e110c48e7f67af2e9d95742f638c04b081d769e6d97b4b2bdb16fd7cf39a383c

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b8226c5a5a6c49033aa42b064977ec.html
Size

55KB
MD5

55b8226c5a5a6c49033aa42b064977ec
SHA1

d2a9ee99cb8b064b1fc025a467e85faf1eaacb22
SHA256

e110c48e7f67af2e9d95742f638c04b081d769e6d97b4b2bdb16fd7cf39a383c
SHA512

26541805b1e948d8aa35312aac6b9cb7184ec24c547e0dec4e8f0f41c600b80cd2d081579b64f7e1edae76ba550ed6c1c6a8b2940673cad62376bcf2fdf98b4f
SSDEEP

1536:gQZBCCOdY0IxCbBGjzvYQ9e3Qtl+YyCcCSFslytbkIF4mDS3hFmysCX5jN8UCj2a:gk2C0IxLjzvYQ9e3Qtl+YyCcCSFslytD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b5c2092645da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000043ad1b19dad8dac1202931dccc03b45fd92f2857466f4725a9bbf1efab08cba5000000000e80000000020000200000004e8da25671b53aa0788335887197b57bb6eea341558d03e998c693feefe9bb6090000000e6ce560eaffd3397f9f978657f0c619e9270aa34ee477487c885e81cbb78c7dd4e79de1d58206b221b6a947db5af199d3fbca1cc5366f628c992f98f67b150997f44926d8d4e465c107507545dea3fc764324553e72b1492d95f6bc36a29557bf80c15c3ff511a9b1e30ddd30f3ab1b054dd3dc5af3a752988eaaca9a29dcc47db98428043e6a8a4a5da9501de00fbea40000000aca62a3fad976c510d4d325cd58e77b0e06638ab903946052fb6cac2148a74995f059960d725fe1a4ee37655002775c6a478f5019c80ee80ffc11c449960cd1b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BF3C7A1-B119-11EE-B928-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000625b827d4cd9b8d9c119eb8558b36f686322518e7e042c3615f5129621c30ef2000000000e80000000020000200000002908cbd78b4a7cd5794f2109a13c8247029df7ea9b3202d34dfab16418bc759020000000987ab217dd354dc17a6f8003af6878cf8494d59261d88d270fe0a2599320be8b40000000a6be585b2a87a8f2b702b3cb5d39be40335f01779268937b9e8feff7b4d591ab59181b6fd815d71385d02b533b540e8f50be397d430585862b29536cd3c8f533	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411205082"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2764	2156	iexplore.exe	28
PID 2156 wrote to memory of 2764	2156	iexplore.exe	28
PID 2156 wrote to memory of 2764	2156	iexplore.exe	28
PID 2156 wrote to memory of 2764	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55b8226c5a5a6c49033aa42b064977ec.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
656197c6e09062bdb07abf77f413a6da

SHA1
ee3fe3b1d02da6c5a0e760af5ac3313ffd582fd1

SHA256
8db7e71e4a3728fe2b65b62faa9dfc5f4c10db8dec415fd2e7a0a29ca6970bfb

SHA512
cd344b295ffc62bd4761f2e8f5556b372a0efbcf7f3bdcb8e62c2122850556c698b5494a163cbaab258bd9cf77ff39f342dc5cd501413d90426658339a781db1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7ffe9d7ccb911ad865fccd33c5425fd

SHA1
1269e4d83606e52bab18d56c1066cc682b6897f2

SHA256
6ae0114b232cdc2e52eae7b278e685d169ac7a224d2f0305a709f9c739e9beba

SHA512
4ebd67a5cac70690e1c6068fef931edd4b0104cbcbd0320db9b11a2ccdd908d816ed3c50e248cc3bbf4891a9c357a4d8a08716d9a75c5f99dacbb06d906a9e22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad1bb8a1942b7528e1384bbf45b1fa73

SHA1
738f6685ad0e880cfb590cf95df60cffdb20feeb

SHA256
5b2c10505c2ac9f550ed33609eff9201bd54d4369406a4eaf1bacbf2a0149953

SHA512
74811e6998ff58fa3eb72918938fdee9f9a7fc073d2a6f013b726276836f19ded99aa928adfd8394f2d70bdbb899be14177cb7fbb3c1f88abdc6616aa543092f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e9c4353979821135c863f41acea0001

SHA1
1bcc07367b880398fd075c9043a4fa7989d19495

SHA256
1f76f3c5127d0a44ef0213eed053e7bd99b5f3df8e71215e253fed64604679a1

SHA512
4fec67e6fff68493ee2d3b6e9e71dc60d317d81d95e6c6784b916e4b4e070e8cddc5bacf1f917f6d96af454dcd1bb04b779c20c5ec3d84b7d5a345e74898e8f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119781a7b693cc93392fa4838fbd866b

SHA1
eed2a2d036ca909d7f1bf5698a27b0dd1e2f98f1

SHA256
b9fbea5caa89330e52fc1e1a04dc296694f9119e74921612e410d1abe67a0401

SHA512
248c2711a465355e9e03d70da9d9c9a295a6bee0381496af267f7f63f1c1c2c64b26704ccfd5c6a262d7cd2514ec641b858deaf8313b6647f51850c62d0f17ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9423cedc7d95eb0a041fd4cfe4896688

SHA1
1112d94e22b62a136e99a32326ed545adb7a2fc4

SHA256
3091f7481d9316fe7e6b6f82a2e75cd178927398801153dd56eca869ba9b5996

SHA512
ca6ba4c22ff52ee3dc62e92f4492c0d280e54c728d94ef81bdc0c50658ead9ef8e7cd5e9df8d2b8cdd1672ddea434d6c2efb38fa7ba9f5039fd90266da266b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94eb55e81c7ff63ed7de4c1952248655

SHA1
99b38613155b2576e295ac71161bf9dd2a54a12e

SHA256
f01c2e02175b6b5470e357e8310e4ce87492073b1a66c8c5b89e75bca862aae7

SHA512
99afed5920dfda6a2bff7564405c3ce5751b303cb0b8addd8a550efe68b04f50915ddafe148d8293c6cd09626cbed4fd17e85789ef994681a3cb5cb6e26baf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
286aae298d1b2d02ed3685cbce6aa117

SHA1
6deb19080d7c8b3a1b3ecf7178bbcf3c5db775f3

SHA256
fa58a6e9e93d6a171ae2ea3e95a6a8eb5e6b9ff7b005dcee5db047f06beab872

SHA512
f705a0f0365835a3a42db3d0cce536ba9135ce3631dfc4798556aaad5d201cbbb4554e8cfc6397a9983a0d4fa8cb0c03b6face09578f081edffbd3f256f1fc57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a14dd3931782b824700ef50bc9aedb7c

SHA1
4cba06f987c1391112f7a11af2d2d866b699293a

SHA256
61c066d009f71cbd5b0c2e767c60960497fda499c1947dedcc07dd54e38bd98e

SHA512
9d7ba589613090a5f390be5dae4c0ec375ae77195d7062a1b499b0191ace8aa40114f15b62ed26c2b9d430a191af644bae187e8dbf7ff129393c9f7de55bc94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17c80289d5ec9f02da389e300c56abc9

SHA1
e94a162ca3275211bf175eda15fe3ca81b290e70

SHA256
590dac3928c60bb7da051698434f2b305da00aaf698d1d880aa8198698d80bec

SHA512
560c642c86667c5aeba662e1532754c9a8ddd8ac0afef6392648f6ce4c14ecda0252f9892b65052e2cc2def2617704acbe206ee1f5c093db5f505b6b2c3cf837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d455a71130427435fbcd59298b766f55

SHA1
03ed9f965dd46689a1a89e4a76b85fd52e54ebd9

SHA256
90e58168363c84fdca40828606b3c68d826380ef6ca19ddba3a2124c3288560f

SHA512
6629b7cdc1060cb24586d7c5b15efb5a576caddbc1844c1541d17859875df5fae070af6863a192a90c4c4c01968a72aba2dc41a2a93054a7362099ec4f0ca840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e22574bb1b5fc9358fc5bf7ce959e8b

SHA1
6faf5ccd594863b02c7a021e2c0312ecfdfa33b4

SHA256
0332a26f5e4d9018ae2dc0fa9f06c4eda7e47fcdde0362fde57cbf2542060b69

SHA512
62beac62f05224931e8ba29fc1c6104afb55e7ff60cba95d5349e6e6df1bfd8e59aebd27b845b704db040fb138b6c4832b5e1fbfa2b4fcce9ed33ce76ff79233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
092829b721ff03be78c8ec1d57e7314d

SHA1
4eba30ef53b78fcf626bbd8f593fc19d3284eb9c

SHA256
de4a73bb6bfe8363d08851aee6891c6f29640d3e405cf6d48fe62e52093ded07

SHA512
5fcd9f1e8434b9846dd466625782d23ca6dc50061752791ea1ad14514d16051687137e2707e46cca1eb155e65e31d1c8746a92dfe9790ea927e549e977aa2ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2cec28e3578c81ae794cb3e4bb8c2a

SHA1
181c25638fc5779e9df193e1181541cc436c003d

SHA256
108abc86bde27dfa2ec4fcb9623357f0c6c99dbd58b77b4911dbe21ba4bdceb9

SHA512
7d04703eb8a6e225cfd03e17372308800f88d34b47f581df3215c10050c530ec66643af34ea32bb729f090311c52a6073d55cb6075c0c3e72e6f0af6355a1109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7b428312e0791c504c47bc391b4942e

SHA1
a94e67d82adfb735d675d3f7b3ee7ee8a5fa8681

SHA256
99cb12ef61b352d689abd8f8ef09277a6e2dde6c760e14436d58eea2ba7c2ed3

SHA512
514077766fb952345ce3d79b7e1c59980b68fe3f09bffefe08170cce2350a508b1768021d9ac171b6540db3d82f132f689902abbb87de90280d1ad4a0c8a3d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0563e0fd9bf2bf060a3754477b86b43

SHA1
2f29e27ac9785b1a9f1995b021e748beff4cb2e2

SHA256
ef1a56bc8e7c10b629e321ac8dcd83df35f2d624d47a7f7fe101c314fb2c12d1

SHA512
c7a3233e8a236cb134ccf29b055d2c4f846d0e98be3604e204cd115a34c1ff99e81138e02247fd937cd8a0a71fc7ae2c24206a127b8bad6e13efe35f56a504c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E9F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4ED1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit