e56ce46317a1eff5d2cdfb1f2e6ce3bdc5dec88170023e6061d2783469670673

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53e4216d47fb2aae54ce3294bc0bc06e.html
Size

10KB
MD5

53e4216d47fb2aae54ce3294bc0bc06e
SHA1

86fa9655c5e002f1534904fbd3cc2ea28f3cafd3
SHA256

e56ce46317a1eff5d2cdfb1f2e6ce3bdc5dec88170023e6061d2783469670673
SHA512

b84d57ef6093036953014cbae4c0193f4fdb6c86522d277c8b2b840aef7f42acb1e319810fae49475b75085ba96680a323b185afba3a9bb12ed5a5270b2751c0
SSDEEP

96:uzVs+ux7jKLLY1k9o84d12ef7CSTU9GT/kblmXp+xA0WtqThA0WeA0WH5lVHcEZe:csz7jKAYS/UbY5+mteWtxtH5PHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b026880fa344da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002783c84714bdc5fee58c61152a3951f6b86f02a211b5c8592c884ddfe96a7982000000000e8000000002000020000000d1b46cf44a2a21e366154de362d934098516dbbd17b390e7db6e510e0175b9bb9000000078b543f0036cd31f1a9f531e5bbe4222e42a7f5820aa50ff5923be8fd606359c7465d76384a4075f7bc951d9d3bf83ba88002dc71d032cb55eedaf41e4343aa84c02e95c3d5d4e3ce181d4dbb3444c6dc7e197fee87741ab4d31966a4c958dd493e49f1593aa1b6a871b4514a9e97874311b9ad78c74116264b1d1e47d49e5c46b31131b910c0a6147adc67a0802019e40000000be268867e11d582cecc5f6e2681b78ca21b1ed6fc1e362f20673b13cf06e8c525acec8be4bee927f7c6c9d6fe7c380a982ad386d78b301c7d5cd418d83d112d5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c39a9d30e86a8a3b46d354c358aa3d7e49a7f4176b676885391d5c6947e49a95000000000e80000000020000200000009fd4166f9664fc198f6dd1bdd7a534b7568d0037419884057c4ee07cb9038ac720000000c5b3373ac1fcbc8a829643fa8e95cd62589a9e7d5eae86042c07f2951acccff4400000003876fc04afe8dc1a38c6aa2bedb0146750794f299c3f2383fef101b028781e4b21a843aa7313e7177d169437192df5a4f2ba9bb5cd400f6312c35a1df638b437	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A17A861-B096-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411148851"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53e4216d47fb2aae54ce3294bc0bc06e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57831bb333882166e7fa5b941c2b2701

SHA1
1c341502b6e4abaa70bc1ca31f2d6e73a73bf3b5

SHA256
94900b12ded05ae12bab7585a0e04fa9b42d2f5ceb10ba2904b5dedb12fc4ccc

SHA512
bf193d42899f9e4d083ff4f964024c6d70622794fe438cfdedb0f4d6edf3754f3cf3b6ee7280bb12e60a3e72d88d4995aeb8d29f7c7d98f8b21bbf4c0d4e03e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8518127299404fac589327601b95cc13

SHA1
b848482c26e6651a9cffc899433c47ac8f982b46

SHA256
7bb79311f7d7bc06590896f8c03e2ebe3a7c1e8b5f03796b4c3473b037dc821d

SHA512
211509653629f67f0d6d0085321f36b0cd3da85ac0e45fdf1102d0ef5147de2d96b6e2179bafcd072c8798c657c80aaeb3437fbf4eaa33bd29e4ba7612b1b74e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f86f75fe12d58c01cbe9d7b176551778

SHA1
ff188947dafe9433792cfe36a3e1909c2da1a7f6

SHA256
306bb971ca4f68ed3752a74cfc06dd88f25cd5c405d13ad8368ca68e3d651cda

SHA512
e1138e5a46768fdd74d6121de17a80a31fa05bc60739e1a71436e2de9f20958f5a1a3b31a98db1514d2407e452778be9c63cfc584d1030bf4b511ed5d2c59288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f89ec160dc35f4fddf24f3de0bc3ed2a

SHA1
30fbe743575231518fa086289a1fc144afc2b0f6

SHA256
0a411abd6a89b4cf2e354f37bd338f3ca88df7c30f71852fceb05958c7f67d15

SHA512
3af59d0930d088d4b31a9c919938fa1cecd44442b9b1c3a838cadde81d75572d9b799ba97d61849ce51d138041fb6f1dce972d86acdd6e5ea18523e1e2f1b1f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abf960785c406fde83afb614bd383f5b

SHA1
1cc362e9cc7942fd43e9115d95ff13782dfe3df5

SHA256
e3a279e620c3d10953e2d5be55869f52f01350cd31d5d9ef39edef564040cfea

SHA512
0f6be8b82518cf01a2f4ab8b1d09d285d40cc924b51d21b37706e156000cacb5f83801c417183dfb39a25b191baec5f98515b2feae988bc93ddd283146b515fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcfbd2c89f74070976b0c03ae5d5c871

SHA1
1d0b66c8fe03c25db65a13a21cebe0c947bd65c9

SHA256
dd3d047b3b1c708468245af2045dbfa4178e1da5fc8dbf67fe336a1e1c4e7542

SHA512
8d49e23350380fcc8ff0e6f1bb9c1b32c2fb48e28b724747299773580a2ce7180cc8853cde36f38a3aff449bcecb33632475bec806c55ad16369f716ef903814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b37e40345c1d3dc07070c8b14058bd7

SHA1
3f40795fd8c9a52965b302422707da94ebddd8b6

SHA256
d9699d1201e3450aa8559b06d43414f37b02dac9e7fc34aa3699516da36d5fa6

SHA512
8f5d0965f033845e068f36861a2e16301bdcd12d816b124ac744d9ca5e860cd0709dadaf16dda3a2f6adab69418524c3b817645e05412a2bffd9cba222607f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc43b741643df08db7ce1a390b373408

SHA1
39edd6f93e1bf78babe649bd030a37a7931d1916

SHA256
4c6abae029251e5cdf0c2c790dfc47f689f37e84f9002ecfcd381a4334c53423

SHA512
3f48ded94adfcebae9770c8385cc9e4ec6d95bb834691ec7c254a962437d10b03bae84b8216620161a9f384a29e8275152db29a2c9e88dee033eddaa039c47a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039d956a18d7af2aaf83a53c8ef1a3d0

SHA1
6e039679b9a0193881ac89522001c6e7a21a8005

SHA256
57dc64ba7124291dd6ef8352858d254a2acf83cd349c8dee5ec9f49426939eff

SHA512
1b898ee6ba23c1d5ce4d650187879b71fbf7371529712dfaf6b71d28b7b2bcce2a11cdd58b245efd312ff71c6119d1ac2f105b3593ee60cf041f6e3d4cef7a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7b4a6bc1a1806c478987f497e791d25

SHA1
d3bae5e5d3de5f08adf29e2266e603bfc19af72b

SHA256
e9602157f362b4b8a623b62eedde88d7cc5652799ff435e56a06c8949c40c8a7

SHA512
2cc5c13da7e4b51882e6080cc3e1058c059808b05f9965b88ab2fead9d3aa7131ef615d82fa33e562c1220837f329d3fbc02d2a9bec386d136780974c5068ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd05f85ce1c3d06ca86c7ab801e8174

SHA1
f242d92b3e89afe3a6c5a3eac5f8e5147272ab1e

SHA256
0c9fd08816907603027ac20007443add7126754be662ea40b2305d6be3b3de49

SHA512
df51ce08a614257c3e9f12c317e0b6ae94ddd53e0ad6715625a21c2c9a70411b1a7e60a9725c20c3f3faef98708a2bbdf84a99669442632e19b348c66dcfa792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9165eda64973f6d4d650042ec8656402

SHA1
e5eb7736c350e8c275aeab7c24553e3a04af8cb8

SHA256
976fbc7f9319482fff3dce8b09bc715d4e94931030d814c85ed965dba4407af2

SHA512
275d503dd3a36eccf74ff4e53dddabed2b2a33067616018a95d508a928c483b8576656e9fbd0172d97e61bb1850d721eff1ed6e6b697e476973e9cd369d0f705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6DD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6EC0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit