991ce982b30d3ab9bf9a2b6e076637011ba0449ea8d73d60a1d14d2b08693df3

Analysis

max time kernel
0s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d17f32ce3d922535c147298dac4591c.html
Size

149B
MD5

0d17f32ce3d922535c147298dac4591c
SHA1

9e9d790badd469896b6c77adf9da3546d522a63f
SHA256

991ce982b30d3ab9bf9a2b6e076637011ba0449ea8d73d60a1d14d2b08693df3
SHA512

a361bc056692a826fe5eebd0b5a17c39b10c2ca18d0f03e6baacdc2b761318eb43105fe4c428e6c184f90db898d7cdba940ff188ed40c25aec3aeae68cf28b3a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{055ED1A1-A2B0-11EE-8DE4-FA7CD17678B7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	iexplore.exe
3044	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2996	3044	iexplore.exe	17
PID 3044 wrote to memory of 2996	3044	iexplore.exe	17
PID 3044 wrote to memory of 2996	3044	iexplore.exe	17
PID 3044 wrote to memory of 2996	3044	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d17f32ce3d922535c147298dac4591c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2
  2⤵
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
34KB

MD5
70a174f9b6e6b31331379c1105453a08

SHA1
88ce733e565c087c6235327173b780cbe26f8820

SHA256
a215adcc02e29581aaa14cf05835fc3f6bb2f57a3546aceef5b80f5bcf934b1c

SHA512
957364095771f12871a4f7f2140368edac48d29bfea95f48b91bd31954232d170ede52379326b1e370ea27785b5d61b025db095bcfbbe614fb649ef191a78793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
56f3aab69e33733f7e16f2e0834f0d59

SHA1
461fb94590322aed278ed75582d0e8a59c2f001e

SHA256
6b26283a92aefd589b8403aaebc0eba2ae552e75733e042120f9b27aba193662

SHA512
19a8a78a538f75eb0d675f2f10fdedacda95d194153f9dd5b3d7e63f6f0da5a51754287e53c49d9803ddb832f10fcaed5cbe85cf2ce10780048fc698eec097ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
716079a6bc4adf4eda791e3e52717a4a

SHA1
f95f7f9bf37bddf74bfaae782e5c3dcb8f295046

SHA256
3caa2a78f216cc195d78da90211b5d800120e6a3608b326572aef71af058f9cf

SHA512
4e6363e6ed1f3a93c0fcc0b436eb8adc6e7856d00360227f180eb67af506b31ea0e693ed1e3c2fcddac47562f8964df6b6858111d3a099744c6ca346ddf131ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74003d7e27e7a2a60a78531eee58566f

SHA1
525059ffa999a1442aaedaab2eabebdd446b47a6

SHA256
3e950c397d0beaed954dca8f34bda4349d8ebd8076efaa019e68caad4f158434

SHA512
839a221e77769b7c3e06323d2127bb73797abf6ba80ba7d8594dae093fd79ee91c8a1f7cc6c4559844483503d8064047965d1945627ad5bc59c172f96d87e4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
855fcb963a603d61ea5d688d2b7d0711

SHA1
d025f27c42f052f8bd58a90ea6b4f4f05882ac41

SHA256
d82cb2e2bc45717e97be83cdb2dd307de4540f77314524046bed9c9e66f21760

SHA512
bc464d423fe1583a335394e05ecc796edc3bf4785cad9a2acc0514f56f53e997a0e1d5aea24f11241e93a4afef4b70f5bcc09304a7d7a332ceaed3ce488f6e34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c4d38a5dedefc08a0577a933aa7e4bb6

SHA1
021bbe6a0b922d00a8963803cdd7e83d66600e46

SHA256
135c4797015612f8b690d349cf06bd23261072504f1af39e1acdf8dc050f6c1f

SHA512
bce0eebf147cf6430f3c44e4ac7d65d7f3cd034ce8bcc58d4c607ddce28a4150db7ed712a894d792aa0626621c4fd496f353eaecff63b53eea720081ac1c2992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22A4.tmp

Filesize
84KB

MD5
97752c488fe93bd6f1cad2c0b57adacb

SHA1
7363c33eabfc7e77a19e2dd33ca74fdd2a39bf03

SHA256
01f7bbfdb91bb0d616478a543a0b43b9df52d87047cb420711938cab16c60478

SHA512
fdb5896d41aa2798172ac2c248599b31727d27959376bd5023b5c60b09e5f8857f2ef2a2480f81432d8c3c7ad02d4db98deb5e5e767cb8051eaa9987df53ba7d

Download Submit