507c810b4abeb09d5350320b80087ef19693108ab89ff02ff756316c98c81a04

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5474055cf1d0cba3cd8b4024b9bd2c02.html
Size

13KB
MD5

5474055cf1d0cba3cd8b4024b9bd2c02
SHA1

a68537b085d6b2fe667103f5f70d15c8f15ca122
SHA256

507c810b4abeb09d5350320b80087ef19693108ab89ff02ff756316c98c81a04
SHA512

fd992a943e11c787ac5b433768d9868a15d29c1ab5c0fc507fcf737b0e89d06a1fbb82ea8d7fec9d9178f6295a2bc56cfc4ca518dfa82aefa33401d56f3f2bce
SSDEEP

384:FuzsHVNNwvHi27iqY4s/AVTsziRJ6CBJHq5+5Ja/vNnzZ:xCCmuC091

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008b3a6ac0174f7a01f4f5436bf34868db525532a6f5efef505d4a4d486a05212b000000000e8000000002000020000000d9d10248c0feb987a44318cbdf7ffc10ff9ca3ecd71515ed33af94e999ea8f61200000002b8f5922e7a0440a9b7f7d170defd2627a694955e2769bddb07d6035eb62199c40000000f4b74c50593f58d3d25f724dc8acf1e6550be1f9535b9690376230795fbe8668d3541c6126cf3d9eff4ca85e87949dcf8a081db892134f5d328af50db94cb8ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b44e81d442259fe609a867084ebf6c20ea40d5daadf798d66a8473a4f29683a8000000000e8000000002000020000000ec50ec674e84221c8e5218e431cb8f37f56d70269f1333b583a40b204ed7c300900000007d65f0f41f13c32cc04ae63f4222c031fadef3093ad29b3773c8d94eed33cb6ffb80d3d240020ed770fa1cdc846e533fdaea59480d951e91f1461f87e95287b8495a308d4881114614c52a249acb82bfaa9548020925442576105a8ec050e91402f05fd0acdaf945f61578242e93bab148403a6fd0331010204084c3512c0c2975dca46b49d63b2315dde7d285f5000f4000000001cdac8dc8643000ddfaebdac88e6f5652555e771cedf09b3ebc6806d756d46df6de3c5ac2ee97efd26619d07e6a7039486eba6a868d68cf2c20bf0d07eda42f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03cf138c944da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411165242"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60607351-B0BC-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1608	3048	iexplore.exe	28
PID 3048 wrote to memory of 1608	3048	iexplore.exe	28
PID 3048 wrote to memory of 1608	3048	iexplore.exe	28
PID 3048 wrote to memory of 1608	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5474055cf1d0cba3cd8b4024b9bd2c02.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d42a3c95c26a71c4217ee4fdaac67977

SHA1
655d0bf622b5100e2de43d0fd27595326b57014b

SHA256
fddb23603dff82f77d57378943072db7c0361bf78b5782c6a894d2db64f40734

SHA512
98693cd879ebdb077e2fb1083a532c190d1e2caad096c3b9c3ee5d3350918ad3957321c2a67121cde676711ad11711a7979c373235f8e74b3aa7d4fc04648574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c7035cd9530ee1ac7a6ea9d241b9036

SHA1
484dcabf5e74a4a8a218f409406763fc90df5b2f

SHA256
2bb79df9953672e7eb9fd6d67d1aa7af4cbe5b9380d5bc192f6f2b4c051f52de

SHA512
fd6b1591464018e6be9c3fbc1c4307e383b23615e3d0320592b35fb93abc9b9d2c9850e91f36401d0115fe32540773ca1473b41f1c8ff603f8efd586b68d822e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b855a9f3fea1d8461d4a30a9b8dd289

SHA1
0965afd0329c5df5e2ee308a9a0b3ee9b52364b1

SHA256
e3d9e02230693df028c7d6e8ee810ae2cf714668fc711f618ebee728f70c99ad

SHA512
4ce6b10aa3cc2a656f94b7a1dae258270977cffdabc17dd27266d53c6266638f89f40f65df0367af783d29393934f9d0bf7ed82cebe5c510b59e318030ae41da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10dd37914e7fc187dc5cb20ba671e9d5

SHA1
b17f14fa314c0518a592c8afd21f2d5fc8f3e254

SHA256
48323a42c464d2bb62853160aa9218b75fca40ebff304f72031a00451ed5c704

SHA512
b8e123a9113b033736d3accd69e43181f1e27def2c7922b5c5e44fedc8b942c34859ef30dfd47c5d612151c15d1d175a97a8413e13c24966f0c5b7d11412d736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ca8f43b61f8e9a237ae74d0128bcfb

SHA1
77447aa117bad8306ccf3bc93e02a3e4a84f99ee

SHA256
96536d5afcd7a5ad4faafb1b91511f6b0b82050a0c46b5b26a93a21a0fe7a7f7

SHA512
6a3e3abf325cbccfab8792a34cfdc4c1abd5636e3d37fb6235025cb06b9fb75cb77af81f03b5b7da39720343e8b99fd5a930e840715313418516b4cd168b5937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff012cf4fbb55afdc9bcf42e8981a259

SHA1
6550145599daf21f64d02a972c53e4c0fa1058ad

SHA256
d1c1b50864e6076edc7d1f21d014d69e414635e1065944f851707b091ca00936

SHA512
da4b068ec8afcc4af32cdac27740d0ec3c571bfd3f6f33622c60ce103af4c3c894e7208917356f70e4dcb2948cc4f0b929aacc8433204b960c2ef521a17b9b43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6dde160be15de903dea3a9020bf9856

SHA1
226e1a76809330bdcf7c64b240a79c52171dd61c

SHA256
64bcadd6218a88e7cccbd3cba6afc97024493d66451adf60ec514daf6802bfb5

SHA512
6decbc0c2bcc345d1ab0fce774348f6da9b1cd1a129de08924b888d92c5cc6c72cdeeda14b314614a2c60ec78073d81e54616b413185b1ab6e4c8941338e28b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17b586ddfd46c6cc72ab62aeba998eb

SHA1
8c75b4b5a606ab50c3c8666e0b43ca7a12c7bdf6

SHA256
e7e36e4203579c522738ca2488c357f881f63da67fe2e0d0359a86d5a3140d30

SHA512
616f603054765261ad451432aaf377d8c94f4dfe2fe96acf694e414034a54e90c6b232c57b2bfd87afd8b839859fd814b1f6ad8652e9ca51e9fb4668b9caabf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a98d69627be21b89f88a4f26112844b

SHA1
87b3f54a2d85fe8018d6f9fddef76c8c1710f60d

SHA256
0f6d6558d0710cd2e5b8db82d43f58530216af860ddd691bc0aeb16f16d45233

SHA512
af6569d26ec0b9545e9e009c8806d7ba4606e5a39a3fe47102096d710aaf0d8089eada12645a092f3c597e9cfd6861058ea753359f15af11a432946354f56ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2fc2d4f4dec018c0f6bba1cdf40bb0

SHA1
e06cdd3ecae5b12e39149194baa18edf13296713

SHA256
9e5195b166cf37f8ae8d430d2008912dc1a64d7c28488b0a81b410e814097d6c

SHA512
19972deb203930bbe78467357ade19e5be2ac3b39137004628828931135f1e550f378e48eb861e3430d8fdf24ed001144621f396747ebe97ba0fa7df4d4318a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4942.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4955.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit