8776b459999d7be4a443acb197208b44dc10e7443abe9b9609d591ec2312919f

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54f4b9ac64b0cb268fe0b3f73e9828dc.html
Size

11KB
MD5

54f4b9ac64b0cb268fe0b3f73e9828dc
SHA1

1c7e3a72f902b1e8fd6010f4986249409fbece9a
SHA256

8776b459999d7be4a443acb197208b44dc10e7443abe9b9609d591ec2312919f
SHA512

c621f36e3814c3493aae109bee719c42eca286e1857cfbdae5509de0eeee51aefbd10ba1baa3a720b895c75ca7775420ce9e96819092145f11f2f427239b7cc2
SSDEEP

192:XOraQNHkDB/zaqhBhCFpdo6ml9sLwAlTiY3gfgZDb:XecGqhCrdjml8Too

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70592dcfeb44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411180082"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3B575C1-B0DE-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d00774e6585242b34635d70f7388330d79f9ee3799d03a35797a2705736350b4000000000e8000000002000020000000a76bb2e0501a00d30cff55e68b440d70d1f490b7abd5f0433c09c2073e520f4920000000e4a569bb13f94383dd5efec6acdcf54c8fd12462e89bb6c83c03494d118b1b9c40000000c29614211930298340be936246adc90604c99b59ec30ad6c9bb7995a71306a0aefbcee12f26d366022a256f9d6aedaa854993fcef540c7d6cf8716f2f3bcb5e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c567cb1ab95674009c93960ca59c8e333899ee65de740750fdb8213f5c40c86d000000000e800000000200002000000016fa3ff6d9857f85f9a4389eaa9a4f478c22f1c33055b696fa9b62c2166b94bd900000004fd7e1215d4ea02001486d69d8f2ca43c0e850db46182a40b277345b988b70dbe8392a290f15e3463e8b2ab39c636ed5b3b4cceba0e20f237abbc8f67d6e9996741a3287724a7e855051091505904b00e04f93df9b33655011c854e0bd1d7fdd6f033f7dc098c5ccf20dfa129ecd533f6f07b0e3321c71f1f11b33039abad187dce050719f52f3bcf6aeddbf1f9731df400000003157e2e61420d11a3396fc0ca73d23362013d8ca12d7a9853c130030fd2259ab79c9a2a2dbe2011f7e1e6a5b5edc2e99fda795757b961bdceb2a1d3adb132d77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2084	2440	iexplore.exe	14
PID 2440 wrote to memory of 2084	2440	iexplore.exe	14
PID 2440 wrote to memory of 2084	2440	iexplore.exe	14
PID 2440 wrote to memory of 2084	2440	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54f4b9ac64b0cb268fe0b3f73e9828dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f630acc3c17678cbf8fd660e6fdf5d0

SHA1
262032bfe18da9dcfc092d76c0d96b4371c85086

SHA256
4711ad42b70a37891262c5c676c944791822254ab26eb298b8ebb99df038ff83

SHA512
4f6897a9ac30f95730a856b4ace15ad001e3d381c1a61a98ba8a0087a36bed390d04dcefb184f6551231704864467295c53c77d708cd307a351d566989648b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5aecf3c86dd9efccfa35240618f3050

SHA1
6ef89f323eb41c45c8613d15e3fdc36e4b0a1940

SHA256
08e86a4c0033c047a87c05845fbf2f158ddfb0b18fca9e9e043c1c143716f26b

SHA512
c0220abc3a164b36aed6cf4d8f2c0d9c40bb59042f374d7e4cfcbbf37c0323a9b881831d5d2359d2cf083497d58bc7d58688aa3e34314773323bc4436683dc61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36cdb95ab21b2c5649c528e665a4177a

SHA1
d962b625d2cd13f3ddd2c694d520e34643f3aebf

SHA256
f8ea1a82e788726e64b1efda856da75c26e704b2f0568f96de58c7763cc7e06d

SHA512
664a0e79a9e2ff91c17b0f11f6fdaf0a9be2f4468186e6af8be0a407fc858de7a349d56e2022f5caf74fcbd32d4759d7ac8909ef8307135aad92936ad7ece604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e85f0b7b473b893cbb0c2dcf4f844ce0

SHA1
283c4153fffe9f5f06a2bcc966593e50ba34cb94

SHA256
a720c03498e886cac69310e57a570c52c22549b2bf831ac7fe21d8c328b79bc2

SHA512
3edff53ccc94e8e49023c66a497a41e690e949a8ad2c68f4ccb2c2503bc96cbdb097ec8655e21a618a048979cc2e37ceca310efdc14e45441cd6007b7a83f958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26d07d2db3c376bbb6a26a95a920fe6b

SHA1
6d0ca642dd4c24409e7f31ec7fa0498aa1518ef8

SHA256
e02410e1d927a5494ea170728351d74207a1073a38c8d0d03cd89f990c504fae

SHA512
0bb8d48edc1bbc8b56781d6cf6ec44641cd952e539ecf8fe131111ff3390274132cf7a59fa880cdc354f01fd89e268dcbf7e695e7de2c160a38a17c398cbde65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
277e0da4855be4155ce5736f03142adf

