHA256
e905fe6dc11fce580e2caef79dc648d665ed2d944f89f245e9d73f76cb22167f

SHA512
ca6fb1325b9da76f1d7d5c3aa42ed4ab0a5d2d8e64b8a07519f8a4f73015d97964719cbcadf3b52dedcfee47a5173e8744ae3c298f5d8850c0e6c3c017f003cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fb8a84db053a2d20ce36005f86ca8e4

SHA1
8db95e937350227c6b8580d01d7d0bad5e53a01c

SHA256
cf1e7eaaad39570ff31c9303d83be3d034e3075907dfa5c725c436184ae2e0a4

SHA512
63917f58b004a895115bdb0489b72d67cb360ae07277e2336f89d7e46a49bcb0a428ba29f8e5ce4270bc1d774ee76c1cea8a33142239b0746f29978111c7fa8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe91466aaebb7238da3cd02a24bfaa8

SHA1
6318b9edcd227d9102153494737a6daf2605bb78

SHA256
abf5ecf622e66c11eb6e10d715ade5921672a072046f4e58206c5dc073372b84

SHA512
9f1d888d65ece3f82fb8f3b2f18c8d4ce393247e300093d9ce807a3530a3c99171c912f95445ad10392b2759e52db3d36702d8ad265a14286717f03ad98620b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e239b5223b414ee6f6ec792a60e179

SHA1
e6bf7fb0747ce31c0cf871be70fc6bd4624c8102

SHA256
7ef4cd82c714f0f06df38eee9843a0f8138a409a93402cbce8896227745fef07

SHA512
d578147634ba3f50f85a2b1586afeca7d0dd545ccab3d07a913594f0449a1ede2b4535f2db33d17da508bab002fcabedc44aab9b0eb93e49fe96a34935587ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit