4bea973567c544259a78ad9a0b62aa694e1f42222672fae22f64295e9a294fb1

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53974e9bb5ed46af4820e35c1d57d2e7.html
Size

430B
MD5

53974e9bb5ed46af4820e35c1d57d2e7
SHA1

df208feb57a2901f6b433a617b215ed3d3a01a83
SHA256

4bea973567c544259a78ad9a0b62aa694e1f42222672fae22f64295e9a294fb1
SHA512

0cc67c5659ee3dd84f784adee0e4508abc2441b10e4bb6533373a659e31a9e0ec559f38f03e3d0db5adb9248588d311b4f34e4788ca8f10a171d2a1af3416510

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000367b752846bf5a9d4928293064d86711311bd6a0b499b05cedc64fff468c68fd000000000e80000000020000200000007d6e4a2ab7b962b110ee57e36dddbe9735409929d12d939d1f28f31881385e0e900000000264f99f603399c812591bf35f0f4edb50ff451fcaae81d8e4480f133dfe3a1960c006a18ff9858f1f45c00d89ef7314748142235e4e89a267391b837301a6ce3aef67390330fdb4e186b02a62eab51684459fd1d79bfe966c615023791ffdcd95c319bc1ad933cae9e05212a70593730588177d4811f644f0e6ee10864fd9efe14973c7ed0de827b7247e41d7b27f90400000009300e4957e93a865a7143f09a7814badb48948e17f687c0aaeb5fc54462549ebdc6af02bbe240a91dd399b5d99a1c91d6c152d50946e4e4e38be611d1daffe93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607c64658e44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E96BA21-B081-11EE-AA86-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411139995"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000008b4cdd67dded4890a175599129a021ddc42913e0ec94c60e274aacbd706f516a000000000e8000000002000020000000a0a4ee0ceb4793f666b379ecd6c5604ec992cce775a63643fdc2ea273486369020000000ac1e987523c5ef591c1a153e36101c4bf5f528e59995426f713683afcdd78fb2400000009a3e07f148f4c44d00790f5f12a35b795c235e9c5052883df60287e721739704ef3b8af9059bf176fdf720892e534e27d048d4b6b44088f09b015f63f9233a1b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1884	iexplore.exe
1884	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2004	1884	iexplore.exe	16
PID 1884 wrote to memory of 2004	1884	iexplore.exe	16
PID 1884 wrote to memory of 2004	1884	iexplore.exe	16
PID 1884 wrote to memory of 2004	1884	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53974e9bb5ed46af4820e35c1d57d2e7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af19f9fb841d285262e1cef81f0193eb

SHA1
98ea6429b2bd220a6f76ec832044cef581d7256f

SHA256
ff76932fdf3de963dd1390dc5529e329bf9213b6e32c8f153ab4e64315b28769

SHA512
7eec296d5aec6d48d32ee54793d2f85870caace8fa61c1956323d0a22a173936e58125238c06659ab4b9cc180333986d0d31954535304a5585a4315c55edbe77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cca5ad4e2e653a131e7b254738fa7ed

SHA1
a9463e5ba4be49abcd6dfea05ee4f2d9da160016

SHA256
fa969884851c6b6147e824b242d7ec75953997a37a1b76bfb7e5b432e405b4d9

SHA512
019d11e17db77647d434864755c38a248ea5c37e74c6eb5a0872cd3f922f4daa2d9ebf2d23612e1652c12537db21b5af47f1b48597f1068b1e897feb4369d964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9e73bd781e7a02c80ee71d504b2bea1

SHA1
db6976b7c6e955a3419cecc4284b9a8fd9695a32

SHA256
c21ec6a8bee6e6e4c71d7a535f310a3c3cda88edb6f62ab0edea409b9052b046

SHA512
7f41e869ecb28ee0767520bce2f9369f6cab596ecf8b1e8e89035ecd33e4c3659e0ec7162fd531f766e7ed83420dd3856b6c21114eb061e441b1054115f804d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
700d7a9905c8d9ac532bb274633eab57

SHA1
fa6731553bed6afde97efe9fae3750871d2d4389

SHA256
34e72df2b476f09090611447bf195e1031caf25e53b3dbd727a75ff0c880a205

SHA512
370f3c39ffd0a202be3801940c03628048c7030742b593b7e4549217170544cc6c82a7d223576e9d733efed51d9ecd022534d3fd517d495b55125628a8f77795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
381ae316b61ee30372ad6e283d4a9796

SHA1
d55ebbea1e280d65cb9d351f046116834b8cb7b4

SHA256
1d5c3587efdb6d9b95d40d3dfc64dd13b16d8bf3a656933797209a547ea55036

SHA512
77476caf28569e2ab728a8003340aead96f68a54f9584e27657d0f58c087660dd62c50357cc9c081161d837b32d0ea947029cc774ecf399f2c7d01a65d713fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1dae903c41e74c921a7370211a87dda

SHA1
e51c866bc069fc9259e80a8ba403b9e541f19700

SHA256
23d863cbe0bb52f60ff0c669f6165d913856c7ae94b1c4e47572b15859b6cab1

SHA512
15081e4a979e21b266b000ff74b4abbb97c1cf207903b9f3e7070fce0d4bc4c7a68d9e65aec57b566498e7092f26bbe6ef23403ec34a06bcbfc912ae5b5a5973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f776e6f0d7453af8b578ef3a9d194c

SHA1
4011d1fa80b6f26e7667d322d9bc8a9d565b117e

SHA256
188557bb94d0d6b629acc70a454255a7d5f91b734521115468d3bab791134d36

SHA512
e0a4ac67372f88d6855a1805d9a2d50a34d7e2d4c9a9298f6267b69b07035ed231571e33ebdd9ca1fb011f5acf07c02224a83bc523c4f7a914a0d26731fdffac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aff376f1306bfb58383924cb2ab163c

SHA1
b5923a7d4c453295ac53104d4ce81e210129a18e

SHA256
2b4822e5432f77bdce7ee537029af1fc8695f420f24a58362420505a946d513d

SHA512
ef4f31a130a44e5a68a9abd5c00066fef55d7c65edb196f4de99f264cefe7b2b2a11c283e31e9f375a888356db2186305d73883f3a11de5ccb19f8c0f802bcba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3840581849301cdaef43b8c20794476b

SHA1
5a18bf23958b7e638cbec3dc122e23c7eea65ec5

SHA256
f63226d494616065654c185807b66204b2a4f47a4d67dea39babfd2ad1c4d968

SHA512
e2324c7760c461f97076e9286814bae89f44fb9a9e7b69db980b6c76d4e008ea49ec62926fc95f6a308b2c6dec1902aa366c29c7b703f7779836cc60c3682c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c33d677a9b846d3f9a292270535c36d

SHA1
457be52e26a3cdbeedc1225ef9a897975a1f71da

SHA256
25b334a214892018bedf3dfa51157ea16c2d7e5755401fdba4133bb75b720a66

SHA512
9e8e44545cf62e67f582eac1a083504ff1f70c7f2567a2c6ad0299fd291f7905f3696c7232958bfa0afe195e7b9039a5cb6491418a596d97799a3aa138aeeaef

Download Submit