55f0827d2803fac9ac22972f122744f53a9f8c918fdf551e2b060fe81cdca3e1

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55c2a1dd113eaa930bb5448a91ab759e.html
Size

432B
MD5

55c2a1dd113eaa930bb5448a91ab759e
SHA1

12243733b78a90773d5cad9d29f604d54f833759
SHA256

55f0827d2803fac9ac22972f122744f53a9f8c918fdf551e2b060fe81cdca3e1
SHA512

30f21aa09f4963cd8694ac17adaf995a7f8478de3d1c405b8a53e39225aad6b687b1ac8728f80d622d3b7d4438a1a41159ba91dcaeb0da104019323e2684d889

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000914a7905c5741a38bf8a99fc8f2f0aff10b9d6f80aa8c5b4ddd29987c23f6b37000000000e80000000020000200000007c181d32affacefad12260894a59a0bc8877851b61720a9d6b12ec0178fa97c22000000056b23eb596afd51b1a328fa1dcdbb7d9f3e6bd25151e2b5df4c83df4811e21b5400000004ac20b7ff131408a4b8dd66eca205db51da9f98732c3fffc3bb5bad98aceb97a047783ff25766de27eb04ee1c804c19e63f8a67dad7feaecc9e78451d7565ef2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2764F591-B11A-11EE-919D-C273E1627A77} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411205508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05995ee2645da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000e5ac73a30b60cd2ccb756f251c9a4fb935e654cf2e373de1da6972d99ada6afb000000000e8000000002000020000000800e13718074b5f02700aa23cd6a752c3ca5d66a51a64d4d28cb25dc1708643390000000c7bcc00ebf8b2b3d325ed21a9403c69f7e3e44268351d1dc544e4fa9efcf912a8256f948352519abce32fb2826d4bbf58b43eb816206d83d49830acfb253b9a6179b308ba8338a1222eb7fbc94898450eccf12dfcf678ef2a8ed198f6fb580f19b131fd370d45713c249224536a83c84675c62d71b619a29cc7ffc08990c3744ac5722e706c938492e3d2eb1723891f940000000275a453f5a045e6d4e368083b4fe96b4d50bf823b081b23033e8c5e983eb58f60bdb3387308521e2359625be3f78e0aaa74db0f7a2743f6cf55c9447c29c7b67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3048	1044	iexplore.exe	15
PID 1044 wrote to memory of 3048	1044	iexplore.exe	15
PID 1044 wrote to memory of 3048	1044	iexplore.exe	15
PID 1044 wrote to memory of 3048	1044	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55c2a1dd113eaa930bb5448a91ab759e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93492695cf4f47b6b32ccc1c5ecb187a

SHA1
7ca0534aa0eefdcbd03c3bbbb84a759ae64e7d61

SHA256
565b702ab93938f3d9b92d0e9604fa047e7272a9bdb3de2e960aee4baf1414ce

SHA512
0c0ecd62a670fd9fd1ddb920a89f71233987cb1e769a59319479cb604a43be7585d480fcbc7453d5b869b5163ce04080d750905dea351d7108caf93d26fd41d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba0c572905df901b9bcb28f6e51ef350

SHA1
3fb049359fa7128bbf6a96f94715945dcefc84d9

SHA256
16d8b4c664db8132e730b490bddf8eb8ed4d617b1d857959d9491fbc62e8fd01

SHA512
66ef1c425333dcb6786ec0509a18742c9dc49f9e6525e6fb397e70177e4489d33e1f11516f01d7da7ddedcbbdcfe963a4ec173e43fdffa54cdc82ed58e9ae7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12af8e558efcc22f5605b55b33b7693f

SHA1
6753b182bf2b5643d69f6e9c3b73d35936015719

SHA256
2692f6d0eb892979b68326235d2dd6466c57e1f52e327bd593c92539ebe594e8

SHA512
2936ac9b63971925b238ab483c172b3732b6fbfd349704d0ad8b23e407f740681a3d0c942fb7d7421578cae6612c8f4d246d11fdaa827f07684ce25f9c5ef2c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a6aaa8f154594530fa8be40f5c1a6d

SHA1
2829139b57a48ce864be6da2ab0384a2c17cd8a2

SHA256
6e03ee290cb8dd24922a1fa051d02bbf4c8c1ac94cf034b460665e014b349069

SHA512
53a9cee139e5e2de37cceda7a2b18c58108182d5a1109ae5e09b17fbadcd1d2e03233681b6a5fb95dbf40afc861e33747b695a551635ada55999de47821f79ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7506aee163044018eea3870fd349efb4

SHA1
c7da36a6019907bb82274f456577e5fccf4b6968

SHA256
e490ae65f70775f73bde7516099ecef46d39586890313a9a41112a7fb981636c

SHA512
999c232f5ced17a0b409ad9ca8f8ed63e41b00036631b13858be2e6e537a607a2c51c6e8ec7b731f2de1832982de97fbeb970267a49110afad37255ed52ed554

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar177C.tmp

Filesize
92KB

MD5
bb84d39015d7734bc7ec5da88a516b23

SHA1
1a15cbe452f750dc4f5d780b2517fbf82db39fac

SHA256
8f807ac7fa789d13f51c3451b2728ae70fb489ff20a8c20f073e68ad0927a882

SHA512
299dfeacc8cfdd600ce91764a0b3f75a431a795635989c2a53dcd40cd1c42c17f92179e8b239a2596414ed59ba7deda1e3503aa5ac611703bf3cf7a0a8abbcf7

Download Submit