ec2b11f5cc2a3a222b22c8b8271d338f3cffefdf45116fa97a3ad93ad9712cf2

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54dd7a409eb88110e23d959091332b8a.html
Size

14KB
MD5

54dd7a409eb88110e23d959091332b8a
SHA1

266c50f3f58582119321e80fbe25676db58d7152
SHA256

ec2b11f5cc2a3a222b22c8b8271d338f3cffefdf45116fa97a3ad93ad9712cf2
SHA512

fb2fd1900522a683feb6c8104bf983821d4b0b163e86f682cb3042f8afe417f067554fb1cdae6fba57c26ef7ca1bd24933286be0d8bc317372beb52db359054a
SSDEEP

384:RN/u61uSypDOuoRArvyg1mD9sPOYxFCbLEUv:RN/aSUyuoRAJUv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411177244"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ae2fe1cd9a5ba6428b5d77e76a35a4fe4970f90b56cfa8dad56fd79c22cb337d000000000e8000000002000020000000459a361f1301bbcc8340bb0747f8623d9511b263b8a3125ba7a95f1fd78136a790000000260ed93f05b7829171705be3e2e0ccc03bc196f99b92743e7745a214b627a1a3b2ad8ffa5b03b6176d6c150a671c53d10f34f9545a6b90d3165981dea61e22983e1633b58cddec2c55b7856005ad1557505f0f9803e61bf24c3b8b729aca4c5286ea03ca46f09cf36ebb863a800cdb405cfab31fd0f9a6e5f67524b5ee53babb5386cef66590f62169c09eec0b0854424000000029e8c553f7001adca12236ce7b29dcb7ae56e81eaae1d0955ff941cbd968355f4d0f503dce11eceb44d9c27103b358d809718e881acf739a8d47490b207234d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0606c37e544da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000009ff4db54784faccd60d256cccd819d37a03b4bd5180ce93acf86e4d671680439000000000e8000000002000020000000c266b745258f4f045ba88c66ce8023fa9dd83f99d177649920ab5a8c50adacea200000002d4652d94929614b594495c87ed32a520523bbccf2221ff3f1dc31a3e654a70a40000000920c3bf275123ec6226c17db442e8fc10300ed76dfea99520fe1b15b81f5b5aafdcd304f7a705580e37b64b980ff6be8e68dde820b9ecd0b33b7ca38aa7bdc3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58D8CDA1-B0D8-11EE-9B2E-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3044	2128	iexplore.exe	28
PID 2128 wrote to memory of 3044	2128	iexplore.exe	28
PID 2128 wrote to memory of 3044	2128	iexplore.exe	28
PID 2128 wrote to memory of 3044	2128	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54dd7a409eb88110e23d959091332b8a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c50ebd15de299339ee43183185e9f37b

SHA1
fece1762fe543fb84088c61fc7e76c986ae32da2

SHA256
3bce5559603b76aa1a62cd564bbc881d85f72c92706c82ef8d1ac4a4487b5b36

SHA512
8f5df31b3b78f8321751b147728da9307fb3d7583688a253b6de1a5f5aabe92ac34caa7cd579f68562704d9576ceaa43a717f5d26238b7a25b445815ebb99ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad7e6f94032f231e60ecbf7f088e05fa

SHA1
4f70c00cbe1dc2bc46530ee7e879c3f021eeb8ea

SHA256
5675db34db2e8f5cbe9ecf6a5c37d1adad2e93d1fe67318252b3481779a000a9

SHA512
aa3e79542a7f2fd4166f1f51aa82a479b605afeeb189ec04b091e6803554c6b427edf2540beab0ffb11ead48ca89c838a6ace9f95a820de3e26e2362d7b4b0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ca4f0de607db3dc4ba772c0ad6e4d84

SHA1
a30bd18a0f027998982a629d2b803b2477b3700a

SHA256
3bf155928fae3416fcf2354cc06c4dc8e968f4c558cba7423502602a7d35e668

SHA512
0109c8e4cd9dced72200b38bf29ff0e74fa22b197accc553026df434cebbe39a516bd5bf7b127d8ce3775e68f2dc05fdf4a3f54fb5487847e3656b8fd8cf922e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
029b27b8a797efe9142809006b362183

SHA1
a479841a3babc7e221dbcc24381e1e3f53eb3906

SHA256
a187fe251a7e267829069c462b00949894bc9eb573554cdd29aa6fc32b9abe47

SHA512
909da2fb57eafdf8d58f90f68fdca30e1c9910f369ce616a91bf839db797f1e62347e4575f19d5803b5da4025124aa175a14dbafa21ee994c5b5407b555e0f53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adbd3bf68bd48eda6e629bc4844d9648

SHA1
77d26cabe59665a2a583394958d8d6b167eb7824

SHA256
6f97aa984b4bd984f2faa418ff09692f95dcd7134e0038cd820062c89d6993cf

SHA512
1382f2b01a1a1f587fe56052e98ff76044383393e573491451b139fd74540c9536b8a6ba441d410a86314213522774b697ae386a28b098f51d5e0f82174d68b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfb53a4db9bcd3dfb7a991eb0da11100

SHA1
f0ad4ceca7c28f8423f885a5b86c5f55ec56ce36

SHA256
9d8ec4b6dd7bdc591448aac5aa2b77e1c227b83c8f486f1ea38fb691133329a8

SHA512
aefdad82b05a2da424344484b6aabf898e45c6defa1a5f969ec579219a2983ede53f3f05e087de8bcd289ba3f0d77f04a5e7857bf22765719ae3b8d368e2436b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ab2ded64462b17a4e9c035ea44ad5f

SHA1
7947f34ec23a915fd099ab6e8a5da899998c8cd1

SHA256
b2fd936ac407a8cbb3557944c707c15df0e5ff3ad4becf6120c0b876f2cded13

SHA512
d1fc76b927f16fbb63d31a0f7d0b60c3458306d94fa748fb232677c3d6ffb5cf3230557d12964888ce792dc29cb6e7b9b6f29c960c4900f18b4da4741c9bfdcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356724096b6239b4f0bb37b111018ee1

SHA1
d6279125f00026f0a688f8d6719e20eefefdbe18

SHA256
eb2dbbaf0f91210d61345387924552f5daeac034c89d2f5b390339d917f16a59

SHA512
8e3a3f8d8e42fee0158295b3a742f73edc275d48c62fea085a596de8138e8169866daf5066d5b072862ff8d5a82d799ced2053515646b61ffbf2e6b5cb9a2350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfb258a2b0c7f4974fff68991ba5e0b7

SHA1
b4f876f4297a36b67308ec62c1e0ef5fb1869b17

SHA256
8b67b48da1e9f8213a8c4769f06304c5fe2341d716649512cbddd85e97d9a026

SHA512
81243cea10b6049b055a07db16f249c37378f4c76518b2ceee37def84cc39e92768c6bbc9ff442d2c026f260526e5520d6a8a5c28401b45bd56bf28537dd2a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b0b673c31d3f9b4f550d98cba2236c

SHA1
3e92be224741a51674af3355efb6967465156569

SHA256
70b5a0b8f5cb564c506199e59eb07f2daed10b90af919b87784bcb8e7d19e94c

SHA512
95252e1bee27a4efbb2a0b214483f3b281b11f363fe43e2e62fc80e424012abb2c9b874f373b036300d7c62568114a542d39c3ce8b6adda3c2a1166e045cf943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8beac3f42939126a2b700c9d37946ce3

SHA1
e2c339e9f62a7b95b93d2188ac8ab86448690697

SHA256
5edc237fe1ccc265957c2ede18f2a13cd86c4e0667ca3186d30b5f6d7c06ea75

SHA512
c7dbd00db8be627fcf6b41bd74a459c81a5873010cfdc2897338a25da1808afebdcf77fe052b6b138b947b5fde6bd49b659d775b6551e57c3b3d9d30a31ece88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6331c702ce69639f5fe562e5b20e6b50

SHA1
21ae1cb732908dc86dcb1ab3091693aae6ebebf7

SHA256
ec43e42a82eb5163a7261be30d2d67416e06e7d70cd482834634c9cd41bc67ea

SHA512
4517269816907758f4f08cc0caa4ca137c0187fea81a6865c7caa2685004cd50c34c9b795d2bc458885c92e15034e5c2346bc205d61a3c53922a557f3e5c1d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7bac5de36c9fef6a2724f3e7db85be6

SHA1
f7b4bc3dac47027f1995593dbd6953398da0057d

SHA256
e97165fa32c9858e32a729ec8d16e6d2afca4d19f5ec6f10ada10317a840582c

SHA512
1c13679256daf7d259be1609372467cd48626b8f967982ca228d6897e7407953b64d04e05e605605d786ced9aca03d22bfe969eb33c2753592be252d1fd2dd1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45826d2646a4463a2a2643c69da2e627

SHA1
a9d0f406ef303871e95a620774796826f2714e2f

SHA256
69adec21d3813cbe34438395499bd0cee5c45a0001de509230b2431a03a7b904

SHA512
8840f2e645238068a9c99ca6f92560e2db840ecdbae82a0793b9d76c8752a8abac6e4009aa4341904e6ff370317fa613a398f7d045af158247a1b269a3008210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cea1427471a2cd40ece4bd6e1c3fbc8

SHA1
fea7f718478aca1aac6a8b468cbeebebbf8d87a6

SHA256
152959184f57421b0b5cee4e51a849a79a5bb8b4804ee6f0fc36da97f55d66d9

SHA512
b631652dc80a69dac74d618b6d0c096985dffa6a9625ec336a4a4631e00159bdfb96f6cf9b205bb82890d22bd91b3cc9d658e2865f3176844e31b0a4a1c17891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73eeea3f702ead07757d25409d0d3be0

SHA1
6ada0baff696e0976359b4a40afb2f11f7fa7542

SHA256
3f2b8c1d6300501bc3fd4f1e65b8b9a2ea643d7eab0128bcbdbb5d41c194115e

SHA512
f8eeb8fefe2ddecd1bc952ea11f2eb5775c405c270c3cd52358b4190479f719b2bbd1661b62a5b6803022f4de3c41503e69fd644187537d01a0e4ff60ed48c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4906.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48E3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit