e855f3acd2a6b905e1b73b37f21c4437f9f71a59d1a5b541ea4dbfd127c847d0

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53011ece5e33b160f7f26110445464cc.html
Size

15KB
MD5

53011ece5e33b160f7f26110445464cc
SHA1

ea7ce7907870dea4fccdd22c5bad15632e1b3aaa
SHA256

e855f3acd2a6b905e1b73b37f21c4437f9f71a59d1a5b541ea4dbfd127c847d0
SHA512

8869348ba46a5d06ce3c674d63bdb53305928c65e36ee120b57c2d0d9794abe8c8951e6cdddf0bd70ed164e7d7857b35454ff19c8c25c65d5998674db6514cd6
SSDEEP

384:5KTj3p7ECMOlxVH6hzM0NOfcrafOhnWBCghd+wRzdApU4KkDo:5KTjHqbDo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500432706644da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000008ccd082853ff89a2d3efc57ad20046e82d8c1bcda12d9c9f3dbc9ae219c80bab000000000e80000000020000200000009eb2bcd1294bfb43cd8f58ade062affa1b150a07de15ed8c520b9b19e91d0cfa90000000b52a4cdbda6eca552e5ff7d44924d4494e166656dcee4e3585e8331a8774467f60e0fd9e0fff21d51cbf1dd9d004de4bbd7c5284a42581fd142dfffc88654ac77ccd0132730dbdf8e82d95686f66978f4ec10b81e14c9db4822cd66c4029508160b7f21b8d9a76940e7c88e760e192e4d161e9873a58900e14fe3f457bad5d4c1d57f36d64cd0e2313a4cced044fa06040000000cc2e61e7f67cc75dbeb4430241043cf1c5094e56222864d72144cd4d39a0b1d934e7bb4bc49be4578d1468b3f82035f5dffb7a3c6d20299a9c8325ffea0389bf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411122795"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{932FBFB1-B059-11EE-BE5F-46FAA8558A22} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000000ad772c189aa2136658afc731692c439b7d52791cb152c38998f06b9b5255617000000000e80000000020000200000009f2aebb682610366edfa1780643839e8c8a23ae0355e760938dda2016a454017200000000dbc14afd3eaff40cd4307dbfaae8a93bd085331fd53b59249376197755fe11d400000004cc0956d50ce137a4dd838f7177ace53cd92805a323290a71653da4b7d50292e29b3c15c7fdd8478d39b2b91f43bcbaddeceb3ec5207e3b5d316b4666ea85898	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1308	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1904	iexplore.exe
1904	iexplore.exe
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1308	1904	iexplore.exe	28
PID 1904 wrote to memory of 1308	1904	iexplore.exe	28
PID 1904 wrote to memory of 1308	1904	iexplore.exe	28
PID 1904 wrote to memory of 1308	1904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53011ece5e33b160f7f26110445464cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c22b207a3afb41c1dde574871411e9d

SHA1
c85ee62f1671952881fa0ae170cc81571569d9fb

SHA256
28fc9449703aed5ef3d29259b85290d5b7ee2ef63303fd288eb55d7a8cde5fd8

SHA512
9fa7579d16cb3b3c09fdf524ed53c454dcea12532f0150e1579cdd5649c6fd9b05669b76c7f3fae5836878d673be54ea20067ef0b1813c68384e4ed05f2ba0d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c99ed5bd8f78865c2b84c49b7e074d8

SHA1
b573f81f36d8ce27c411bcf9c54fe2a1f4b66d2a

SHA256
69c23761d815c790750772088bcc0abc9edc0f04e337b9301e240315aa2ea83b

SHA512
018fbebcbd418f64e22286de009f9bfe2d2502d498a253d01644acdd35770b19acf934404c2a09cd3f34caf0bb51962926681639302649f773f3e604fb4d3c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f1c1419b9931800c49101b92036ce39

SHA1
51a59cce0e41ab3cbd5e3b349d1ea9efa735a1fc

SHA256
c05466670625c633b439dec76ba271c55f57c585d44805174dcd9319c0960bf7

SHA512
7cb5b6c080de486d25c88c786456714e25e09e20b80fc59db1257c1a9f02f73958369c13269c68561af17aede1372ae91c32ba38360605afb06fa8fca92a3134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c845c8e09bf3e74deffe15e5e0aae28f

SHA1
7c46c3cd44aad5db760feb469684a8d3e5ec4da8

SHA256
7d7ec4cc048ac96f0f63417dfae56e3199249d7ef5b1ad11c5935d3e32192b6b

SHA512
3872deeed88e29f0d444980e2c52ddb1a4f2dc9adca5a331c5f4e1666ca1b17151fbb88dc1816f4f6b8e25f34c254049059f98f784e2b167f237f7ad0aa3d1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bc0029c1a559192e634b6bda39e2725

SHA1
0631ba2e48c362b0eb42abdb4b650044bf5cd4df

SHA256
fefa02fc5d190a03be26788a3ae76a2c4c5e93edb2a049dab5ddc820720a1584

SHA512
14a4554736fe24a707b5caaf6598ef6055cd711ab5b5236c16e57fbded190c15cd5ee601314bf8cef1ae673f995122d0303b2aa8172ae31b01ce1e5328d58daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aec626e73d43e46ff48e9cf34c6702bc

SHA1
96978b6f7c6bc400daf9dd38785df98b0bc898b8

SHA256
b10c1bfa1fcb30b376a5074491f13816a18fa874e3a1a8bbd0d5c6e93f1bd208

SHA512
646ed96041136fa41249470f7c5224c8b6f0a8f767a7d8959301ae79b5376e741f881edd330c128eac0975a68f8c5df24b572f829970b701fe68514b9f481323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c142280f0845f5929b2faadc47d9bb6

SHA1
3d64016e903385238f6ccd004686383642179c0b

SHA256
054c02d6983591bd2f414d7999c08bf59d19560e7c87c2f0c6f75d4ed7f6d02b

SHA512
01aa33bd60ea70ce2689296c24aa3a7978f6537df4c17fd41313eaf0cb353aa346e2901f8160c8e001f998a5a91c5a54f3e246925133249660e89f64b00d988d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7185b48a4b035d4d4faa9acacf697270

SHA1
36d49395f4c2898ae3524f911e953ef41b2122ca

SHA256
e9253e3b4b7edf94c0390cc6759bb9be132e16b9deb52cfbd408cc19625ea034

SHA512
f1d8a190752a62749ca0560750d3f502e4176989aa7f598fb2debe94b6f40341179deb5e23f8d172142a32bb4efdb064edcc66185f5641f72d8cc8c108397910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da3da73f3abcaf2996ded006797e3057

SHA1
4e5b35641413f3aa57e8ae404104f9efa41ee798

SHA256
fd787db34a7b9a311b24e76aa7f406b267ef2bdfdbaddc6d89b0e623014f7dcc

SHA512
8efc322b99a2ecd93ec51d5d9035f02fcfb41c46f6ba2d4e10db66d92bc8621f15b17a7f83d72727a52a0b11f322defaa14db831c200b684561bee1c442a7e87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
578b856e813be02b703a1cd50d9561f6

SHA1
5b3d8aef0673ab8dd275c0776b9dbdb5a9203e18

SHA256
084e44c74356c6e10f23df5d376e167a78525419e0b542e62d8753de98323f27

SHA512
f28030fac1e04009f3e0fb20a9124a0868e28b16ce50e2494eac2fffcb89720d6435b1f0c8ecac418e497d0e6d903f29a43c98d595f90134607affd34c1c09a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7955e1647722675a3df7409553b91ac2

SHA1
ce2a7304e9aaa092ffb8abc033650f2fca4444b6

SHA256
7d3bc2b2ef7f644132262d4e8a33c300ddc587769cc840265856cc57ae2c874f

SHA512
d81ec157aa9ee7b97fc57a15b1eb5509641f6fd2947aeb038719d13829f7cf47e4546592ea1fc071fab0b8235b2f8c6f9f25badcf454c55d396dfb4ba3aa9158

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1392.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1412.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit