e32be33a1bfac5a2c4f6c123eb1e171e42b164518d872f1132de76a0aa70f9a5

Analysis

max time kernel
142s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

550c6db4d44f9b98ff2b8e629bfb0e58.html
Size

77KB
MD5

550c6db4d44f9b98ff2b8e629bfb0e58
SHA1

c8c580b65b21c4bfc29c7cf3f0fea58aeec86c7e
SHA256

e32be33a1bfac5a2c4f6c123eb1e171e42b164518d872f1132de76a0aa70f9a5
SHA512

91f05287427008b46669187ff5e62aca055a8d5e649c4042c1a260a413d3bc7dbc04b7dd7efb0659ed042bae39d40179339a99f68da874e7b0584ea3e0e76222
SSDEEP

768:Zcd9QZBC7mOdMo5pC5I9nC4ESXZacOJKPd:gQZBCCOdZ0IxC0iJKPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fa98d2d82a7032269c7078825d99961dd038f31bda9d681456b33f3129a6584a000000000e8000000002000020000000e7d1c14bfe119ac81bd23543a8661e7c1ad2501e9e1d1e762b73d77930dae3cf9000000061845e6ddfc0b3a438d496ef4f9d0b1f2022a9deb330378eb44483dc690e717ee6080bc44d0e425ce6d069ee4312dfd27a0b0cf431e840feab44ab34d23ca8cd1566b03cbf959ce078bea65c6188901fbac7ac295249dda623f33f3f6f459d248f19925658b852c47ffd49d4775ac331b0842a009f67de258a2ff7ab8e2e7f4350de9fb2c788ff7ebe507148db542b4840000000514eb6c393702d891a279cabf7f640b2d726d4b2a07dee66101c7917aa4c28de316df5fc7c280f3553902907d1c317c552ac5343055dd74f054bc1fef1d3bcef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000396a62e23bc3296657ce67765b49925587a72ced8ca0de93dd7a5d387c580402000000000e8000000002000020000000bf8ae76804681e7a225fd7f089cc120b411e9ae1c4df983edbab55773b137a42200000004c2acd53869b4744e8cf6622db4bb57d39c41d7b6c6a3ec56310fdbece08c93d40000000aeae8ee50ecf64a1990333b0670025e548bd84b4c1c4d0a5c360a3f6045e4122893e8b7deca99628414d1b3d433ce61396175da682a2e5ed2a85bb8856e427af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411182823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52F99601-B0E5-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0380829f244da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2360	2288	iexplore.exe	28
PID 2288 wrote to memory of 2360	2288	iexplore.exe	28
PID 2288 wrote to memory of 2360	2288	iexplore.exe	28
PID 2288 wrote to memory of 2360	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\550c6db4d44f9b98ff2b8e629bfb0e58.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25532a7a8ba76126531d672d38e4d23

SHA1
914481e09e62ddb7554e90d6766c7a0cfb1db00e

SHA256
ba922abb697340fca850cc2e15e6a4f177697f74d3bf23bac216fa7e004902ab

SHA512
a5cbe7d8e2ece08b15ea07f8899d6cbbc64d2a5198217ff5a65116492ca2bb38a934af2d0fe16fbe8bee0115f4d892c93466f215905d6c3fe3f3dc8b01a2d9dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee00265ce724e4964df81e7c663f1606

SHA1
f4f687568678ce97b8d98eee295455bc0bfbebd7

SHA256
b0548a6502b4b0274b9cb3a90a275fed0c4fa45b4a5e1279b2942da9d11e6f02

SHA512
b1ac47d5f65e6ac55731effc1f77f09ac8d23d8d304c060809516e322d234cbbea41746e92951cfb23750468b4daeceb078bcfd1fc5863bbe1d08beee580cf30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed358c0af75093d5fa524bfb626d088

SHA1
b33d8e94795f61fc842fa96b37c355eab923ca4a

SHA256
2bfd95701bc411c67a5e04d9e09f2e84a02ace8040cc49e600f57137e02d6182

SHA512
0914e85325a2e792130377736d9a58b46641e052b6b02e1e838d54693f7e4d7187da164cd5cfcf8cf5e7b4bad4313f9a3343a5485ede4d04564eaacef9e86f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a324ec308708f625e7f6f89680ae96f

SHA1
8f6cf37f56c38769aa7adb3e355d9740d8505a02

SHA256
a6278bf7597a1cf2fc1d8abba968b86b53cb57041fee5f6a757bc6cf55eae019

SHA512
d3989c9877448b9ebeff6055bd198a8cd15703cb06df07b4dee083d3b0f8c63b8084197c0c8afa447dd09cf744526f4e57ad50b7147dc9ff874dd547da24a7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4171809ffa8a9db7213020a53d8a8eaf

SHA1
a9e0921c99822b9d779fc2cecaa21c06592a21b4

SHA256
ce91572bc482d61f58e6fb05e4e2a705c9d05d1be44d8ec7083a5eeb46426dc3

SHA512
73f89d4f862c72dd5acc233b79d734ba8eef47a961c004651b20cf9aa820692bcb38984c8c2c4fc6a97803f67afcd81f59e6bd4a825b24088e95085c2876c3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abcfc7e6c4e3739f0809ecdedd59a214

SHA1
f8b38fe77c73f35077e0e5a70d353731dc01ee97

SHA256
6805ce6325ff051c9400484fd0a75399188d5620ea6c4cc2a3f1a5617f729b7b

SHA512
0ed942159eb0f8951c5dbb07fbdea486cf6f1ea10e4652a5a6ad67fa232c56ad524259a3cd6f92767c65a23fbddfca32196bf98d9cb42f0b330ad05e981587d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
596db367e6f5daa18cce4e059598c65c

SHA1
9a67956dbfb211a02b6161aa3f1c25b82abee5f6

SHA256
18d47ada0ade28f9e34c18d97d6caecb03f5159674a0d1b40e3a82385dc337e4

SHA512
72e32f240cd9d6ae20db34e329a8495af9e38d1a1b9345321c92a8a8ec819b623db126b7b413efff0d6cee859b0e3feefde6252261ff20a1343ba266a7188ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7999208f391932d13e9a381b2a4cebf4

SHA1
ecaecb9a399ee6f9f93a45d814c3ced747cf9ab5

SHA256
6f170b127a1fae3de4e9312e7641f2028e4d9e3412957d6c9e863e350eeb808c

SHA512
437783f58d7882d18157268f705f31c0cb55a06118a0ed795b023450f85025409e3139c254cd56a20b2d53ee5a5994a21fc45c260d0336b0734b5d29a221a303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
774e2eefec07c5e670debb4bce5f936a

SHA1
3d691ba811fa16b9b935c88b77786ab5261ed6e3

SHA256
310fa70a9737093bd4329f139ebe52328fde0c78823c2f00bc3da3f9bf73b203

SHA512
54ca27bc1b55db5c1cd3a3cbc89ac4cac99f7c51325fbf326aeafb4a3728e0d0d3d4d7dffb1bf1d25913305ec8c28d4d4f5148362da5661143bb37907310af5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA45B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA53B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit