db9d81f54c40d0464637ac449fe92e3c00868337a0be9db4870731e6d3082cf6

Analysis

max time kernel
138s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56f9714396a42b1802491e1ca07d4775.html
Size

448KB
MD5

56f9714396a42b1802491e1ca07d4775
SHA1

74746bd4ad241406fc282563b0f31376f6fb31f0
SHA256

db9d81f54c40d0464637ac449fe92e3c00868337a0be9db4870731e6d3082cf6
SHA512

62cbb8e40c28ec71bd4004a41776564f66ad313b0ca7420200428c1dbfb95fcc3c5ebce5e736b0cb82f268266d9fed93416ba520304caf1a9909fbc35d54cc4a
SSDEEP

6144:KsMYod+X3oI+YPsMYod+X3oI+YmsMYod+X3oI+YjsMYod+X3oI+YQ:o5d+X3B5d+X3O5d+X3R5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e67842e9400d62874588ce7fce064dcf6d93784e0a489c89085bd350365ede26000000000e80000000020000200000009238e4e948cb820e8ea6ffc47c11983633f8e4f2e447b9ff5b2df92ee23ce6e42000000030b271acb55363e8516933b1e9a38e54f080037d2dba2b69ee230c89723e5104400000004d867a72072b2f09e4e10bd31ac9f42e6e9b1c7d1c329503dd1b51cca4c5f6b59343a06432276b189706bd75c707a21d68e38ffa8f199aa1aa465a3b71a68851	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006d5000d9c07e0360ab838c3618fda7f47aefdfc234d244750f47137481bc8409000000000e8000000002000020000000c85ce665426f5b82451218a8a803476d32849c983783dd5bc7c93fc37792ff489000000067933f5d7621e12cd696edbf490d4ba1bd65f7bd745d02511021b599b2507377b7f6779ea1fad1f5de73bec7015d9b736428c0432ef45d6adb6005aeaa2bd38f7bd351721a3fbc6f65046454329e4b12ff5efeb7657b69122fa7d4e714ad50443a330fe3c7497619f023c61bafc3671893c6af154a2629ee962a01db65e991ea1e3cd980ebc2d2994310807226ae866d400000002c809ac2ee170cb064580971f4587b08efddb2f2b8568594c6245ac8e4ee6d820cbe1950bfd668a823337a8656fd66d0f19090df50d0b5b86ff05cb0a1324fa4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A18C7F1-B16A-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411239820"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207674df7645da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2816	2376	iexplore.exe	28
PID 2376 wrote to memory of 2816	2376	iexplore.exe	28
PID 2376 wrote to memory of 2816	2376	iexplore.exe	28
PID 2376 wrote to memory of 2816	2376	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\56f9714396a42b1802491e1ca07d4775.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c61cdfa5996594af88c6c4d532f9623

SHA1
aaef841992753bd904608d25c4fbd08cf710bdd4

SHA256
41e89e2b5ddb73bc7b0f0fcae56ea6aca21acd99254f9cb0d63d1b6cc95916ca

SHA512
0276240d2ed60eede5f5c6454c674225c0faa3933253f0ea8af8a6ffd055b10211f617fb75b9a3f9dcacc9d440846b0a67c10fd54685886f248011836a4650f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85d1831fd48a10e0b13cbbf0b1c56f18

SHA1
381c2250847db80e9896359eaf42c198cba208d6

SHA256
431da1fcdd084b68e6ac25caa5c0ee1268437e683b9b169a97d4147884e356d4

SHA512
14d5e713b4051905e4a60e8b31f14b1720e7a60367f08eccc45ae1dbe4af67a1a0c46c4a86926e1633ece98308e27f867cce9bcb8ee05b5e13bd9727c3b16cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc2093956de3920e384eb2bbaf8167f

SHA1
1a83892264fee3d4b56c5bafbaa5eaa6c9a6bc66

SHA256
4872b574af11a2cbe596248f02ac02a8cecc80f6461723805dd3f7489489e2ae

SHA512
8bee5cd0b27d1367564118b33974be01eddbc20e33bbfa10b3b19556aac6d8f99d7ce1d8e07e9f1a3eb639914d18bcdf2f602c6ea591e6b92f855e69f6df8fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5d9ee4dda000b473ec5a7a7c02641d2

SHA1
0d93a194929a521cee09b00656196d1a83ad52f9

SHA256
951370e0a92a4e345b808b9f7aed46bf4082d687b08717836c9739beee247f2a

SHA512
cc08c67f1d6c5721fe56ec387e63d4ea940eeee1cf310285c1ea69b16bd70d17cce7615e7f6bb562312cb4e061dbc563bae392a437f58330a60809c4d8496caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e244ced4d5ce2624ea1c79f1f8dba23

SHA1
cc5646637181df10a34be17076c4bd5b154a28d5

SHA256
6bd1fa0c94d027e420bee4f1e7d1c8d883f588b626b90ca5ac2e6ffd271b115e

SHA512
afa1d6d533eac8586b1f197fe78e57376cd79d4f2cf0b03a9120e32c1e9a918b0bd2ad81141cb47277384d946a07e4d60ae7afc1aae64482686fcb34e710e206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2df455cdbdff95234269994c322ad62e

SHA1
bccd108bcaba325fb7f87fbc91959d8f8059cffb

SHA256
51dcdb01b7b48046ea4731deff4293e8efc32a1b90c1528d64477faa1c392022

SHA512
83e76c694523325e5fd21cabe70c4040fe7f9e3d6ffc08e3aa58f889bcd3ef88d1cc41529e969ca58f723ea51dd7f7914688ac09857685b4916e8b26653a9b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a92dd17df0adbd85c5ac0fbccb96b5f6

SHA1
3c610b04b6595cee8ca118eb3fb5844ffc420527

SHA256
c8ebad42214c15f29c9518b67fe5d5e513ee72e46e4468fc444f6bf9f7e68d7e

SHA512
050453dfc644697399303bd374a5d8641ed5982944c93c3cac0a5ee088fd94c7188fa8d1559463ec77163109ad240fe0e43e64d39cb42a997b111e0fe9b947e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be7c60cef78a86669903c21e6deb027

SHA1
4e99076d28014868d9815c5841f0f7e8a6a0d60d

SHA256
08182ba9fa324b3fa95d7a7154834b29a450acf774b35caccc7f9a6051d6400f

SHA512
5e5c531908aa6669de0f4f097e5660d6280597af74e4ecec085c6da175845256cadd9270c1eff87480ee80686cc836de72c137efb8fbca2a3e96f49f44bb25a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd2186529fa749cb8fbb80c6a6f1b07

SHA1
70dd48150f533578f96177e25a486a78b52e370b

SHA256
817927df30db2e7a4a806ec22e074a2e8ecb047968386a7d0b9513d4d272961a

SHA512
10b492cf705232641ed08d4c9b90e4ec92d3e08f17c53ff136497626620d50b0867ae842bf3d6d27cf46782cfadabbcc4982c913a32056582b7c4c3c46ec6429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2386c4044e1302e954a36c078b5b1df4

SHA1
b335119e1144f6ae3f2edc46bc1c0a1c994ab66d

SHA256
be633d8520d0566a6ab41fdc1c224d05a33895c7435e0d37d7616c755acb1646

SHA512
16bfed215309aa0f26245455e5be7f69e1b012d4327fb2dc002a3507163d761be5f4cba61f1ad962a998f54b0ca3586b78acf81026c500edcb710a05dccae3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24873d33939348b5971c9f58004a6e39

SHA1
a6547f4a7febcce4faab2bd3164b3ba54ca8d11a

SHA256
f07426779a3ee2ff901c8465abecd0aacd899ecda9afc3c84013e397d8d26366

SHA512
4b9cb45b8edc3fbddb7ac6230f83f8a0b68d6e949dceb462626275a5c10353bbde283b1f2d0f199a5fcd7ff826681faf5528c38a9095d1725e94732126a797d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a4bb3ac8c81e4cf67938a97d5963e10

SHA1
4e5aa34c339aae922f44ec32c2d98e28285f0dfb

SHA256
db7d2325bc5051ed73ce4400bcf85318240fdabc89d81d8daed60095231ae968

SHA512
915da3915a35f79c806915236dfd18c6fa92ff71f9426ad72e28fcf6e5d9c36a0ed60f94f2050d20e03a5ecc033b0ee016e8cf3fae0e9a8d069e2e8736a80a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a740a29c7aa966428a359d30f7fb0d2d

SHA1
5c1bb55e9eeed6ff9bb9ab7479d588a6b9f1342a

SHA256
5ec2e12e9be4756391944c9cbdc76372b456279c4637d1081ff8f7f749468e33

SHA512
a7def9ec457bdf335a3b5f368f636a62f949e96038d7501fb7f6c90ff4b397ec741e6a5e41352f87c6032900517bed5e3214aefafffedd1d7f7a9f15e7f2b27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
784b67cafaa156dc022c182004d6c345

SHA1
5f76fa4670bc658725960078985b269fb3c6ec28

SHA256
c0b14ecd8b576eb5ae60ef44dd861a6f14cfa0a450a93cb2ccf021fc9cebe3d4

SHA512
1949ec653e941cfcee95437e658d624d5a83673926193364c150b8ed3bcfcba3fed32ae11bd028a8cd240ba2782130882d6f1573dbf6c57ba2018d82c795bc15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4c5e0d289f9906b64c3ebaa11f11aa

SHA1
942d39af71db9b3dd05744a119ffe4815f5ed61a

SHA256
ec626870078d86e600c4b6d62e1ebeea1ad06984045421c66100a19609ae159a

SHA512
500e1c47eefd2859c8f59f21e8aeb0af31aed258b28ea298ab26ac64ffd98b65fb8b7d466d783418c4ca0a760a2f2a50b1512f4ae7d743673e842386bab30a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d778948dd7d3c5574113171ad21412e

SHA1
e201bb1967af7d31d8f3154d75e0b9aa78913af0

SHA256
fb735b20065c96e8159e8611635fc415863d9c3bd34ea1d8e9ca493edc598f28

SHA512
0eb04ac6b9346c98d586cdb78c98d79005299e5c64a7b0a5a42b3ddd2ad8e8325384d563c87e23178815308de84a9fda1e7a615f18a7f2cdd9a9fdc320929666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14cd29a070d181ebbbdae7d8b2e5678c

SHA1
3c5993a541f518fcaf47aa19505b19efe6c2b5ca

SHA256
695d09e3d0f245245e6d17972a64a8ebe6228f4ab4c0d9bb215c8496e3c70000

SHA512
9ee6f52230d932bb9680968b74de21c6dffa9c6bcf2c68e5f0f8019d3e4d7dd1440562a0d9f29922c3317599260feb0cf176bce7d97778db0f3bb36dfea6abe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8643.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8EED.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit