e6016bc7384c0203a475b95efefa6098c16289f4801c9326e16f963a6bf3c125

Analysis

max time kernel
0s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14527d25f179096ddecaa572df3e2c38.html
Size

21KB
MD5

14527d25f179096ddecaa572df3e2c38
SHA1

fcc4bd048855fdce583e9a6f175c799ac515269b
SHA256

e6016bc7384c0203a475b95efefa6098c16289f4801c9326e16f963a6bf3c125
SHA512

7b7c28daf25d7483a2641c7128712ee7443ec1c11eeb626771cd6db37e8e274b63ebeee4fa48c75269b444ee31773ccd949dad2c63411f9b40cf5546f3787a7c
SSDEEP

384:5t29t2WAnkD01pR29lRVJJ3nDql6eIF0zLBXrPBpxJ:a2H0lf3DqlvBXHD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6146451-A366-11EE-B69B-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1624	1368	iexplore.exe	17
PID 1368 wrote to memory of 1624	1368	iexplore.exe	17
PID 1368 wrote to memory of 1624	1368	iexplore.exe	17
PID 1368 wrote to memory of 1624	1368	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14527d25f179096ddecaa572df3e2c38.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
19KB

MD5
ac2ead46743930271e7a8bb73e54329f

SHA1
780a0a087e849f3b2bbe1ab4af4339b2fab6b0a3

SHA256
08f843be14f60efc764d533c1abd6fc5ab6cf0b2defdfad2b5523c73a5b0d4b2

SHA512
4c6c03bb0f2be35dc91bb2b722960b21fa9561a6007ed1159fced464cd4728a8a87467601f9d0a1521cc20660b6fb357ffe59552b8eba58c77916944aec98b0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fe652428cb9403b110db5008fc748156

SHA1
d4c4a869f641e2035cc03fc053c360ba23e3260e

SHA256
ba818c7b92320993122cc2df5f4042a5eb871b907421f40b63476503d54af801

SHA512
29d5d032a2c37b8233b0cb59220cef5941595e0ff8493908700c938cddc020129a3f6dac5322c3bd9898c2f389e0ccce4b64174cd0a6da5905d17a1e83e8d5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ab4b932bee1d816333d436b1423b2b0a

SHA1
8f2fc9828006e12df10ae4c3ec32e5a8e3391a34

SHA256
5ce5e0a99b64b0f2466a49cb87f6d1cd476f39a2bfd485a552bab45a8c706465

SHA512
cb690907ae30f631bde68b1dede06e43e9d41730e6e6f7f75d4634d606cc7edf903cbebdf68d51ec7e38d481cb30e36951fc89de146f6564ef9469436cd8d7de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
be530d28623a80e55fcc582043465fa3

SHA1
2f8c0ba8776b42c08fdefc01430a47b80e264a64

SHA256
e731f5f43834aa0e64f50537d750e167ada1b69441186454e9da7b01d78d8bb5

SHA512
10dd8adf1680c695888b4203ac734793c542372bf66a5f0ab332259700bd1bd270f2356db911f7d25cb5f2bb40f0123122f92a75a34283c1cddb0598c8278022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
56a390cbe263184fce1bdc6bb03b7d09

SHA1
cff197389d7bcf629558c496391a90a38b8412e8

SHA256
c33e8b2268f5375b3a07fad51c9733f64e9327b7b9b83d579efd503877379da0

SHA512
806a33e6a21b6f6151f82c30d875e2310cba8ef60bc29b3d8e729a2bb6250890cbef454291f31c6a874f9549a9833bbf0ff294f8bf3bef02b8b077eb82675929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
53e7b3088a675bcbdeceb0606b2f61f4

SHA1
49a52c33744cb3893a8fe2aa0865faacdb988892

SHA256
7d8c2cc104fbe83261822abd913c5fb87c3a2e7007ea7d4cb764606c4a0eff3a

SHA512
fb2db0f517b794a92a147b5f0cd046b004f7540990b994f56cf83f021c461539ccfd08ad6049f78e8a22a80586d59394dd4b6d6a8101e88eb9ae934ab3d8111b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
67d2a46f51134f08d161a836688dd029

SHA1
1d75b969fde5d7df8ae271b0b5f0f805b6c492b1

SHA256
adba6f69b2b275c7d06afb115c291dc52778ca50a1506c52db1a89f1986bd003

SHA512
2d119ce20c3a288cce014e446fc637c11f858c93b74812fb68d40774d551d93f925138be8389dea398f1a3fe6a8229e99a39fd6b6d0a682578f9642b407b3921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed706c3610c6f0802c46537a50d3948f

SHA1
98aa48f47b2d4a20c0db793caf63ae80a17a4893

SHA256
5205805a93032db7f822cf4548340d28d540486c52179aa316423d5a736e0b55

SHA512
8f7eb623b13f40c78b0d9c2d1633a189c35512101460bcc96162363af9ff8cd7951e4f10851b420c65cce426d5ace1bdad1c53dafb16259259be37fea6245a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e0822adcac4853748733bf19b362795b

SHA1
a75678b1b4eeaa074fdac8762357923d95c59c1e

SHA256
0924a428e710c120bf821834b2854d5f7e94b83d98061d8cc310fcbae669e4d4

SHA512
b0b1e1068f32dc85e23da93ecfbe633721b2867a49b2c1a8b5dca9a8ed43ae67cd624f6c9507ef60764e3405c7ed42659ec99f7378e5c99815d7123b45730cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit