d4942fd85b9ac3ff968eab53288578b7f422d34fc7d9117bb0922e99c2758401

Analysis

max time kernel
0s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03cd0b492aaec64a10d316a2d5664c96.html
Size

23KB
MD5

03cd0b492aaec64a10d316a2d5664c96
SHA1

6115cac1c047258cdb88af57ce74b2695269c5fa
SHA256

d4942fd85b9ac3ff968eab53288578b7f422d34fc7d9117bb0922e99c2758401
SHA512

0dc5a66d5d8fd8188627eab0297dadc54906b03e1ae9de1cecaf3de2172a33f46ac54d1ea515259ac6e633cc090e6ff404c4bb4ad2ca2d761432e608bcedd983
SSDEEP

384:LVIRIOITIwIgIxKZgNDfIwIGI5IxJ7SHuzIRIOITIwIgIOKZgNDfIwIGI5IVJ7Sx:JIRIOITIwIgIxKZgNDfIwIGI5IxJ7Sq0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E0C71C1-A27D-11EE-A7D5-D2C28B9FE739} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3016	2040	iexplore.exe	15
PID 2040 wrote to memory of 3016	2040	iexplore.exe	15
PID 2040 wrote to memory of 3016	2040	iexplore.exe	15
PID 2040 wrote to memory of 3016	2040	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03cd0b492aaec64a10d316a2d5664c96.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
11KB

MD5
b58900b2304ab996378cb840df48338e

SHA1
109681e341c11fa6a0de51190fc9ab02e1fc6ffd

SHA256
a5227f760ae18c1e17a4cfd6a204fe7106b679e7b0f2cc74fd97e34c90005db0

SHA512
cadb02fde58857591a027baeeed424268d00c44056d078611dc96f7a8bdf9337fb774b97c80ea53c2768dad1683fc4172d354dc8ccab2c01d3e17dc7b1f2d9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
51KB

MD5
1ec283368913ff70ca251d4f5ef4f340

SHA1
76f45956058d6bef21b4ca5f39a884974aedda8b

SHA256
76bd7751e87e69a504ea538c15183421b28ddee42480352c8ecdb3ff148b0849

SHA512
f0fac54238a0f74710c54d20bcb412357b3937522ff40136f07745045c40e9e0b128e5f1497115d09f6a53c42109e676b5873cbd0bf36aded778f5bd2d13dc60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
42a47c3084d3d86e57c654bb49b215d1

SHA1
ea50f33a800d57c5618fa21c89d78e6a3321da01

SHA256
7cf39c838a5a1131304c7822919fb6bf1ac958a6481f3830f5c63fb0cc2a6d78

SHA512
860d8b1e8d5f32e0010e55d18d7c32ece7aec59a8809f8c7d0a3973283765926dcb5944204752e2f8b994ed6aba0d05b054fbca01d565050c8bf862112cc8baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf93b70966ca27aaabb8357c1e10d36

SHA1
e2caf9c1dc84ab799f6abee1b001678c784a4e01

SHA256
75bcce59f76f02f3146c50f5cb30e1538ca607ffa0f5c89ede8ce70748c254bb

SHA512
c02585166151bbf0e023c0ac9a37c9d2f3d014f5c24e6f33199ade01d5904fe8b3ef296fc9a40f103c181bc5333583a1fa8d9c26ab482a2ac6b0886a2d8000a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e392c72bac8b374c6d8c3bdbbe42ad92

SHA1
dcb203e02c9a0be3c51e7abec37b7cbcc10bf06e

SHA256
e80385be9bebb90d1628ffaead6d7e04b9ce74106ba97f6e62aa01ab3942c1f0

SHA512
d3c143ddbc731d0a7e63d968e67b807268231d4deb1cff936d34712c191137abe0c7b3e59880f9f4c07259dc5b88b053310fc18c6f978f79afda36352de18965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
772ccd1b650e97caf5cab30c79c75ceb

SHA1
78801ea478999d3951242afb695d7dcd8bb77258

SHA256
c0321ff02fe2925c74df2e781d61b8ddfeb3e7ee7165049bc3aa8c317df1744d

SHA512
cdcd0ec896308a12b50b929249647eba2510f2a60882a12aba3eaaaab4f9cc934e517a36cc7967ed7cd527a1b0836d54043c754b04d351ace5525588ad082d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4702b4ebadf7ac72f43b97f6b326714a

SHA1
9e878e16265e911f78bb5d65a44d6900b80af57a

SHA256
ead9acbcfd70f4b28cbae917348d29d1598294255af72cb5772e5ba4bc712f2b

SHA512
2559a194d212f625e7e9768c19e11f3d80bf9562e4272235ddf9e3a84a935bcddb9167ffa212428c7717842f3621bf87357488d75328872bf4b7e08ce473de42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10506d6595ce50d0b19a19955b7afb67

SHA1
de3ca514c5e673972c7da761caa410f2326d1dc5

SHA256
afa30426007169ebce7bb098b6f75cbde7d649cee6bbd27ab07d1ed3995c453c

SHA512
74977403933fcd7974ad7b35f930b57462886addad0a946449df59c5ae98c2b2d010783a4c2c3a6dc3b1a4b74691501fefa4586b00cadfd8e2317e6454629fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944e2f9e4705d4eaf1e3a0369b5afb9a

SHA1
4cb1562f5f992ed350c894bac733dcbd5528689c

SHA256
8bc8548bf7b45e2a2d3b57d7d750d0cbfcbec771fb706131d06487781c58fef0

SHA512
a71e27f7be330905f9fce7b05db76c1d15c2335a3d643397986e2d81bafa39d76478a6032c1e09d1d7fb52c16121ea69b0245bce3143e7cb159e6c2edef3ec3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38594fedcd91dea916fd4dedff92726f

SHA1
62ae971be3f85d0dcc3893a3aaad34ea675bbc74

SHA256
09d3b9d662be4c446d23e019c4460a5c0d0ec5f2fa1256ad1f5465a9b56bfa3e

SHA512
8d8a0ea9e9e7b1adb42e975daa23909ef654c0291860f1d8611715d7fd1118eb045b7fe2fcfae42f73c8384494756cd3e77d0c108d71648616b571c89f456f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8bb7e0e7158bad65a586245e65d597b

SHA1
c87be187a2a3ea915418ccdab2982454354d104f

SHA256
045ed7fb14245dbb77876a91ce91f23fed711abcee4bc222ef10a30eb4a6db36

SHA512
aeda7e7a7d69c66b84718d50b671c5ba2ff26ac52f0284eee3bf2dc32631528997e486916634abd4f599cedf4fba9837fe94c193f22ccbb01cb3764f74c3c773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f3ab5160487d284959333713b8859f77

SHA1
58e54e1eafe0f6418d5bf0f7801aa241fd108708

SHA256
7f0e358cdc48a9f4827179fe73ffd446523b24c92af8fbfaaf1902a6b164e5ea

SHA512
79b7c5ce2c537ae595424fad0eab38714b4859df729abad82576abe0c4afa8116f1f0a79f8966b717218ff3054d5517c5be82bf0ff8000b3de2b8c549ac7666d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18E3.tmp

Filesize
29KB

MD5
bdf733c0a52eeacc33e2ec80de07f0f5

SHA1
0bb212d70045d9c747f49d76d3ece3c43669ce85

SHA256
c87d16357bc100d37db08a64394d7b8282fbbfbd0fc320e9f3711a8345f22c3f

SHA512
04f45bc50feec90ff5ab23d8e9cd61c7c10a30db04ed49e087ad98ab068854b8f3ddcf995b1a7420f94beb3e71bf6f3fb03a656f5b6beb1f406ac15f8ba691e3

Download Submit