d0717409b117811f6a08ab386b470fdd36f68c3f3b0a10c72d25c2f6d912d1ba

Analysis

max time kernel
0s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fab119943065f2d0fab39792e927ee8.html
Size

7KB
MD5

0fab119943065f2d0fab39792e927ee8
SHA1

e794e563241665f000f1acc22e1f4c3354253cca
SHA256

d0717409b117811f6a08ab386b470fdd36f68c3f3b0a10c72d25c2f6d912d1ba
SHA512

47020f150c1480314de32f30a8519595fa39a40278ef069bdd39793d5a391911dbf0834c85a0aa073ccfb4998e364bad3e7d9adc16a3b104a6b9477467047862
SSDEEP

96:4zWvP+YzY3pggpMmNTrj4Vj3ViEZIwLN0uuvQ3X3txF/jKvg:4q3pUnJNoTViIhuvQn5LKvg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E22D5641-A32A-11EE-8A73-D2C28B9FE739} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1908	2660	iexplore.exe	17
PID 2660 wrote to memory of 1908	2660	iexplore.exe	17
PID 2660 wrote to memory of 1908	2660	iexplore.exe	17
PID 2660 wrote to memory of 1908	2660	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fab119943065f2d0fab39792e927ee8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ceb2bff4503b679ffad6ec823a3f60a3

SHA1
2a1dd2d4371e7e4fdf0b0d65acc2895c1fdef8fc

SHA256
8a9f5d920ca797e1dfb39c799d076e4870a2384ac35cc953c1da8cdee1e171d7

SHA512
ce8f20d952b52e7bb5a50ef9ea67020b2a92f244220d953be5c56bb2ecf2422723465d68ae20a923354358bf356ec1cf142ef87ea0e5431f35aabb1643eed249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b070a55f476ccb142bec0d2a2d6d6978

SHA1
45301216816589dd0e9e7b6affa7caf3ffb946bd

SHA256
758d983597b698438cedc338986947eba4ab11393c8247737324e4acff7404fa

SHA512
b77d193ccac3750b520b10715de8c8ae0f0746439bc6188ca523b0820b6db91006f4395f91f934dd967e743d36443e6faf9eca82bd6cbfb7a4186a76d8b595c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71201639776b6294310aaeb0ea86cdb2

SHA1
6e5832cf95c189d5de80954f887ea7a86b44e491

SHA256
ed2eb322041ae8985191af8d032114d5d201fa12eae43938cf4a8cbe4298576e

SHA512
d6ab53dcec7a2a5d31bcdb1a8e98e6c4541c36dbfcbb61952747ba544dfad35019c360d2c0592550e4374dd1233ffff79d850b79cd2a5c5e018455faab5f0f33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
388b3c7bdf636b48127347bb642c2612

SHA1
68d5b2be56342669674d601b0b68f40b5cab78e9

SHA256
37d915b00880f4dda33fbfac3906e27fe5c1b0fe43f42e78cdeedb42459172cd

SHA512
a5e0c620752608e57600b3b3b6f4ca77889d1f3111230a6ece3cbe631a2da2f90f58cf85d5145123cc787ba46255da4aded713c5605036a5f85428c2d00b506a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8316fe4a7ea83bc6da42be94f882159f

SHA1
f2ec5a20a6055876dfd1130096f7c164bab78a3a

SHA256
42eb2d1d07e5032d20d03e54d01d626a195b5723fa8eab05b1d5b525b1d167a7

SHA512
4c01ece387087358a3a10e800576e953e61f300256f9b7ba6192acbde22019e3539933543062aaf46cb3da418a518bfab0624aac74eb69fc002efb7ab0e4ebcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
127B

MD5
67f4934e428bbca0f8f1558e044bc7c6

SHA1
a7803f71188991ce56da5664d0044fdf4a5bd504

SHA256
8437255fd678b761720df614a21f48d3302979364f0df3e20cec0cbb946b90b6

SHA512
c176850524f6cef6d51466c84d8e408d9f13d175ba64ec4b8a5e972dbb51075f5501f0dcd4e6c6211c9313454bf883669ce6d83e6c057c50733638f98d436966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f6db0d3e99b35b67e18f2762a0e75c7

SHA1
679ea1f7631436c415c54274669ef0f3050023ce

SHA256
7d006a4f8c4e080ec6a9975faf0b63931f91a8ad15f3d5666ee71a63376d9ff2

SHA512
9f37ac4fa04ea838ba0011105c99ceed187fc2506c8839d54cdb77526d2462edf6c2f5fd5cb27edcb6d650454ec2c3a540e43787c18bfb9fc9882b7e7d7b1a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5da36a5a12b8c26ef1ea4f94daab155c

SHA1
0bc649ef5cd3fb785fc5f629d198bec032b600c3

SHA256
e13d64bfc9ca3be7bf99207b22f3815e6be79f2c6fd6bb9bafe5d981799b719e

SHA512
663ca30666d6aa2788ae2a508d692f0d99155022a26b99a98fba383715a2c5dc98f02fa9132264c6561f17a4815b022cfeb5b23af197853f252bd11d3c8ff97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d4d03bcb50617c7df8fd8a6ceca49ee

SHA1
c2f24898a17d3c9f9d4e204052e2190314ff8dab

SHA256
e03e754587c5fd63e63c71a4d00bc90a8f7bc897c1842ac7bcf48b4a0ee90313

SHA512
7e66a1b1fdbe2a46fa046998916271382b92a98b9bcc94cee6138b0d990238fd141f3dc5592941589b79eec3f2f73afd3c5b06056b334287b9681b8a46e58b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
00e19bd4ca3672256837d660977bf00f

SHA1
458ae8e7ec0cecbda9bb338da0c2d5c2e7edf642

SHA256
132ad71018403df301ecfe7c7076027f939fff6ce36dd614da12bdbde360f6f7

SHA512
03bb37ab3616debad36b2e28275c9a8506992de48b805a9770dd757d87ebd7e55352fe59488fd0ba7c149740b5aefd915658dd92c93aa7a7217b10b170ffd085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar348E.tmp

Filesize
65KB

MD5
9cc2d2e28b9f9f6b643d096207004a67

SHA1
def602f88170317aafdcaffc5a0457ffad9cf04d

SHA256
f5197bb03cf58e00ac0281343323e5c98377adc5c5f1931bc8136e4cb398818a

SHA512
f1bff4d5c5a47b73cba607bd8baee792fcb255bedf558c3d5fbf52f607e1a47a8ef3b3f16b5384ef6f84cb1a6f7f79d2f2121107c349b2d8e30bdb1cbfbc727d

Download Submit