ba1d4367099ec9f9b9b57367f61e48e6ec0cdb3869cda00b167d159da8274796

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8146ab6dfa8b87a9519727bc2a62bbb4.html
Size

601B
MD5

8146ab6dfa8b87a9519727bc2a62bbb4
SHA1

cc14ffffa21a792734ccf612a3d87ea37904af90
SHA256

ba1d4367099ec9f9b9b57367f61e48e6ec0cdb3869cda00b167d159da8274796
SHA512

b10588b3c6eedd6bdbdb93c36de3e5e8223b1a7be0252c4f7a3536a4a841149133c230df37b7c6a9ce1915aa797dda6d98d82e7b8f023005fcc9996471b5af0e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2A1AAB1-A195-11EE-B092-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2216	2212	iexplore.exe	16
PID 2212 wrote to memory of 2216	2212	iexplore.exe	16
PID 2212 wrote to memory of 2216	2212	iexplore.exe	16
PID 2212 wrote to memory of 2216	2212	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8146ab6dfa8b87a9519727bc2a62bbb4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa665907bf0e8ab162c5f91a27041aeb

SHA1
ef1ea53c090359e9f8ce678bf519112989353d07

SHA256
f886bda6e4d174de0ddbc03b465d935b181547b5bb2d56b473d006021476c253

SHA512
355f9b06a6ba15e896820d18e98c50548aff7ee192964cef5dd24d3e01c5d59136072b1635764c0f56ff02db4ef654577da73a8e74952b489d10ca1efed550f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbca4f0a6a0e4f68a50722f9b64fca30

SHA1
58f8106d3b88e32b1bd332cc0e2e17cdca7c2efc

SHA256
315b491ae3132e8ed608ee44243ed459c65fd7672cd53a2ea5586b9ce60ac262

SHA512
31772a106c77c320fe6284a2be5e2ffa9f0923c768c70407f413232347922376336711526a5ea5e207017c3fe0d747b00842a890dc785e69e7a1a1299ab4a07c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0ae0afb045b962dffdbbd39793785b

SHA1
02776fbdfa91fd63e0a66efbcd5c7870533117c1

SHA256
b1c7a010bde55d6f43c1f54d64354596538bc752a9214b2059e9c680d6a40710

SHA512
d2ffc270770821c2019fd05fa459fb132f2bafc3fbb5b7502e36bd0b8ce20e74192822fc746cd96686bfb5afdd5ef9c43bda1e0033517aecafdf1afa33539bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
552df98c5c91d5b8114f015e509cb6a4

SHA1
ee5cd61940ba08402cfe7723d96521bb7096e94f

SHA256
aaef803334efa4642528322011dec0da27808daedb535588569052577de5dea1

SHA512
fc0b8b1488704ff38c9db2d10c63632e4c4b9390c2f26b9aba87f2466816aab8a22e57ea667789c6466afe06d86b95d9f10e52a5d6756fb3946610b39837b994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0257eaa7b9404d4e4d70b00612a9eb2c

SHA1
209c7ec223faa2ae833aa522e2142ae905d869b9

SHA256
b93b19dee3dc137ae1b8828145f0825260ee5f3310382b9d5281bc3941cc65a0

SHA512
ef226e04fffe571510b6780a53e0490deb9dbbe018a403d2f2900f98108481336020d3afc1d27f4ea074690aa7625b3c9ee94b28986c066c8c1568bd52c9c7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a54061d9f565b75c0801596de345bef4

SHA1
4eef60f3b73f2249e5bddcf58f1ef979e4af6718

SHA256
3839cbf01b81147fc53d82c78cf4d8dfb30f93fc2c857a6d76c77d87c2155306

SHA512
2f6faa3b546a19825d9e4103ffb4094a232a88039c06bd977f5dad02219aeb70f49440f1cd951c81d3518b14b43a761641ad69abcd0a334d60b5935bea57c16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7792cc312e434af58c2252b573111a21

SHA1
d1dbbf6eca8e6a1616be829fdabf1e39432942f6

SHA256
39e3de6c417ffd657f637524bef523de6ae7fb53c2a9145acbad936412437451

SHA512
c71b4be13781ddade61a4755b02b2b23e716d7738f4da696fb7c9672a944523a048f15d944e4c3921d7de775dc07264ad7f7a0c1b8d05147757d018a24e3b20c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab649E.tmp

Filesize
19KB

MD5
9f9e53b4aca0420825f5f3daa121c53b

SHA1
e0697490de3dbd53e64f2f69ecfad1cdfce8f175

SHA256
8f24023ab22eb7768160706cedb1f121dfdfb0f8125fab6dee8d11e856dd3991

SHA512
413399115cd96383205102a9be11ceba1068b839cccf763a6b35eed0ec621c7266c390620048a795ea1a47cb3dcb73535f8164120f06211cdbe266e1952e814b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6972.tmp

Filesize
17KB

MD5
4856d002e77544e3bbb0f22fa42c8757

SHA1
21fe502bf2f585bf7f396e4f428fda653af5f19a

SHA256
88b59ceddb5b54dc803624ca4496f32041aa7dedd386749b594f39056bf01405

SHA512
58c04d2082c42a5c09811b32597d8c6bce0f03434d809234f16299f4fe262d477d24c91653c83441eaaaf50e265d16f108b81096b1f7d20054be3ade06b0dcd0

Download Submit