SHA1
06968da5125270dabab2b40ee0e994f79895d5c4

SHA256
ba1708bafefe8b9787ecc74c095b7f2561eca17b5f9bd48f04e976aad85ecf89

SHA512
350a9107ae99782ddb3a9529984d3c112f124324bfd3dcab47e2d660c3eaed28372c4cf1671223854964f7db3bcad44bd3b894bfc0c858e000ff94c68a36d971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f00693336aec666f60151f2b4ece11a2

SHA1
3703e625648582b6b6856b68366be6a38ea1c2a3

SHA256
025ee3c0e9efab82c037361d07c17609e933946ed679882d44ae618d862a41e1

SHA512
ca8cfb363f9839b07cfe1d316e276361e8a2cb9f068b0b1d148f9a7ad2326a7d0109d2543d8fcbfe87275f8b15fd82392ea62811daddfa34d976040b2fcaf754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcd2c24ede11cc43c518dbe455c32ed3

SHA1
09809864adf602df2e4fa49ded7b4ed28d93bee7

SHA256
4f7aa2e7c9dbd874f4fc92419a7908a64848b6418b844af415348ec16110350e

SHA512
cda1a4d900d586b06e40fb41f0534d6d8d973eaa7ddb393cc069f0131de70a49dc2e29bb045c382a95986823fba491e69a4930cfec5aff9c7ad97bb5ba052d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98c45042487b9f4ac57a16474d18b196

SHA1
886c1d8a5cb8439db9228c1966319cce96569198

SHA256
fa9b974aa71097eba8f5ffa88841091ce127b1ab9a4d96950a01f23d3c00ceb6

SHA512
927650381e81e0f3c5e66c7750953edf25d81a9714b794111f7d9702d6caa884d2f414f227b9c484bb8973453ca457865a07613f2820392f3f092804a9f40883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a51bcc262a67256e2b1d7be54158a800

SHA1
e2d78232b3e2a3f2c7d5d242952cd064caceb81d

SHA256
e392f7dcd31fa14c6eb305760714ea6fac3ff224a28e4977874169c2185ddb77

SHA512
5340252a4519362411d8c64b752744ad866b5b37e550b67e0d962ac37dcc63322dd2a0422cbed810036cd8b0b68d0a95954341b908b70706c341511624426092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ebba207e9f012fcf7b8678afaa7332

SHA1
69438d0f9c12de4d8634430412b601721f09a74d

SHA256
79c40c294064ed9785f900d69777d397217323a0de9586052b5f215ff812618d

SHA512
bfe1c9068c75ec7988f43b978e2a6f6e7bc6a08e9e014a341988e3cef5d949053d6a4f6060dc0903981dfd192e32194fcf29bf6502254bcdb5ce678737556267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4086e213d39e024afb66ddf2f829b98

SHA1
bf7f015c300640da29d6f61af6a2dc7bb378a517

SHA256
76e98487f10daf7b6595ed839497e596ecc8b919d4cf286b5b44be656529266f

SHA512
49f8512491ebc94e8dae7fb378706e504f365c7b7778eab5ae9c8542da85883b1d916bd0ef8ed7447d76a3c49153c3f1e4f60a09dfefb1a86ad46919f0f1c55f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d3e1b6c4170244cd7058bca4b04633d

SHA1
1f608e24af7d8e3341565d107c78997510a6566a

SHA256
9dd566e6c3f1cc997a9a674465f737d8694bea45b67f57ced6bbff842ec7a195

SHA512
19714260e998f3d1e31ceaae2a7b20bdf140e83d703a20e476bdb639dfa6ecdfa8d1a2067b54e0885b9e2695a5575a1b4fc5055ee90dc0a9f9f24486bad52c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
020fd725ad247a1b9a416cadf726296c

SHA1
a04d9ba066bc58c764667eeb2b226ebbabb2c21a

SHA256
c5575889883e5b68807af76652ebfd62aa441ea27c0ac210fde047ec6e6c4a92

SHA512
d9c731a0a3c62d9dccb25dab72ff7b2627e6f365d2f1ecfec0ed335101bab5132d9452448f632bb685c6cf1ed007a4abcbfb448c447cf8f69cea79a07c7efdd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
932afa3598a529c187c353010ad8ead3

SHA1
50320831e8b2b75622108c98320718d94bf54000

SHA256
b0fb813a8e603de932499d0e145e19a9b7dba4b9d9ba7905af68498d03056888

SHA512
c3cbc10e5544ebc5055bd72afd52beb85be04d4160c8447f3dace61349b47c520feb0618b5ffedc51e7f0ecd73e4648d0bbcb0c5a315e98cbafbd72d5506921e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
991efd570fedbc9b3adcacb23ddcf3fe

SHA1
469379624f83825497741e43e46761f9d782d856

SHA256
cf948bc097a7288bf99ef3d630521b78fe300deb1054370029c3863ef9a5afe8

SHA512
5146af9fd4f1a68afeadc8de6ab27f3d8886f9d8755d3e0746a510b1bcdf5bd993da012027ea93c7738beae9786c6cbb3e829f1e7bae3e447c735d115554f54e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34A9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34CB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit