55bf3217f9d57b2fd0f0bec910ae3852515950a4acf4f48d7dbf61f53d725026

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

576e33745093e24a28d960bfbb304bf1.html
Size

51KB
MD5

576e33745093e24a28d960bfbb304bf1
SHA1

de8c19a01ed79d7a2c3d7e7407310fb3f25bb8a2
SHA256

55bf3217f9d57b2fd0f0bec910ae3852515950a4acf4f48d7dbf61f53d725026
SHA512

9f2a8a582fa1935367a851b507b7de8c738672b3c5fd286a0212079c040bc323081cc14028d0a61379c4918861d834411467a66205e08c03678b58afba3d40e6
SSDEEP

768:xDayHHvPWNo3PSYksTYMLVjrCCz7pqIvmy1FnkCVj2SFiy:V3HH2NOPSYzYMLVaMpqIvLFkCV3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FB3EDF1-B1A5-11EE-8F35-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f2b96c0147b6b9e2f2b3d10c6b5ba211776cd2f2a0c8a8da281a35ec31287e26000000000e8000000002000020000000b480f4b25360c49ae9c20bb9612b179654bcb1d43ba979109ffa5bb70b22ef70200000000d8419fa5a29dd871185d1b6c6dedc5bcf60e095a033d8926851f429c88fa8e240000000d32e2eef89c8bab0d86e1c733e430ac1d77c2d48c49a4d265485af1dda9c01c3fea39d15a44a867a90d199c1118cafe2866f073c5211d9ffd46c7f36b2a3f7e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f07d8d54536aa4eb4b86960d099f0a46453dde8bc39b65c5f5b7d7824514de2c000000000e8000000002000020000000fb130b611427cec57c61a8849f8f9c4a68769895b3b4c9f64b3008ddd782c94690000000bde846829180271845d5e4b935cc4377a5b39848a7c92e40d5e2a42ce6158fa749ae4735ba6e3183edae70b55fd0ca67105e53b9b25b43c9f84c71260560d0d3bd919a46ee20473ddc9f3d9f5ea828e457983360e909e7933029030f551e8c67ea6719e52826c52990f17f8d9721f82081552829c6b702538ae241bd33811d1082ff594c3c0a2186fa450999d3c7681540000000e8487627c572fc0d562b45a69cce12ce50dadf6d5f1d921ff403b032b0da7333605ea9d207f0dc8553baade331d6387f44815798b3677859ecf6243f29b3c242	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e9dc66b245da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411265396"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3036	3004	iexplore.exe	28
PID 3004 wrote to memory of 3036	3004	iexplore.exe	28
PID 3004 wrote to memory of 3036	3004	iexplore.exe	28
PID 3004 wrote to memory of 3036	3004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\576e33745093e24a28d960bfbb304bf1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
72dd786172d8b604e0336a05d9abd9e5

SHA1
7ee5a3daf89ae5f4d714cf7bb8e1ff6d8318110b

SHA256
0abf0cf7e7e8cfb5c163915a1193972f3909de2aac8877c2623e54664a2714a1

SHA512
58639410a1ef6849a0e9a60be6b8cc3437e5e77fb5837175ca03ebc0aa9fb0543332a9c33100aebfe2783e9557af7beb005a3d091fffcc8c611170d52f2f7f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69422f9b31a3b42fef5b5aed33a1668f

SHA1
e23afe82b9ccda1f49f080f495fb4f43b2cafec9

SHA256
77e28b86ed1f1bd1999a838dd43bab91b6e3ffeec9f102a8a13d2cd05a32a705

SHA512
34dabe43c5a3f47155c1d0eee83aa7939f76390636cc45d32ad1f290c1497ad25409f69c6b5b6c95ba19c2afd0a9f98246981b56a299a2897598df544ff8fb37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53a3c41a32c460bc4f32d1bc6b8343d6

SHA1
bbe5cd1fb972140fbb9af1e3027cc1ffe680549e

SHA256
723b680a4c1d681a33b44d91444a838251cf00b867ef9e472579482a44c1e249

SHA512
77b2371eefbf0c2a7ecf13f820e6a29f9d76ec6e650c0b241eae1b11f935022676f0a917d96530ee22a630c2d7ba4ea94d3122516f369216ac905d23acc2170d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f0eee1b69a78a75048ac2cf41b90f34

SHA1
9454e613e0d7b234d37157695e3302b76096f2da

SHA256
828383906b5887821f8b5145216c6e631508daf1e693146fc42c7d8e10edfc6d

SHA512
715fcb41800d24523009f1f5b1145c45a3a34ec6806f2ec20d3d9406febf7c7f0797f49ea35849a6562b8d65692f734c823ee3fedf1c1ccd072d30e4ee1f8450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59450016015142840ee243d851750028

SHA1
44cc95f073d0c8e1542de96eb7cb23461dc3f8b1

SHA256
486da7ec3c2ffa224831d72c630a7270ff73c00a3e5017c2a9471639407fd11c

SHA512
b44e12be517176696fb376522bfef5e125e4bd74aa96bf8b874db877b11be0357e3514a18b88e0b1224384f4284c2f98dc984f990ca89bb3fdd7a499d729ef46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0cb2a557ee9b1cbae7b78b9a13c478d

SHA1
d3277606261b42c79501c26511d3995554b51d2e

SHA256
0cb2141bd4745caacd624b8451344a7e07dd5f274be84d5b434b3798e4c8c796

SHA512
98d5c3183985a4340d135dae96478fdbe12f8595924be4f9c0e868f8622e848e343f105772eb70a2497e35b46c8881c377667483527a52a180836f9eba1a37e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bbc00bd5cb28c6e257361f106be8d26

SHA1
6a091badd7934fe90f90cba9eab45b1812c9901f

SHA256
9724688f11621c36487f13cce652425bb2aa8bc26bc50cdb4ecf2a0ed1d576df

SHA512
0af375114f6f577f24ff411410d561c6d4fc24bbb1cf8a23e3f0b0533f4be01a94cbde0bd3a1c6e9a05befc93f41332ac399ab30a5895a798af2d64a290eac37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ba94d170f9c6c149f2abe7af9a7c1a

SHA1
967d52aed79f92b425a1cad80a1abe3f3bfcc1a8

SHA256
bd3ae0e32de95c7f7d163612629a9a7ad7960182c898cb7829bf64a95f99bb26

SHA512
7c570ac7c6efeb5e92234e21facdc8be20c737c653d24038bfcddba565bb5eabb072731a03635ee5f611f610b03124ec8e17843edcfda966d4f8494c40ad9d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d823e5f09ab408de13850db1bdd5e0

SHA1
5a36614a7eb29c49cbb5a8ab0f6272c5534686e0

SHA256
eb990265b2492573726c81049e1cddff380a8b56f046b4f9556583310565dbbc

SHA512
729ad63faec8bee90b6ca38d44d564e08bbab153f5ec0210c8d905564c0457a4762a7631edc73dd44ecfec28534687ac424ebfb68cf5206b9155bd1b6f1bf35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5d93765e11ddfcf5127f95265eb65e2

SHA1
89b540740725c392d12b04c3240cd3a62e695e91

SHA256
d2b94fcc958ba21263f20e2e50aea7dec673ae3d4b36f452d4186d576981a9be

SHA512
78c1230d5b566015232dee8237fcc750d236eedfc686fec1e43352a3e4cc06aada927e607dfb1da9592ea8d84195a6095eed41242d5c3494255ca1172b603516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5fecfb99bcc9c2e811c221e9fc19e7

SHA1
acd2c20cff4e17bed00af60a1adb470c2874c69d

SHA256
89e1d826af1446be48b7949fba4df08e0cacbe0c6b33cf617212c89d79f5fba6

SHA512
389be6c2606d970b40b6fec4f44991612306c251667d466fd1ee91403e9f3170413faef4d7b29eade1ff57fdb2623d9c1638953275761e8b0b44c33a401582de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98c99f58c7338d0333d48930a0519cd7

SHA1
8281150df07069a9a5d5d97c7e8ba3868d516fa1

SHA256
849edd9a2f077ba9ff17f0ebbcfa000d4e2f52814f36f1743be14bd8bc3805f9

SHA512
5d3f74b454da4cd0c1a8952eae268861c9da75cc22bc8e176a128980c090422e2cbaaad03d222e4747cd22fe291c30b9dce2e58bdd12b82a7fcf1f5760d94da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b334486e6cbb89dbf8c9ab9a5cbf13bf

SHA1
858583a77fdb66c13558db522196e8392cfeb149

SHA256
53f292f2966daf602a95824dcd44c32e7f238910d10d019baeef5e946cfd7f1a

SHA512
4be1499559bdf0b22b41d5445c03909e947958b3624060a48c04de5fbbcea493ce083e6fcd4aa88eb0e67f0c7910c739b58d7ef654ce5a72bbfd5f74dd0ffaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a46c43fa6f0bac843e162df37f978b66

SHA1
37e25f02506d58f939e541922206bf62a76e5a2e

SHA256
8e47103322e4bc19782a2a443679123a92da80d7566ac3a1332c141f38e48e2d

SHA512
9651dfa133f35831c4b739d1e7f79ea427e12b610672e7863e3879a7e9ab91c6e2911966a8a24b5dbadc20777aff05520c7b97e789f06f424e43bb31dad169a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CFHPCFFP\f[1].txt

Filesize
36KB

MD5
6680d645fc7361d39d1fba2ad0e68c64

SHA1
dac2fa5e2ed8527a7cf100dddf5fa687b7182100

SHA256
0bf534526e3a8be5ede008aeef1c9ae9c2759080323813c6f37e977ef9f70912

SHA512
ff130abf279c3f3ee89cef2a6c5626a55da7f0d8da92a5bb91e08ddd0113ff2824377b8098d1410a9a0cc784be2170b60eeba8f232ced311878effce6ba76f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4961.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DC7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit