12639acfa19c17cc964efdb951bfc2c22bde716a69397aac48b86aec01f7af82

Analysis

max time kernel
0s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14c1d92edad3d83e1eeb68a71928a9c1.html
Size

432B
MD5

14c1d92edad3d83e1eeb68a71928a9c1
SHA1

8ad356ff94d8f45b6f3fcc4353a65ef8ef2489e8
SHA256

12639acfa19c17cc964efdb951bfc2c22bde716a69397aac48b86aec01f7af82
SHA512

390dc73b98a1dcc2714dd221adf6fc5a71772d884c35d321d31f2d459045b64667d18d4e8c07ee53aa0800960c20c2abc1a46ae998ad4604dbe1358937ac37cc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDFCDEE1-A36B-11EE-8459-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3064	2916	iexplore.exe	17
PID 2916 wrote to memory of 3064	2916	iexplore.exe	17
PID 2916 wrote to memory of 3064	2916	iexplore.exe	17
PID 2916 wrote to memory of 3064	2916	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14c1d92edad3d83e1eeb68a71928a9c1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
48KB

MD5
4a6b3602283ed447e5462ebfc2053eef

SHA1
00ef45784b01ea671aacb11d295358b19dcbd5ed

SHA256
d5eb2396beab02763bf361e99c5355ca46c8e041a68bd220a0682b54453180cf

SHA512
63397047eae39d75312fed4505df2a6327d09b81d2d3ee9fdca3a923d7791064b7f9775b55a848fe2f8e250ba0e4d5db194c5119b9ac134a0a09b5937dd6d214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
73e86c6370254a3b9ede621b82823fdb

SHA1
2a11db7263eca999be15221a2ac76aaa31d5ff12

SHA256
8bb91b01d37b8112d99ed84d9b1539962a817c68680b10ad57997a85cc552ebe

SHA512
badee727b72dc16f9c489484162e845f3665d840fbfe249c686a03606fc3afeb7d228984b5f1e91c2e44efdfd8d16a68fb2e91b2cf678df81a0e87b628e01f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20224ec6150006838bf849eb4fde4d2c

SHA1
0392bf2fe1e832ed0aa0c99f65733dfc5b0f6df9

SHA256
dca4ec3a2531b17c8eb665e3d36211f419ed9624830f85377f37d279654472eb

SHA512
4187e80aa21576ca3abc261149793d33d58b7d97205604a6d5630e5e34ca43d41ea968b69d0ac863d971e3760709c64728ba624c5d3bd3749cd6a8d248c19d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3245b519dbc2fdc17fe44bc43653df78

SHA1
ad3411452f92308b8cb9546b305480d9c76914f8

SHA256
d4fc052dceab57427fdf73579151b387cab950a3628c6a19d266d799a22a86e3

SHA512
cdf05ca62c5510db1289beb91483b402d6ea62a3e220a09e07c25b6f565c2103319376c9376c1109b65eb34d43e079664bb0f4319ff86a8cac8358df47e34d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b82a1cbbad7fb9565cf3c0e2ca680e48

SHA1
2d4d43b17e0ace1c10b54e04e4737ce9f0a90630

SHA256
94c0980e37f2038fc1268612114ac61ad4fda94e141725914983ba3040327072

SHA512
d2a7bb3359d92146118ac302f4e1ae50f147ec06f48616726b5a9085040058269d63a012e5fffcb285ec7a8924442ec23ca50730b177b019aefd2208e2a6d651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb83909e4b999d9789577ee6ab8709c7

SHA1
7fe11583e94db4da024fa478e7f420df68c6f98f

SHA256
d060a99df573691d12757ce0b3f36396d30f55a2d21bed90a0615f43b994ed9c

SHA512
98c1c13ca37f8e92cc587e81f315dfae7bf2823749953bcb80f45dfc2be32a2b0483080f32018cbe63f0e60fca7baba84ae12e4f5b1de239db61374c91085fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab5b36d0f42cf9711438fa9c6243b4c1

SHA1
3afb39a51067444e8fc927ab7f2ddffeb753f58e

SHA256
751703378b80275d296f3f780dd71924d5edb398af7e4fbe61272a998730ef86

SHA512
b3e0bcedca18e50283e9d3b8c85a8ee9646b7f586cbe9c58b00d6d297037a22bf27292858c28b5b010904cc2d8053853f602733c1dee267a17053c32e9a31dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02322421fc548a3719b8b0a98bbfb601

SHA1
2a22ad9cc2419ff3ff6ee6affaf81aa749244715

SHA256
a5bbe94589b76fd2ac0d0fca1ba0a10fa93b4c6eebb3629074dcc9ea00604a81

SHA512
a3b0fecae83ad4c242ac922a3971e5a070439fa3cf64c87bbc8865f49b191ac495418d98dd81d719bd83631e6705c5f978b63bb4d05a012355e661fe988916a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e0255505712b97e5123f79979fd9c86

SHA1
62b5687700a1d493b55c909404f220bb6695ab64

SHA256
96e58b5750918c0eaa69b5fc4c012ddca0ba7975094f4575318e0ab7bbb87780

SHA512
eac7f7c78580aec7d701f19f08d3d2c613c855e3c8e02f7d9f2ff5d67db821e65511b56d8b5d106dd279e5f26c7ed1362286f624446bce78fad63cf990b58676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b59024d4988db3ea30ef416ee633db3

SHA1
b6dd43846e2d28060633b10906a0434a6ef3ca32

SHA256
598c711e84b1377b3ca3854125041b857b1426c906bde91de48ae0d24c40b22a

SHA512
a55cd333347c659940525a95aa58faeaf34870620288600a11869d2901bcefc2954216855bcc2be1ea27ae7fe50d3af8b912339d1916055e40a13a8e3de27a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
82d3bf9278032cd012ca3d8603e37074

SHA1
560e6b0e16acc15af21e69e6774f87243b0864a8

SHA256
e88d1d8750b94200beabdcbbc9879721ad293ad5132175adb1ef83cf4f0c200f

SHA512
4cda2a93eae7248960105a089a6e8c2dbf8fc0debbfe85647ec0ab54bd83565f9defe6a9747fe2db1b14bdf64afd3369311b49d4cc1424cb79c11710ab65988a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
61956bb15c599d94b95bfe609986864b

SHA1
8cbb0dd8716ed842cf6f42abc036626d9cc153df

SHA256
4ef6fa8b774ee1905a311c36966e645a10986c6480099ed8067a63980236797e

SHA512
8e832da6d6dce5f2fdf86376bca4ad1fd9b999b16c9d348f43d2e4750f680be53f94e3f90024b0868a64e318b15bb37b63f2876352fd982a890eb3100d23f272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n7bgnbu\imagestore.dat

Filesize
5KB

MD5
b6ca06b381aac0f77f1aa64d765a9626

SHA1
6d45e59cb9444bb42cf0b22b9e34dae3655732cd

SHA256
83d04c811c1d7ad81be55b537c4c41f3ae51c600cbdf0c2f3dd8459ddfde694e

SHA512
b9abe35756e8040fd643f7a4a2599fc5010633832792c26b1cd3cc7b50043614cdeb1cdb1ddff2d350a64d93ffd902ce5dbf1c4cc9ea0479fd0facbe5fe7564f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n7bgnbu\imagestore.dat

Filesize
1KB

MD5
a23614d0412ced3c63e053fe7f33043b

SHA1
a10a69e9e7435c779dd0b5fb0f93564cc9750d6e

SHA256
eca42ddb6636a7499ac8ed4065d54f868df9179ea47e0ca24b13ec4b3563fb9c

SHA512
5c35c7e8ed10f5e5e1599f7d2532c9f5c6b230a757044e6d8efdd9ac7576de9a1c7ceba44f0fc211fce6f4ef08e64971341ba6d95f363965710b02d705c872eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\99SRF21C\favicon[1].png

Filesize
3KB

MD5
a75c230f34b9296e6fdd8b0b855df5d8

SHA1
e0b9e32053d44532fb4e8bb55b54c3211965517b

SHA256
8adba20b1dd9747ec8ac6ed5a26a8dfbfc7ab82213d8051b76ac771c76b87920

SHA512
950b94afc397ac760f38f4c68691bda6b541832e1d23f496e36568def2b9f9dcb6984c6a42ff6b5abef0e19b76c37e40baab22e9dcc9360091b609333029b24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU0QMPQC\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit