baca80ca3d9f7cf0997ce0970ab1c2696228abc43bec70bd445bcdbe614241b4

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

54c25dbc6a944d31810c81e9a82461d8.html
Size

601B
MD5

54c25dbc6a944d31810c81e9a82461d8
SHA1

979db6eb3729a84373634174320ae0edca6b25f6
SHA256

baca80ca3d9f7cf0997ce0970ab1c2696228abc43bec70bd445bcdbe614241b4
SHA512

26ee0aa6488c33948d00744458b2bcb26474ee8f3f5b331c6caa397a4d25cb7d5579eb26e05e126f643ea1517dc39e47aa857ea8970443acfdab193ad0b956a0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303bfa27de44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61DFCB31-B0D1-11EE-B092-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009da276987f07a1738e05a1dc583440c76089e25a1d8cd069c9b555a83ef2ce74000000000e8000000002000020000000e75ae43ac4051f80c6739668f7b8ca1c43ef7c303bd532a335cc0cfa8a4da85520000000b573ff53509d9bb5214a1057aca8981f68f4d8b9b76f0fd1b15bdbf31c00959840000000953c3b0b5b41cda078c1d0ac161da03a3d3d33a902940ac2050694be8e75fa1bdf1c29682fad0bc7afad3f60ac6807499fb6a75939c19ea827c8662d3cdab9e0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005e40433ab0c02429995c05235786f493f6f2631ee862bd827d5f515d4ee5aba6000000000e80000000020000200000003a8f5ec4d075a88a5a833046a0fdbf911a83ba54f6aa05c3ec05a035f3d79e24900000004351448e62c73a4ba22dc893ce0827a98c3c8da38ad15a8ab5a11620e6fd22fdb1e0425cce1b348e3e317b3ae00cfec9d448a455d794f0805087ad30b67f7439f8794273cabeb002c6a9cab1a3a0f3f851035d3c10749c2e010becff92fc86d15cbfa454939ac0153d6bbb0d3456ff1c497763e5d208d921d6e5f60e01b6d28f328985a6bcf66be64bf886aed2b3d87a40000000efc407d68e94fc22821871f6ea821d2c1bb2e4a7eb946bfe952ecc986dac71df5f9a9bf87e99bac0597f79f2e1156d95c4e2ba0326e3d827b16b25f48c65ef40	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411174255"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2724	2964	iexplore.exe	28
PID 2964 wrote to memory of 2724	2964	iexplore.exe	28
PID 2964 wrote to memory of 2724	2964	iexplore.exe	28
PID 2964 wrote to memory of 2724	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54c25dbc6a944d31810c81e9a82461d8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ade0d46b800f1dc7177a6bac76fd1e

SHA1
592cd7b3f43dbc3e2a1b007bc442b204e48219e6

SHA256
4ad15d651f83ed854986f559a42d32a980017e6a59eaf93f3346d57158c754fe

SHA512
1260dea4a09a91d8fabd6d841124fc4240da6dd93da2e17d2a612e742a2541e1705dd6f157e8502bf63b7710b3d172cb64cfc543e1b8923ce4b636452689dbab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
867cb74f852ed70849e34287309cebcc

SHA1
0ae95a6dba0293a8bb45b3d35caeb71024307424

SHA256
be6510015ebadc428924ffde407f2754cae3ca6125e445c4ef6db81285de46a0

SHA512
4701981fc4103e5b08c861674f2fd2dcc5f8ec285154ddf7377008e3c60ccffc742693df4f0f226792b5b28212891fdffd857f44d65ae6bf9a4b3e095edd7fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d6e25db59be773e605773da37648500

SHA1
a06bef8afded185ec4578e195acfc0705d74836b

SHA256
0c81d18d8956b5ac6f64ea28bb1a354a944030ceef2eb89d3471a4817b6ab972

SHA512
5b7ca83cd6ab8704fdcc2e06bebb1944db7b30eb30a058fe52e7f52d288812d466d33ac2e76c2a4e016ea63fdea118465b73061fa56bebfd5ebbf06d013d7c0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cabc3dacf37135125ecb49b086a625e

SHA1
538f7642d0dd6ea03a11150ad41f10781f0ef664

SHA256
13e51485473ac791a087fabb19dbe07a516361e04390e9818fa5faeea44cd26d

SHA512
9ed25a75f588eac13c534ebcbd68602308956babb040d3d89bead3c133fc548e87512722a088dd9c1fc5c886a56d2e24fbfa4fc5851ff24b0e1a9707be50cd05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbcd23e3b9f80580e707f06f7272f80a

SHA1
1e09ea301704ed9f33a96a2c0950ea78bb43e22a

SHA256
487e671f2521fa3dff437c03a0334f7b9a91591c85d5d75b044d56da456ac099

SHA512
d001f6396e3293905d8c66a611a3636d01089920e28bf723a4af22b86ad6b1a517075d9666d682f069c9e1d6ac4c732861a858afe623732c5de96a802b768f53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f356cb82e3532da35722774b23905eb

SHA1
d7d251f4156c338864ac797723e6a388fc1f959b

SHA256
57ba3a63347254cda9b74fd3f368e0196143bf2cd36ad505e11296ef5596ef74

SHA512
d2ca5efcfefa94970908a92ba562c1e4e37124ed33429156de962a1bbed985dbf7b90f87b7a1b2ae0fa752b7e24198b74a5c8b122fbff9a299d15330623e8bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c58d01a719da1cd399f82d2cf1a1d79

SHA1
278ebb094493c3b07b2da01339dbc030459651ec

SHA256
79320f2fb4781b6f26e810dab9ee667526e1e3cf9cdfa5d28f333354425c6c90

SHA512
3518a11eaf41c3d00ff310c4e78be828d443983512cd621c65704a8843a657089abdecacbe1e78ad199ab1ad543d688ed4c5035ef31baaabc35712cf9d70db79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6376.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar682A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit