9c21a0736bd24d961809179cec0ed76632053ffdd3ddfb485bdffd0d87759ff9

Analysis

max time kernel
138s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54625a932302deff3e79259504d48be3.html
Size

20KB
MD5

54625a932302deff3e79259504d48be3
SHA1

b8b05e25800c0e09c42e7017422e4cdaea7575e0
SHA256

9c21a0736bd24d961809179cec0ed76632053ffdd3ddfb485bdffd0d87759ff9
SHA512

9c7ddf42e760b604fe357624b4b274e79e2145b24eb2ea11fbfb79410ec008b223f40d46ee197ba524ccb8aff6673a7fe9bf870af982948a3d99e993e1ad8275
SSDEEP

384:jiJKcRAa5r9DIi8VBD8cRjQ3RMsB0D5WScfIk9xhe+OzVc94q:ji+a5r9DSgcu3OsWOIk9e+gq4q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4006188ac444da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3C7B711-B0B7-11EE-A29D-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000088d7c58745d60b3efc91d45e3f0d294f19e6592a9a7eb256afb8ec90213f2002000000000e800000000200002000000033b3dd88144046bac4a2846d77ae5cb7e90eb0301f663eac684727880359d09a200000006ac72a5e31375463b8ff5175f9e5a10ba3d7cfccb559eb11a04f9eec7a12bc3f40000000d69ca9a67a6dd3b4bd2c8004d863881db1c347f4a661dbd37b8afa18a2c88649d051a0a1b6afece8c90ce47c95a207582f5d7f4f1c2a89986d8ab4e4ed85e1e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411163224"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ce8fc54eb318f48e198eb5e72d2e487f07fe8010deb9be1b7d339d2df0b3fdf5000000000e8000000002000020000000bbba28aa1ee1343f4a605cb14a27c0693bf4b0fc2eaef054ab68aee9e4f823ae9000000090949ae82d65941b5046a7555eab8f1e90551e33b893a328f8b64f4fcc738c6a78dc131f580ea6985af15d5fc9bf7c07f1705b665cddcd062a14a342d9c192299c7aa79b80daace745096df2f9beec40f3f325c2fc0b659d86d41e0986510897267c46205165021252c4d708c397081e5a7f89160848bc7605c3a2cef4694d4bd6f6c25d7b3b6e7104cbd7974ca8a0fb40000000fd3a9dd64dfe2fda1b7f71d5f7cde393532717cfc233d56046d09c84f76969543bcc3a452d3ebd8502fb15576f0eafe9afa2bdfe1fe9b4cf2463ebd8869640e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2200	2192	iexplore.exe	28
PID 2192 wrote to memory of 2200	2192	iexplore.exe	28
PID 2192 wrote to memory of 2200	2192	iexplore.exe	28
PID 2192 wrote to memory of 2200	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54625a932302deff3e79259504d48be3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4331c06096db0e893cf844ecf2b6d649

SHA1
dc8d1be12da06766a275b891b66a4336f0979fc8

SHA256
0c5ddf1ea411fa50c5b4fd2c286d3bf82eb96a95bca5947e9c1818348d60c54b

SHA512
70dfa44de10c0f7640ac58e6d17a3d12184c09f62c98441f89274142ac906ce50de2e6c98e4147a68e8650afefdd2f9196a2d9b1b5125131aa9682c45b5d24dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
489d27da609a4716ffe61249d865ee3c

SHA1
1c8f4fe97747841aaa144e5486f3dbd300f49f0c

SHA256
c4b356c1b9d0aae06b98df2c3d13b48e61e4e41adc0341374030214f6386fb69

SHA512
69aa18777f802b5e591077bcef795bbe5bb05d7fd18687b175ddcbff82c6708560feefeb68011c7e8f2270feb7ff9b30ddc401aeb320145f9fbe53ac9a3d10b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9565d682a9a5137339adfe2bbb153be

SHA1
e5c0e76cac67d6efcb67ae8a0158d70efee2cab8

SHA256
cf935e04245e296f83a1bd9f4d9981d580498c1ee3173d5a6fa72c0719d6ce2c

SHA512
65b6c98a0648318e2e06c3130688d55aec62e63de5fdc17578d9ba4fb91e1f0922377c1fcdb486d8b8a62a1356df0ba66f0c73de3a54922d2dd5063ebc40f9ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0259968bb44c3e1fe20d52c64cb7710c

SHA1
146112a20ddfec6747985bdf4fdc38eb617897c3

SHA256
69425e4cd59dab53d4a20d16b0079b6dd6e32e609b931a9ae51858f9d45fb29a

SHA512
bd4e8efd0521319095736800a26961aa87d3c7fedde7d6b7f6137708c238aa8ae0c70e9b77ede8f54998484f75b019926c8e968518e6f49bcea5d827d9c9d462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
718fc8058e7a76eccefed33a57e598cb

SHA1
15963dee7f8261e2ef2d6997a8851f8c063d8b00

SHA256
0a4513eb7a8cd761e50164c621f572d99d97ecdab16ba9f7d89d6c9c4fcae65b

SHA512
ad4bf5a90800b2fa469b9f171951481ce39b07b3209997e5d676102990d76823ea1b47d3e44e6e2454b95f3bbe9339a107299e5529de2d4891888e40fffdb477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d59baf1ef4b850dbe7888ca8db8be5e

SHA1
4dce695400db52af2f7d134b6bd54af8d1f945f2

SHA256
646de6e9a00ef7f987bb51ead77ce5da73dc12fea975ff9b144888d4396f07c5

SHA512
c9993f8c714adbb8bf7419a654d591e38cf3c0c13fcaf7986837b7d31c2bf2e0d14dd0121fb1ef3874a466dd0efe9bc85a9efa807313c1eb219b306c7facc4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51230ed2866d4b2b0ecd871777b0b473

SHA1
cc4d5599bf61f06ade314d96cd25f9bac3ed4abb

SHA256
a90b7a4675f9d54b0c94146816b058312eb824d122efdea44c6a1a72454a09d5

SHA512
0506931098eec91a0539a2e8e55985b5f4e2ddc1c922983f0f07a9598465b2b266a5a076f3845c24736459b2e9c9e36a28b539206c5208f53165cf43f479f56e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22bad138778bfba4cfd53ae7e2a87f34

SHA1
ecaed38ba689c2a7356b198d7da1252b1d88f62e

SHA256
6df7edf4761dc276d53a5c3ca8265e5d074135432e10420197a5d9dc61c00e90

SHA512
20522803e97a461a7b836d184f5905aca87040fb3397f98934fbc8ed326d2265c8c8eebe4370af61e9bada1cc17458d0c3899e8bb39f2bb02a978a2cff02ec29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c33c7e33087e3a3f2e1644c800bcfb8

SHA1
93498e0e7ee92586f6e8f895a151447918b6e2ba

SHA256
a0105fac5750d87591b6bad5f446191044d882e33603af76d50aa9b03a3224d8

SHA512
00c110141685624fb7d91e3e1c92a78de0dc610e7bbc23a75a86e32230c24ae3fad1ddb5325ca28486eb8305e2dee981c8a47f560425a93eb83ecd0dce4f4b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ba83035de4dd766b38b29e668d2bff0

SHA1
275c2aa317ff6bdcdb27f39ccda89b987a2723d8

SHA256
22f28025e5b7633458a330a74cf9fd80b260b5af129eeb273d1bcbe002612b82

SHA512
ca41f1d3dc4856788b1352fcb5d15568c827795d460d367b2f394f77cab3be672897968924adc89920793c11bb78ba79f67a45bae8e138fb5b476e8dcbe1a5d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66953e3cebd81f4b354e470fef3e91e8

SHA1
208978210c078fe96c22a0a0529dee74b38eaead

SHA256
f6493c2a95023c26432bda51740cc6b96be3a7248b22b4de8362cef135b4e5d1

SHA512
409e9287daddc23f2ba255ba2bbfeeeabe2b2589df80d022fbecef7d22e0267d6bf538573b4a66fb6d852fe025284369464dd43fab1e3c4908db1751e81e1a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc8097916cdef94c2174dc9ca1ba32f

SHA1
b5d2d8ea448c01d885bf3c5c98f1eeef5df8fcdd

SHA256
4e85ceac264c4dac18cc46e6616297343e040dc06aa7451a26a3561d6052a523

SHA512
94254a4e3e24c0e8cdaa6e0b944fa4cc76a8ddc4aa41ac2b9c37750bd96dd66878d42362efbac442653e14afb3ba87e86e0d3562486a93302efac8a19846b23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76e0b2515a01bf5e63cb83fca83694d3

SHA1
927bc569cce893580637b927aab5dae20f6d8a17

SHA256
f2117e94aa32d071ce2ecd02aef33137b400067c2f51ab3193ef637607bc064b

SHA512
83c508f9516342ff944c94dbdc48c887daa22d7de86f68d29cbc3717b7c5f4c8bad96edf68f4eaa31f91fedac8334935ee026e0b9752979aa1d0444c418c0efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12e90147e7ffd5003bb4f8a664303c3f

SHA1
af63af758d656480e434920fb08f4fc132425b15

SHA256
1b1170f6f068db69ce58ba401992879781ff64ab470bec5edb3face060840fce

SHA512
936efcff8428c2b7c9771ae1d6a3afc7a70c4dbc9bac8de84ffdc5a147ce6bba914d5196148dddf419f72ed9579565665f18f58b5eb927a20b692f428985e213

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81ED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar820E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit