e67e00a47cf7cb5ce7237467190505a6925d48228e6188cd31c64662a2dfab81

Analysis

max time kernel
0s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b9f04b7f5c0dcd3f9c2f8a142abaa56.html
Size

953B
MD5

0b9f04b7f5c0dcd3f9c2f8a142abaa56
SHA1

a1a39a1f3455acc7a0ad4d39a8be325c237fd3b0
SHA256

e67e00a47cf7cb5ce7237467190505a6925d48228e6188cd31c64662a2dfab81
SHA512

b541c351043c0678a1d8238f9bb62c2629d6ad9431acee9086fedabc744a009d96879b5ec2aad653e61a816b20d3801cba8b9167f135d9d0e1b30a415ad9ca65

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{965FFE41-A2F6-11EE-9610-464D43A133DD} = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2744	2468	iexplore.exe	14
PID 2468 wrote to memory of 2744	2468	iexplore.exe	14
PID 2468 wrote to memory of 2744	2468	iexplore.exe	14
PID 2468 wrote to memory of 2744	2468	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
1⤵
PID:2744

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b9f04b7f5c0dcd3f9c2f8a142abaa56.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
983b9e6ce77eefd9dc384892e93bf587

SHA1
9d3cf237ecd5d94669c692bd1534e076993f5c7b

SHA256
235ea315195c561385779c61d1a51063ae79af72008fd6cd6fec4098f2fd731c

SHA512
2f8adbdf7af26d717ac28fb696b49e33cd437d68eedbbbaf6a7de3921c33956d0cde16e1d56a19b55ee5b4c9a550ebddcdddf2fc10aedd8ff03376adb2fb0467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4f08a8d2bae7897b613a216b95c8afd

SHA1
b5b26d0337c4a9fa0c568314a55ce5b2fad93e41

SHA256
f5e9da29dbb1c9c65c9dff4922d1e23a50e3cccf19bddabbef71c430d59aab34

SHA512
ea3f8e24ba9e4502443dbfdf1ee6b7eabb84cbaafd908ab8cd0ec43ff4de8769347ae373a226208944ebabba64102fb9709313084a65822204e4646ace0a300e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5773b214aaed7948904a388cce8842b1

SHA1
00b0df722356ad8b0bf2172c97fd218f58522aba

SHA256
697edefe1a8cc5d156068e20d41f905d4a7033a6df132e3ab2a7354d8b95f42c

SHA512
87b1f048eae85d487ff2b16721234fa46a628b209ed14d01c6765948529a56b96f194497f4d65da1988e973923dd94936345443daf984a37157ef9e8f53c3a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
140c79a311782bab42b97158a6591629

SHA1
b32e5f72bbafbc82f2f603636da1bdf28553b614

SHA256
4fc8851fbf4d63585eae589b6fa22aed17420de97192eb1108ec6ac292664df2

SHA512
058c2d4d13ec70cd7d28eea841b14760085f5cfa2042cc7fda2acd75802c701311d8a361550ffa009f227ecee43b769acb65c87005dd5944c332ae1768600cfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d7f9a3a95ca399ea892f5ec833f99af

SHA1
c07fee2132d521b9c8f7f9a9fdd92618c81c6e56

SHA256
76b7ca062a3f04d3fabd4936cf9acec42375dccd3ed2653ebaf6b109c8ddedb9

SHA512
fb1bf4efe45827e51eaadd94f8596fed8fc72a6d12dd410e80b225a2667cf43e8daac566b63903447872f9e02743b7b3fdcd4f7a2f4c4115dcd01885ed818f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b72cd89044c309b583fb372a9152695

SHA1
36fc3984dbfda363f1d49bedb8c82f0ae4e66b13

SHA256
b41bc69fdb0b23e98c2fb6ffa68c93d76561c8c4f19c3cb9547a3f3fc44802e7

SHA512
342219acd35c3387bae8d943e759be8f305d1c38ba2f1d9b683477d67e456e520479e65ed3bafffe778c9ebe3400a1518e373c561c422c231e88ad8a484978f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8322520976f2871044de7cea1e539997

SHA1
70336dee3bc2e911bf6c5b652b7da7704b849138

SHA256
accfeb8589efa0c9e7c30c9e4759cf57c24138bfe766f3ed45bd994921cbb8bd

SHA512
921457dc812ff7c55592a1fb80cd84de16522ba987275f73cb55ae04640ce4020695b5b82fc9eaa668d38cf0256a43c64fc4f9b78e48c917848b5962ca6fcced

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
623fdff2e26ab5f775613e5f3be61f50

SHA1
37b8b229e70e881ecea8c6f971adf472ee1441f8

SHA256
ee2c9a665737a1df2754cca7513c9ddb08418fc0c0c8999d5cd4b14df4d2d02c

SHA512
078cf59adff8ffefd834f267e4b9f803e165584c507f927964ca98677a770bb7886c29caf2c3fa7234cf8312a8eb2ebe322099665730a3faeb20f53ecc453b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de91da8f213ecfa458daea1767259541

SHA1
11b80a719702038bef66272debb08170ce362124

SHA256
ac4a2a19cb83b71fcf663c6ef49c199f496594acda9a17eae1d684acbea2ea24

SHA512
7c73b40436135495861cddf5f45942986c660763e35086c4d3f4b3bd9dda5eb82cb5b5ab21116633465c10338a188785f5b93289fba192f040646586fef9fa49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
4427435bbe422ae54d32d94d8e2a24ec

SHA1
f704343297094e016eda9cf8507d845414eefb10

SHA256
9827d8a3627373e5e9753ca11adb2186503c528095e820164512e05a9b66d5f9

SHA512
7b4ee60be19d7208bbaebe25dc21f958316e117054bfbe44c010f82cf1370b30a2fb41210ea9879592a7c1481316c50dfa1272b598bf1db4278f3c54ab47c4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58CC.tmp

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58DF.tmp

Filesize
50KB

MD5
2926fb913a72e602df119c3fcda583a1

SHA1
b26d29298a63e359b7d930c1ddac27e0bd5ced59

SHA256
21d5cd5caa28e3b873002e3e9d7783fceb7df7c673ebccba5195c63272e4fabd

SHA512
b084b288f3653e055ebfce2037858e53b5d91fe7c4dd2dc70485e5ab40a18008b19b7bdb80a1cea59aac9136c56d51e302f3b64df709c335c8b71da56e5071d9

Download Submit