7b22ea04aaf15919a41f18ab01e8179b9f6405cf8ece3f2b3599c7dbc4e8bb95

Analysis

max time kernel
136s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54e09edbc06b30f0aa78f8b942866fd2.html
Size

1KB
MD5

54e09edbc06b30f0aa78f8b942866fd2
SHA1

50c8af52a159df963b67e037e141364ed263a977
SHA256

7b22ea04aaf15919a41f18ab01e8179b9f6405cf8ece3f2b3599c7dbc4e8bb95
SHA512

ca41ba7faabb65326773cea991b7b68d1e91cf716738c87f928e42b34315d5a1340cd7c9777c53b168c7f7a7bf65ea00b491c491012a22483aaa2c39b831a84d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411177546"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f3bb60bddbc07444838dd1fea1e7eeef945d87a363df1e762a84d88fd7671e42000000000e8000000002000020000000f8192744f23b262ad3ec269424828c377cee47f43d49d858e5022755d216be9920000000f363ffe2716aa5a9d4c7a3b315bb67da6ee6ccb7c222b35bf91395c6cd4327cb400000004eb9ffb2f643bbc92b47a8ba2cc4e49cf1c3796c503f0a14dea585f40828b215e0e0f09f4f841f3b118e9d96c47b3b13466ce420bea6aadce0c13c8df128be29	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000003693deeac351d7eca3f20956108201521ac43f0e2982fb2da18e6ebea8291530000000000e80000000020000200000006671be91eb21b67a3640848a30374031334d0095ad191417835146962ca94f2e90000000a28360d95dc48454edebe0c57a417aefae657fff5764e6316fb1c0f463296d2df674c43d7664186b25dec804e5291922df9f8647e76c8020a876dfbe2665e6c9d141dbc12ccc06a62d6f1ce07699d571ac885a79e0a23335e46b1aa8c35cee5731c053a253d7fb70a6f7ab15a65f7a0f7b801ab7792acdb8855335b3ce6f3ccace0d7ee7f4f63d563f2a48100c27e4c640000000b0dbd3dacd06877296659d40325520b000f3e8b29209d3936736a0934b7daa0c19fd55d3205e117c5c78ecf59cc385e3360ebd015c82ad595b501992ba06348f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CC1E6D1-B0D9-11EE-94B6-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202b95e1e544da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54e09edbc06b30f0aa78f8b942866fd2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7d93473fa436d21b4e13c48012ecab6

SHA1
78fecf610ac94fa7251a1d9cadd2d7b227791e16

SHA256
e8683889b71fdad16b0f6f73693b519cb8033e0cbee287ee4de343bc7f0ab30d

SHA512
b43b4e8b067b5226b9664b35fe841efc458ec6f9b61788c97793ec34f01bc732ad006908ef6e5cd611a4641840dba56a9556588440eb4717311c0e7e81b145d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c287850c4ec7ec8a33ed35fbf0993f9a

SHA1
bbc4d1b1d6a977ec1741c052fc37001b13ecd26c

SHA256
284da898446e414f0a293da47838d71a139eb6a9d5c0e31a578e12e2fe6af557

SHA512
f03b74c1fd5051887a53cc27baeec9cc3522ffa0e2261739e0c7b2ce4ff42c5fe09e8972c6ef37f166e1c0af86504bc6787089cc937628aae5cb0fe381a4a91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5dee1cbd919e2c7e36a0a64d4e6ce12

SHA1
e97faddd6a742e152e5858fcebfdd31786b75e24

SHA256
b3d66fea292ebc5c3a4a1f202054cc088b3d34796dc534d828520d5c718163d4

SHA512
b9fb2ac0f1e8f9b4ad8ce685b2c8f4f726003a22a03a401df4752b1e4807d0f06a2082858465183e8bb24385a1fcd71332b89d1c3f46ef18bd7cf293bbb1b329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b2522a027ead304e7b3e49cf3d34015

SHA1
780b5b8b2dfa03823389f7eff81a16ebc6f5089d

SHA256
f05bab854ab0cc785f9b8271fabb57cd56c20d7aea2bc4d240d811aed24f1b3a

SHA512
6f6fc134f1cdd241f0b94901d4250def0c455f6fcd6cd240950e449c34197c3d76d9c6cf0c203199a4edae9ce493c1a8c5d146a5e8186aff2c08f46e46dd2134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1973c182235caffd2a712a6127058d28

SHA1
067042395fe88b915461fc2231b843dafefcb885

SHA256
044093e17056fb623b70ce89a0bf48815e4b85382850d609743719e0e09fd948

SHA512
bd744025c18d6033a4a22cce8c218228830753763180a81964560f142a2c4e1886000bb75ad70fb9b54b8106ad6cc308ec9786b80f2c52ac1e0e2e18d82d4514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac375d7a6e6a90de5ca7466de63208ce

SHA1
7607730561fbf6c33a24a4a3f51a396475521717

SHA256
4294f5174b3ee6c2d856190c9ebc69237358445d211031f8c0a52aea26860f84

SHA512
20dffb41738a1836f5f126ac760233d3a157f576d62996157049750a93cd9e8c2d7130706a22c834f09e0e5ce708b52f491ed3fac9b6dc1d4e02eb8987e5a468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d0b7bd4e469faef3a46afcf8d38d0f

SHA1
6ab1ab589a28bf3c401e1021d6e8b631c835977d

SHA256
15e61589a3c6d600654c543ee914eb74611537d24eaed802f7fddfbf7fc6e893

SHA512
f09de1280f87803e72cd8b1d2f0ecc9f27c6e779fb3f4b3e023068257a652b34bedafada1439195631fef3ebf3aa7b733c926c6b54851b22460cdbf840e12407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9388c193d7523b5c052b774842ce5d91

SHA1
ee62a2e8d9e68b310f3f5dd623463277ce724a74

SHA256
c571090483ac149e30c7da6d906d8da268ea2e6b16d69344dc5f4b8f67a336e6

SHA512
ccb821590f41d8c7611991dc54fb60f09d28e96819a95ac8d5e4a9c9b797b48b8b899b54775b5c504afd477158385a2e7059ed89d15f4ff85ee6410ad5f0736f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b2b84ccf70b4cf0ca859a643618a662

SHA1
01bb83115df27edb28870e433e6df96cb4ae1ebe

SHA256
a9af1d81060083946399653324d29bb9c9e36d99dfbcf2901ae0f0053d9e512a

SHA512
b6b7425b4989ec53c5b004273785148f190762b6551c0bda943a50b32852986bee3fca649cd4b9ac7370c452aee0ac1c3a871f60e040eac50e3359add57392d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BCB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BCE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit