8a60c4d5b14df9c61d2d6c8475b805618f8558065256858466c0dda9c0529c85

Analysis

max time kernel
19s
max time network
30s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ce3a33120d09898c11f2974a5e1a109.html
Size

68KB
MD5

0ce3a33120d09898c11f2974a5e1a109
SHA1

6af6fcb7163041bd5a34f126dc5cf6c9198a5999
SHA256

8a60c4d5b14df9c61d2d6c8475b805618f8558065256858466c0dda9c0529c85
SHA512

ccb4e0ca1a81717d331835df482a973fb50bb5b08e7bb8c4d95a81acaeae855a80ee0af60ea6b4ba915d39740224c76370c85418031e458234ec07459d172a18
SSDEEP

1536:TpY3+HH2dl/tMPcM3nMLidsEy69rCX7CeHA8s0rmKfKItCi:TpDHWL1MkM3M2dsEL9rCX7Ce1szKfKID

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC7F7EF1-A2AE-11EE-AD84-DED0D00124D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2836	2220	iexplore.exe	17
PID 2220 wrote to memory of 2836	2220	iexplore.exe	17
PID 2220 wrote to memory of 2836	2220	iexplore.exe	17
PID 2220 wrote to memory of 2836	2220	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ce3a33120d09898c11f2974a5e1a109.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e99c729661d361cfdeccb76fb786aea4

SHA1
f91d515bd1fd8fbe2a4d274f8062af1d0bd23a8d

SHA256
ffab13b85532e329f80d61cef78d604e593cf8d409e5aa117e3b9b3c96926159

SHA512
4317e4bc797f0efca9ce3ab3bc404e35d965a8135e5efc17a5b92c7751c060998339640a0f66d5ad815d7c9ccd06d34cc8f6c22d092d3698fc13cfd283ec3241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54b2789507306fee98e96643dc0380d5

SHA1
10b6b3253251787f9dc37c0c7c881d707e349412

SHA256
2e1f3ccb8567c44127d6dbddc63901cea325bae48c603f546eb6a016932a3c14

SHA512
2468e833a7ec945fa06fe7ca67868703900641f5c17344e33ac685c0c64e0f83ab0cd1448145abf7c445f9dcc6d6585835f3a957ec99667dd5795fe78b7c907d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1034a290a6cd878d4e1c58744d16a345

SHA1
8a501b604df5f04e6b6ff0154474faeeebec73c4

SHA256
bf4cca69a363973070c7e814357faa0350b32c51042c1f4822087900fded7229

SHA512
6985c1e85b0142573298214982263facad7ad5cacc99782588f330af24b81966c6055fb9355bb54d4c21f72ecad5a7185339e8bcc2c05ce1f092d66a4f7c74ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7cd7fdb3cfa5407860d2370a73a927d

SHA1
74f1ef087eb3120bc6354c9d45df889dd1060752

SHA256
3e9117051d045bf6e192a2f9bdc27b4ebd985308750d06b5e72cbbf075e45a4b

SHA512
bcd487618c61271749e2d47f1088e1f1737ccfbc9bbf85c50cf04f24209acf90faa3682e5dbef28816b9bc934a85f7d932894c33fa25f4bde2b83d027f681556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RMSG079J\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RMSG079J\www.youtube[1].xml

Filesize
229B

MD5
a740d28e665888d0e2a404512ebfdcff

SHA1
572db1e53d8ab31b750ad30faf3d136565c4755d

SHA256
265eb8d388e09d7cb8cf4755d14256e067d22767b2bcca850b2138d8343e025d

SHA512
c3418142037cfcdc4d08bfdb8fd9f02aeeb8abc9b21751d9494044b32ba2a96848c650f8ae4fffb9f9beebef3a78c2bc3de5b9926ba6e6bdee05b43a03c77658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RMSG079J\www.youtube[1].xml

Filesize
24KB

MD5
6ddefa5e394492ed703fc9d09487e654

SHA1
0ace587c5c8fc2d8b357180d3000bba99b7bef7b

SHA256
999b0b84b19ae5d75613c539b5bcdf22dd8e717ca724c862064d1edb09ae61b8

SHA512
1417c63a48ad1308e056faa299653a7e7639cd3f166ff934a533e20d65e74f21b0d93069859c19961019c439f1376e9718b0df4b27b1112f6230d626bf11f4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RMSG079J\www.youtube[1].xml

Filesize
578B

MD5
255c01156992994555223bc380970950

SHA1
0a76e2e3c9e84b0e82538a549c466943b2ff28cb

SHA256
20a6fd1f4ef32622d6b2daef85aeecb51c351268bfed40bc1ad8b821e67f39d2

SHA512
93e829a9e4f7e20774e6fcad52ed1068f43c8be5493aa4c159d382c9510a66cd6d071a6bd7f2c5b8e7b5ebec5790b46835088bddc40896f54221f68771d824ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RMSG079J\www.youtube[1].xml

Filesize
578B

MD5
bbdfcb6236c9611531ffa89278e3e777

SHA1
03f170c25e172b98e22efcd3742493d132084441

SHA256
bdd360cf60c63b0d7495a14c8c6262719683d2c7f841b9e5e914822d224b290e

SHA512
b99e2a35e96dc2d38979615e75b5c05b15e6427a8731d59494f8fa475f01780e70ad6f7a1e6f1d38f446461511b017e632979e6ffb38aa111022c16b7115a89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\cb=gapi[1].js

Filesize
53KB

MD5
112ae8f113b84c654ca273f2c7989918

SHA1
67cee2288e916a0c3eb1e2cdeedb87d31228f18a

SHA256
93916ff605e2f8e9461ca20a8d93e0a72b0583512d8d505551606e88bba5d09a

SHA512
27c85d817c4764c28d3d68c772b4008bb4204dcab7d4a5a5e4e7c038019d8daf01ba5fa0fec1069a6598ecff4c4b7fbc45f1c5c85e14056c19993e9ab2674acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\platform_gapi.iframes.style.common[1].js

Filesize
50KB

MD5
6179b76404b2cd8487cbbd2573d84ab8

SHA1
a30b1e7d5336a9a40c6a82c26af3bd5e95c0acdd

SHA256
81d4ba8f90d462cbe2f10d329edb6b7acc6b047919cbd71f2d45f4bff7f4e81b

SHA512
01408380ae1661e31826894f043fe3cb4db5c4378d882909fa2d31a9e7d7c5f0f0a0e0278383130ecc9c78956ccff2a21d85ecd7112bda975479d67dd21b10a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FB4.tmp

Filesize
34KB

MD5
64fba113250018a7295de67d7c22e3e0

SHA1
0d45f57c7d7cea37a72a9a5c0d1bc6c42c17d18d

SHA256
7add0471f6023ec43fb68f681a00a96f9c152da812da145fe69b07537ade189b

SHA512
f1ead38b408d28fd6f48df50ca8537d98768522679479f69da0ff59d5655a6ef986d87cc491906c41d7a0c027a125027badd8ce7e50132b8181f0787bde2aa34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9082.tmp

Filesize
26KB

MD5
0a8dced1efd8cdcd8f516abf22196e2c

SHA1
d09727c232ad3fb0d215127fa743de4f8fc81410

SHA256
148cf78b5d760e49eab37ea4f5838ea10f19a25d443c1d88472b3f0b4581cdc9

SHA512
5600aeb85710b85cb95d5da5dc5e194c41bc0edc1d57310d76562719ff3c3c6084cf4b8589b39a72e6e0d1835180cd2480a9d489e66ce55e044982ceeabc0586

Download Submit