498ff543d9ce58b3f548d5bda4812ca25f97315ce1a376d6063741685742563a

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

055438fe5ddbd192ebd5a65ad1e47d8b.html
Size

26KB
MD5

055438fe5ddbd192ebd5a65ad1e47d8b
SHA1

882978e5ea294b62df81b881c0cd01c59f8adefb
SHA256

498ff543d9ce58b3f548d5bda4812ca25f97315ce1a376d6063741685742563a
SHA512

6ad10bf64b16b074ee7ad2f6527acfea363ef8750ac79a72b3de3f0789e3b05704f6e49fe35d96dffa593f8cbba5dafed039effe97a22a90f8606cb55a39e749
SSDEEP

384:3rRozIXVsdjqDcgxMu0VGxyNFdR5hxCScKKOZgKSTBQQCTB6VLC:3PYuYgxMwWRZgKQCMVLC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB58D5B1-A287-11EE-B309-FE29290FA5F9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2620	2416	iexplore.exe	16
PID 2416 wrote to memory of 2620	2416	iexplore.exe	16
PID 2416 wrote to memory of 2620	2416	iexplore.exe	16
PID 2416 wrote to memory of 2620	2416	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\055438fe5ddbd192ebd5a65ad1e47d8b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
1KB

MD5
dc8568450312bfa3cbb0ec43b4bc1498

SHA1
cb5f7deb9c220593f9e06c0fe33b12b3332da2bf

SHA256
1c5a2573079424a299d042547ddb8ce898c05cd741509e1c677a654916190e5e

SHA512
bfff05e58962402f8da8c4f8f907087af716c8069fec76cd19b136f3926ff55ca546ad65cf1b1bfad29af792fbd620d2b57c54e9fa51b1a540220be981863601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6fb5d00ddea00be6819a7180b35782c5

SHA1
61fbcaaaa51794846b5890e84f6f4b124c4f64fc

SHA256
ce60b00c691fee945d2db6130f30ae5d22c4dea634347f972d013647fa343aa1

SHA512
699999f10941e21d1f9b11a5ba354da51aad805e624e122ae6a5c140ff9ca82c10e3aba5c0c8e5b76f15c31e6b63ec3aef6d42b0a41aac017413d13ca25860d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2847f1346d4bf4c7011be99b0b6cd61

SHA1
ecbf1abc05f8ef1a92f0db37d90e44e3919f99e0

SHA256
a85753f9c5d8cc7a09c5060e9a1b7921e0a8f4a9887f734d486bbc3b0c99c288

SHA512
38bd2e515981d8b4007bc011e1ab428eeaab7a6c8ce0e4751783e62cd88e652c8762bad3dc1e1c86e51c86bf474c4aa6571e0e80faada8e04174ae4775dfc6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97f0cb24be930666de4a92e8db53f0b2

SHA1
d72c3e0f7b25c31e702583f7654fa202177460d4

SHA256
3168fcb08771101aa895f57f5bb345c3187de8f29677e8d73a643a28bb1fb19b

SHA512
b86381c9b71b8754d9c80c9f7643856811d40507d91bb0aca75b568b6f0acdb9cd1dba4ae0f748b8a7cce14f7031d4ef2e6a10c548f9ec1670cb624f332ff46b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd6ed23161e31b4c5cc2629727a3e678

SHA1
9b390051bc46e59268940c6d569790c55074c55b

SHA256
9e3ee878ae506abf0979c632d3a55a4edb744d5df10c7483d08acbc2f8083bec

SHA512
95a81c315f49b395059cbb1592d1347a52880bec52f3b8aecba0f8736f82b549383861efc18624f9232aa7c6c6d08ace0c4de11bbca8065317b3a1416cbb4951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db7e2271dcf988cade3d3b05827ba0b0

SHA1
501337b51f1d2683f9c50299506bcbd6824e07de

SHA256
b7bb1cf0e6033de02382dcd828b68c9474b23b7c1e5c59f018ee97edbf00dd1e

SHA512
c5ed3ddb569841e6bb264d81eba9b1274fa33d7443a69bb7e1ec6018075315a02953d5748295b2582cf868190f69e6765d83f1efb894de87d00c44fc2039e42a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e58c297de1ee445ec42f5a6093671c28

SHA1
6907153eb5a54042129f208f9dabb0af43d9bd4f

SHA256
2dfb19d45715b70367890dfabea48c85166f95ae1cebc9a0998b1ebd8ded4f51

SHA512
3fd139998d9c2e129b642074b15b6441c555a46e80872e74666e14040d8add26bc1500091ce16e4c2985a4e24a9ce40b1b3af03a0e3552f0762fed6336d22c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7767392a1d6a1d8c6deb6c25a66a7de6

SHA1
c576eaf499ceaf9767e9542c28cf2a586de9fc9d

SHA256
948e0ad5e6ac9414c708e56f685f64989796934683b67feda4c4885f3b357f5d

SHA512
8c8cd6090a2b77bf8f0b835163c27014e9f34689f0e481fff5d25b67b8382725a78ae1be4fb5961fd3304ba06c6a524fc313c23bad722e2031de456a4144a517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fb503a9e5855ce07a0e5892fbf20ef3

SHA1
aed5b55b5c5edbaf438b034dad522c0a25c4318a

SHA256
5ffb968297de51031a6fb198718c0b33586864ad6d8fc24f6e6e08f855347af8

SHA512
8408e7be46e9704562e0470e978759b297972198235cae580e9b36754f36de3ed3d42d04c0036f3386b80b77d98d75de8c7a1fd85655a5b726741d4533ee0ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62a962c1b479e1d65c8bf8abd54285f1

SHA1
e8316a53cb9aef7b259f88b81ce5b096261ad901

SHA256
727c42eb983a5426dfcb412cf9e81d0b9e4b413a8d80315649a1f5adf447c286

SHA512
b642e89fdbb8157dba5ff287d5d06d45d46dfae540ff284d3e78f402d135f99ea84dab31bd02f7773c236e6740159d345217db8dbd39e80c1538f7ae226dad52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b49cffb69aef0a7ffa93727ce2109740

SHA1
9447c8012fcd645484ab8c60432e2cb61c3deca4

SHA256
e2758d69afba0cab52c9cfff02da8884fd540cf00f15f325ffa98f8b97183798

SHA512
f5a2b949cd5222b9b4bc0544fddeb06796cb6f23c77ea06b7b4d313d1fdc7546a4cec324f83bb07bc3fe16f751a07d0d54d7ce12cdb411b6aecbb6913c6c4e18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
aff1d717c1c737d7f68e424fb2cf982b

SHA1
895ec13b79d0f9d33dfb3498c86896762a8ecfcc

SHA256
c7e7a1a05904ac40bf4a6b39e4400610fff8bc603806635b63e99f02c9a829ff

SHA512
efbdb7401d82848afbf371cefcb831d1c15468f538a3ab5b8727b7c7787113e93a35aa09350fd279e7c97ff5f897599806aafa81c4fcdaf7cf6b9f3fe8bf2bbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
1KB

MD5
7125f45e2b64561340f80f2df51ebda9

SHA1
82f3193a53474a5d83b4ba627d61ec0197cfccfa

SHA256
31054f95f3353639a6564567278cb431718fbe3c9bbf1df6a015ce5b0626c31b

SHA512
becfa9c67a6b9dee5f30aaf8b4a8699b2ff4af652e86fa80e55136f7844863bcde12249f8531ac8aca085538d568ee96d15223c8d332ad2edd9dc8902c1a6a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCUNUS09\KeOk1LZxPm7[1].css

Filesize
19KB

MD5
c8591f773bc412fd307163175a64843b

SHA1
bfc8af52445868cc7a6cacb3513ea21286f147e5

SHA256
607ba88e1360e4b75ce0595f8359f73f7fb8bb31a04c9093f1ab1b13e4a53bdb

SHA512
d2851f537fb8ae7874ea20cd89813b5ed8678cd3d88dadd21167cc70eba375d4cf15a64cbaa355bf1e9772d9b22b1c2285544f53fe338c6e6b959d6b07d06d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16EF.tmp

Filesize
22KB

MD5
0229875856c8082f8399a2119168bc44

SHA1
9a50719852886b0eb6810ffeba6a7f8777aad86f

SHA256
5909ac9cc163d6be02ab3296b38f332d2139512d089799f0ea9160bd2851535c

SHA512
738d33cb7b9611b7cc3311520629e4f645a75a2b0b91dfe0e7b06e3b9a66063972c8c1db511f8100a4627660443b4c1a47c0c34c2998dd91b33a2f36a8b39490

Download Submit