6a40e0727333a5926a7c35518e21880036f9407e1445b181ee1aec77372db9ff

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53c0d7f82dda95d5a8ab8df2eeee364d.html
Size

159B
MD5

53c0d7f82dda95d5a8ab8df2eeee364d
SHA1

71957a4b85eee280d9ea0a8b9af6934f22049de3
SHA256

6a40e0727333a5926a7c35518e21880036f9407e1445b181ee1aec77372db9ff
SHA512

c58729ace050c90866e7022133dbdfb8507d3552766584e795839c1e734554f992a1a33b34558abba3ea5b43bd3e87afe9a1942bc6c887f6b9ce92e576a79dd9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b833c49944da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000bb148ef84037a522a570f5f6424eadcf7021556d440e753ead4a58cf4996c5fb000000000e8000000002000020000000c78d7e4a560a0500f99742856d1875b2b7828d21116e6262ddc8c5f233f5ac4890000000460d1487ea64eccfe4b374fcfd826a57a6628a727e3364fb349f76883199a15520e514ccc003f776381a86e719341a97a24d6a3900b06291e4ca178d04befdac3046d778e628e554cbb5d1629f0d254a726b29e96ac7668018f123dc05a5732282366998e07aa5572b032f2d5283f5d92029cd6c1b60e779460a3b25915f92c5375d3c9d84222dfbebe70db0eb5bfa60400000001a143c7a3980e19e2bf18183acc78d5ef06b63f2c15fdfa22ed5122512602723e7b9edeb290bc93f20fffb32f829f740edff07494fdf981d744fcf3159ebb3c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000fdd0636cf7720ffca24d3da2097740e297875be6db6f756cae89ecafb7258fdd000000000e800000000200002000000014be9af22753d6f777b279381d2035406ab924b3b1a9e013fc007007b28be3062000000042e45178054f3d115e96599e266ad378ea22852275de4b7111b4077698582826400000005ed954fd0e50ed95cf44a9e71ab674977b2232cdb91b1dbe60d9b85118327f060bd4850b9e33bf5bc161424986b711a75372419f32bf4a57c26bcc9597fa3ed3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECFC3E01-B08C-11EE-BD3E-4EA2EAC189B7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411144849"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
628	iexplore.exe
628	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2796	628	iexplore.exe	17
PID 628 wrote to memory of 2796	628	iexplore.exe	17
PID 628 wrote to memory of 2796	628	iexplore.exe	17
PID 628 wrote to memory of 2796	628	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53c0d7f82dda95d5a8ab8df2eeee364d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9faf61a8068988484a7950d49367187b

SHA1
5a7c94ee2ea474fdb2c883e5a8a4e37e873d9f9d

SHA256
8df316b3858f249d3100f699d06c0136f7dba5c24f6453f01f86dd223421016a

SHA512
35e7d85113c68037c74942ed93bb217e24ff5131cadc275a0d6f3a93c0db073275f3ea67e8eb37f35952377d3192cabdedca2783ab311e018c5a8a01f6367bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c070f22159c3eb0a002068fc9596791

SHA1
c23122639e5a2c1b7436a8ce3d18a7a6648a8a03

SHA256
2529a573ad003ad743f1925b2d53963fe39f36899348f5f0ee9dd2389c7cc3e5

SHA512
d3ee938c65f6942c12a12505783b38f953f3b9fc40f1e181aff71e74984beced26816629115861c81966c8cfa68eb298a0f82deffe8f24955877cf265c3fc858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d98435d13bd5dd9d20fbc9673b1fee60

SHA1
94655901ee91416327b889f017db17f466dd0543

SHA256
cbf877e54cf5add001846aac9e7fbec35abc526632698adbdf62054a9f692705

SHA512
3ad1c6c60c9537592192f4e98f6eb27a1201a39d545ddc00c3a1fc0b3713120523df5c2c272e5eb39aee854114636894f88b87bb965086ffae1ab9f7a778b5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d1a84e745d1ef446fa1b60a29de0b07

SHA1
51759139b9625420d61bb77b488c7cd410a1562f

SHA256
fbdb4cc2b2818816c531cecb4aa7b10d2d467f827f9fbe6f6c708c146e59d9f0

SHA512
f76388b40ac553508acd4149bc1d42f3bd8e37a1e59fd122117a860cda7b87686f0617b4b94bf8ffa609d9805cb8fb921677e23a2fa025b71f377f7410eb7674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1250a24c73215fbfb2205024a6a3d1c7

SHA1
c211f11ff34603d9e0b792d7994e9a5afd5bc39f

SHA256
cfa7a1a43b42fe8dfefacc791a8d7f2ba828d5564714c6db0916021a823319a2

SHA512
ea72a43106db3ffdfbb166e08b4517e2db808d5d9e2548ef9037e316478efd05cbf955a44df28fcad3152a2a3d23253f106c313cf6c8c7180fcb6d0008c4cfa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc25ae7902a10f79c4f0963eca6794d

SHA1
7a28909f82954af93315bc3549649d208ab24ca2

SHA256
5c9bd4b6b44df8a4238d3ed193abd9681eed35b44197f40fc4b0a10dd0e1191a

SHA512
ba4d16d358e236a2283009f93143316e33ad2b9d262126a20e90241b0ac895ed49657625211ee312608a45741c01ea6cedc71b235801f1e9bf6a10fe41eb4b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64638d0a64d338d0095d05740f77c7c6

SHA1
5015accf43f259b03472eabbf4f93a80b4e7294e

SHA256
09a33cf26f7b681a42a3c00dff2d5b1741e3e23fc3140d351acbe7c68a38170a

SHA512
a24e85627e468b61c17aee5d41f28d41caaa56e2b5dadc71b8cc9a9885c2c88d188939ed3b3ca82cd697f129ebcec34da2fe38853213383a484aaf01d09ebb23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3909b08030d310cb6a7e4b053c4494

SHA1
e2813b3be9ff005f1022ca39dceb642d2f149341

SHA256
4047287d50e5146cf225411917150a67e7287e5505bd6594b0162ec52dd6c079

SHA512
da89da4df77be174fbe615e9822d39fa9c2c4f6d03d871d8b35b7e06042d2503976aa388443ade371da4cf3e678d92f24154dc582866a1ea339582d2835953f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a19224b95edeac2b07f739b3d9b5ec81

SHA1
cda4373e9b631fdd1c9a9a7a53b85d07e017e35a

SHA256
8e17da44b037afb0bb26965e409d7b694e295ef8e255faab1e03fc42645bc583

SHA512
bde1d49439c576310b4a0ee803c18df38fa2e158379c18132ac93381c1b6db3f57c4f64f432e414f9276459464381390d685cc71b9cdf472088df141c91d3bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964cf01a2191887c6a431226de7680cc

SHA1
7ff3f6bde38caae1ee2918b5d07aefb600b4c5d4

SHA256
4ecb54bb7a9395b3a1980910a6c290c77cb176c58ffad2a5dc8f1a4e42df760f

SHA512
484f0f06f873e52da127332e02670642ab1aa2f4f663681903d46009aad115261545fc1f2787fbafcc18c9282f3e98a65df03c7bca88ee840ab12eea2bbff4c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d7e3ed922d2be8902fb3ba128e7d9edf

SHA1
29db77c79485472b11286bcd1034d7aafb3e057f

SHA256
232a5d855b1a6d858fe0bdd87216a58478ef42626bbeaba24c749f46b410d04d

SHA512
47c0b7d47b6e801027f6c94bce6e39b4479f85b78607b84359bf0bfd024fadbd74f40f2ad3cb33afd8a4ac9dc7b29d767e9f83533291010d56a702b05ddd5b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CBF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit