06ad78f0fa768e5febf94ad2d2c5926f4dd6d927c932683855d1fd04d4c63aa0

Analysis

max time kernel
0s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d75bce5f25e64150bb0c7f79b916ec6e.html
Size

601B
MD5

d75bce5f25e64150bb0c7f79b916ec6e
SHA1

2934d579d8baeb8a9b70fcbe265c678e771c83c9
SHA256

06ad78f0fa768e5febf94ad2d2c5926f4dd6d927c932683855d1fd04d4c63aa0
SHA512

4dd88757a6dbda68e6a77620affc151e96ba5f44a0366494ef6b7a78756eebd6bdf7002511b3fa84680cdd94468a4c96788587349f9b366e3fb02c665f40280d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C048971-A103-11EE-88E7-76B33C18F4CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2312	2268	iexplore.exe	14
PID 2268 wrote to memory of 2312	2268	iexplore.exe	14
PID 2268 wrote to memory of 2312	2268	iexplore.exe	14
PID 2268 wrote to memory of 2312	2268	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d75bce5f25e64150bb0c7f79b916ec6e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e49ec4332ebe99edd6cc90c1bc62f76

SHA1
de0e9bd849601f8dc9cf9d0c64120f98b70281bc

SHA256
4930810629702177eb1040e5621407e1a38c21e1a71c8fdf9ae0ef486f654d26

SHA512
1bbbfca1204ddaefa5934e1e5923e3800d7193681831447cbcbbf5170a50c0f006818ffc44495a3c72e57dde39a556dea8f649b749d86a890922e181b854f00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73dff2eb8857b0c07b967f1e02183084

SHA1
9f7dfbc3aa0c10544634790b385a2f0791a1e828

SHA256
696b2b76a32d03a9bc7072a792d1aca143c18e50db64301b3ff36a196960f173

SHA512
3ce00bf90ab84ee5ace664cd15c3985ab9dd72f5e19bd7e94bfeac7ba341181b4388e54e6ac9ab7a522db00385aae828981698177989b672a1ebe2c99b7e3786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76608518933d34d960f01a1c575d317a

SHA1
a86ed88aa0d298c0c2940feab0e53539e587bd49

SHA256
336bebf9fb1f1da486c69c48b20d9067382d104d7a5c6620539e99d54aa3a4f2

SHA512
fb9d693eb7630d61bdd02c9dcdce7e2de5d58278f3e9794d5fa9e153cd08cb370bc4e0d0407d6c117e0fc110684071967e55038c246ad2ac16027cf249e8db1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1fa4308703dbb6d05b3c7214f554d4

SHA1
076af10b5a1ad5f13050fe0782d9677df4ef06b9

SHA256
e3e981125711ca71e03411ec76af2f9dc9cfc05740fab334c4ba374c4b40739f

SHA512
a96f6a18808d69b57f5f2780cbb6d1816886191a2ba8f15aadc266f026689276737770892e8c9ef70ea4fd6a84865db0f054227da63af9d47c0fc4d07c66b096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9038601326946a0eb036533c6998cd2e

SHA1
24b5be415d7d0337527d62f690991be7d460cee3

SHA256
28c0f3477c8061bf6b84bb1e0ac62df4553a70e2fddf59cff36c898b56e22b92

SHA512
326782cd1535baad0580c09aaad98b356bf6372850c26e2c6497ad6c58f5ad070f557a745a8f75014dc1d915d87c272fc95ce66bca2426801a71a3e1593a65de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49b108150756d32f0c59acdd2851eb78

SHA1
8032b47339ac1ef86fcaa921da1a228f38f9ab52

SHA256
6b6336b54b13ad049997a0d84a47b4692e6f750aabe24aac4920d0995be23713

SHA512
afffeb73ea59972b52056c26b43252fa92b2e18eac7f2e91c5721f11a69a8ffe6b938bc8f8ed62cc38aecf14e5bcf6242795f2b69636ad1ef367c6ff6f832dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0338b969901d345cb0048c8962a22da9

SHA1
f1eee0dbd4e43433ae51b6ffe5d2e58859a1a225

SHA256
fc009b0e2bb23e805559989b8bc1d0e6e77125c29f4357cf16382f5f68fefe63

SHA512
49ebc6f072ecd4cfa7082853702c331612ad98a14330aa5243a29e5cbccea05aefb47457e587ad72d4a4ac0872f97d8f5738886aa888b0ba6710308cdf1c6be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
961bc2d5f35dbf0fd8e0dda87abb277f

SHA1
8059ad0d169ef62dcbf4f13de914839f0db4ecae

SHA256
ed4bdc3a10017844d63cdf94f6d03ba4204019e52eba8dcfaa40dee04f9d5d49

SHA512
38142009d20ea9fb574898357f1f05022d517012f2afb6e2156d923fb4ef829f7d019a46618de1f0fa7f9c76b9dc11202c21c23b23c76f57b28428c35610f7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae2b52cae4a5963a5692161a7f0cf91c

SHA1
50f52a490d6940767057b53c3cc22b49a3f504ed

SHA256
c480e728115a58a3269b437b5c1e01fd99c2c6b54e5882875d8192d30a11d5b0

SHA512
73101db12c4a9f6eef5ca6d91667f7fa6fe87297609ce453179c0db1a42ab543a4db1bb728c8d663726e8983224fb435090f51596a6e61eddc6ea5714a7974dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1769.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1818.tmp

Filesize
144KB

MD5
ae43119fc03da67ad1dc01d0a851007a

SHA1
e77199b0a00666bdcf9159f266466fc91dbab9b5

SHA256
9f2cba9f2a370b785a3fed47fa780383f6524612117353f8d04f5a29e1d2aac2

SHA512
88575473011a5a0e677b904a054e3de4db5917e240791a19194a2c83f6a8b04896062808f2733afc5740e08957662696c80e78754d9bcab5c8693e8ae7d38ba7

Download Submit