cd1ebc3deebf2c273ab1aa30f04d07ea98668bd6043db08997738a6287e41b2a

Analysis

max time kernel
0s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8164a4b7a085f92600597ffef373e329.html
Size

4KB
MD5

8164a4b7a085f92600597ffef373e329
SHA1

b4f7e254b137aeac3f78cc6bf1a1b6067d45002e
SHA256

cd1ebc3deebf2c273ab1aa30f04d07ea98668bd6043db08997738a6287e41b2a
SHA512

0e660b216e67616680851c196c599a8bc9ff0443b1e647fd98df63d46939fcc7422c2313ac3bdd2e9692ff66b2af27ba07aa0e0d105d91b2c2d6a0a84c1bded7
SSDEEP

96:rf9seakGiwLsvfpFFOxUEYfvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIatfvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E541E4E1-A195-11EE-8951-5E4183A8FC47} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2340	1748	iexplore.exe	18
PID 1748 wrote to memory of 2340	1748	iexplore.exe	18
PID 1748 wrote to memory of 2340	1748	iexplore.exe	18
PID 1748 wrote to memory of 2340	1748	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8164a4b7a085f92600597ffef373e329.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
00cf776e7280e67352461fdbb6f7a4be

SHA1
98ac5113f88f770ab3c71856461f25a8cf2e9b3f

SHA256
c293c5cff0db1a63ae278c20847cff91b27f40aa9ba858f75e7bb09233750bcf

SHA512
be96dde173b10c5ae06c650af47e6f1b421dcd408c9e921b678f2cab096d3df900746b4e8597afe55b29624a7544cb88e654f1fca0afee44425b984df998b570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad717a3e47187869c2ef11f4a320c0c7

SHA1
9b2eeea2e20b77cafe923990867e4359a412d5d7

SHA256
872cb6a74714ef21dc769506a9db7ef979197a65f49d9a8bfeb8e65bcaec454d

SHA512
942ec3cae62cbfca84802cb5679af90ca7bc675b42ee8318576560a8929088b8682ad83934057b71b8bd9431c31568f3b69e100293d97881f15951556aa737b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5dda3ae3076729e43131947799e3aa8

SHA1
04098e10b0fd359ab43d2f325d59fa13b10f6243

SHA256
061aed663afc2c49d2c8565a37d09470a6d4140f970120419853f9ddb4c3f44d

SHA512
ec48674a89d45a4af284d4d3dc5401ca6bd6c156d278b8b8bdeffb83d0145da165210fb87e84a2774019b1fe745558904e5e48ab8049aa78c0250b2f69a1a2be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
150f8afd4a230f12be9a5751c3a52721

SHA1
3777e5f978d04ad2387670399252dd92057a1089

SHA256
4e57c59d54dcfcbb0c9d77a18699802bc2acb46afbc16fc1af147dccd375a50e

SHA512
090b0ac2b7ca952ab845fac87779c59e3ab1c577d3d3d5df1458105a607b4206847c66a34b7c2bff5943510da0059f478769d558bbcda5dad0c826ea263610f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c73a393530ddc5b0c3c3944533896b5

SHA1
eb339b3367f17ca686832bbd21d72845edd710a4

SHA256
08282c0492940b3d54040fce3e4a2fbb9f68be58c236e25e042cac454d320239

SHA512
caa31aa0c27033d9041b04de20306a6143dc4587c71010ed6e59c8ac3ae236371137a8839eceac879b279353b99d5344709ec9b1f16d9e94ca126448faa36d55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55fb298ec51008688205128e23b951a9

SHA1
64ab8a5b6a1b46b75c8d5978f12d4455addbb991

SHA256
96c7c9384731ee4e5523ef4b60e1082bd54192f681cc046c3672e4845deff461

SHA512
d8bc15f168e82111b1d6a24a083a2e1e47fc679fcf184bb230828ad543cbc03b6cce42fd59d880e186a2b59c4e0d84d6de77b6b29a25270349de17f6d9ec488e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
266a6d6cec33e87513f7d80eeb8cc7c5

SHA1
3cf86f3fddcd4e808c27fa56ea678d64303755e9

SHA256
a3e57b8808923b762ed656bc4f083655bbe1c120e815594ceb2925f532918e46

SHA512
81badbd2817bbe38942943f5e52a44dbe5e9d308cd02f6777c61608972f5e318fb8db223e4c98f1b0699d1377ee3ea9f8090e19e3d3eaaefc0c29ff0fc374191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37ac0be72eb9d732decf4159a6cd8cda

SHA1
f1f37616762acde5c81e2a5a9886b44a7af29a63

SHA256
29450096669d8826bab43b68ef074592bb9aeafbc6f012d2b632783700d812d2

SHA512
2267a01acd47e087044ccfd0dd45f7e7b82e3c73f99d2056735efa69fcaa7949cf018cf384249802ac3e3f3143ad3e3ec1fba0a6ec5a2129b916f6648955a0f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f88473a77406b48d6acb179bb4730d41

SHA1
07fd8374666918bcb6b816344e2a588d5e05c18d

SHA256
4a205497b56b9517259441adc90b4dce59fd250c65668d7cc08089ae925255ea

SHA512
050c8109e38f8d697096163f75f3b91c80a895d7c3a110ced40f23850ca03f27e1024cc6602b224bb1d0a45a97d342c819c2f2dabe6a38561e02d97e48714cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed98e462697c7e73ff3c623d4d582c59

SHA1
c7b9106428920bde74b80f8e1b39f288c30d19a1

SHA256
f9a619e7f3336e038ca10b94c704a80f315451e6bf52aa045e4e65f2fd463e64

SHA512
9bda91dbca2697c738a4ba4b22f2d1c5c6be819b88b8b32058a5c9e7f8b8b9fe1c60192757828a771e7fd22dd52655524fc38d7e45355afe35bf4044131812b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5500801b19e7f41134edc5a7811c99c

SHA1
bea3d692d0e94dcd127ace2fbb67703071d06f09

SHA256
f51db564c0e496a73ad40ed3e2f7943dfa746f3d0cd12e787deee2472a79fc66

SHA512
874deee3ecb2e43724fb410985e88f79bdfb32ec61f1bcb227673dfa7ddebf902c8db0ca53db26b7377ba265fd48fa6cbb3138d4814bd60e41e6d1e975e16846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4382d31951fc733c6f4194042f459aa8

SHA1
62c90947180a25404d07d7f11ee2ef248846bf6b

SHA256
d97a1357290f9d5117b032745f3d7b630a9bdfcf8786065491144bfa15584804

SHA512
a07be4236c1e69a39bf8e188f555b10eef6714d1aaae95272d082ae99e48e51342f7bd35d7c6956234eb9f7480a0efb460de7a422fdd8f11b5d15a3b6251e4de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A42.tmp

Filesize
104KB

MD5
0e856e744692bb4dab47a3e12ee0bd26

SHA1
e861f31deb19b9a78357ad3d1bc2d4b535369c30

SHA256
5e9465f97860ae341e7e317e838ac20c8461ae6ea50fae08a64742619e09ee87

SHA512
a79320b5adf061f1c4768cdfb4e2382e61b840cbd084fd9eb01d80323a557c8feae3179cd30ab493b3d84e64fae274149f2bac56232fae92a10e5c208edebb95

Download Submit