78df874cdd40407b8baa7f7df659069e8ed150c8939ed73eb397060ce5bd770d

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

089d0fe94f8c2608e2c559d46a74da8b.html
Size

12KB
MD5

089d0fe94f8c2608e2c559d46a74da8b
SHA1

93d9d466d592950f43dd2144a9db8ecc9598a1bc
SHA256

78df874cdd40407b8baa7f7df659069e8ed150c8939ed73eb397060ce5bd770d
SHA512

1ded80a4b591fe5cc40e08336742881744065758540dbb72463465fa2af5b56b7b7fc7e0d4d64e2f7ccefbc31c0863effbf6a0262a65384e4ae33ff2fb98bd02
SSDEEP

192:tu7Hm983oPhdqR1a6t4HuvlTDG3prj5n+MxlI/RRpRbWahaoR6WXX37CLcSixowz:U38qja6E+lDG3prjV+4lmZrXPSS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AEA7FD1-A2D7-11EE-B449-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2252	1712	iexplore.exe	18
PID 1712 wrote to memory of 2252	1712	iexplore.exe	18
PID 1712 wrote to memory of 2252	1712	iexplore.exe	18
PID 1712 wrote to memory of 2252	1712	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\089d0fe94f8c2608e2c559d46a74da8b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b62c20823c21b1d0a87abcd8ad2d94ed

SHA1
ff956120d649ca949d83864bf868beeef608903e

SHA256
f17d7e0a59d71403baeea637e4acdf411db3790b4f5879a4fca0d95cf90d30a3

SHA512
cdeb0be4d50528350d45590e2643efd7b382759d308f064afb11c58f9408bf22c4f8173371acadbf1ce89de14bda2afa51c7d1644c6c661f943ec1d9cd91390f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
545148a6a8a7690b0d42ea064c1af3bf

SHA1
765cfa7daaa69a44627c104fef6a034ce0cc3775

SHA256
b8991596cfceee6ba640eb41f1edab64a0e90c2124411593d9770f776c37aece

SHA512
cc5c3308c1aaa2de3afde8452cd7b2301d0030e6de29004c8fed38a73772678f4c7fb573d3dd82d9ceb5d7958fdfb30df8d32d0bd7a43c09552077ea330e3e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f567a9f077cf5b688b1282f9d20639df

SHA1
6836c3a4c4aaf9b87b5bb175cc7d024d6f901ebe

SHA256
a3d583d5bf951d923a3d8e7bd1b2517b5545e6b0f8e3cef3ae646b94d1a51e14

SHA512
eb9de53b985b5cf2c22df8132c880f5020374bafc4f9166880f093cae233f44a03452634c35a092e5d78cc3df324451ea55535b3a43abde4970120298f9286bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
894ffe705067fb0836af22e9b1b490fb

SHA1
38cf26fae0926809b7361d488faec412b503051e

SHA256
10f0f8fc9ea2cbe786b9fccd98e3c726b0b00e0da4e51e05ec2830570c9e13a4

SHA512
2cbd9775f112a22603862e3ea7c0776698531d9cb2cb5f7cc70a155c32d8a33825039d9f4d8e61e02a3ca5cc2d0528dfb3a5b1d3278cb817978829fb5e19fbf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c113a4dd403abf3400ffd05fb17d9b17

SHA1
bb93b2a2e49bf69f69720e1c86b86e1236b8a3eb

SHA256
5c10b4df4e16af50f95c9396bc600a7dac7cb8c90fb3dab9578fe8585879a2f5

SHA512
080dba605ef884117fd0eff45349be5c86552a5b28f200ff703c27cd8607f422f3d1eab8191222d2e9ea86102937ede40442213a48077d03fe81c474c8167f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af8bcf580e69eeea610b156a509c6897

SHA1
5c0ab050c48bbbd9693e3e80d40e8387a77c2ad2

SHA256
83ac6aa50693a8a6ad802b842ab09805f29e640f77a2518a779542b48bb04ce1

SHA512
aa93d1a839def6e77a1cccd438d8c9d40c76326856ca4264290e18427037d1c3bd3a1bf271922d547724c600ad6c316ad1307de8c92742a379dead8097fdc788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a928c0c19afc4db4df79a205a07d68

SHA1
e3a80315bf4ab2e15a6b38fc4d0c75053034c022

SHA256
c426837bae681fb26572b31d19351e40921fe48f7972522dbcb12e33520ba790

SHA512
25e5e8aefc90d78c6a7b4df75c4956beb9f263f79a7319f51b56745eec0d736685709631f9a0c76a3cbdc2bb58cdc4cecbe17f07b2d2c2d227ff78b991bf2463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f6c3652a336cecd9af04d6a71e89c4b

SHA1
fe8a97d99968fd92ba94a37c21c98a5f8ece1758

SHA256
1402fadcc2a9ed6ee9106e2a0cbc030fce91c4d8a7ed9909a95886d600018049

SHA512
12b92f1ca1b2b0a6c102b692d38b1feaf352724823521b31123464580becc686164e4c57803ca53176f0c020876a57525b2980901b09a45f32d2378bccae9f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5538.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit