51869c981d558379542856b5298852305f6af9a14ebf26a97a733c35330f4820

Analysis

max time kernel
0s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10257e9e562e02b1634e6e4a94cecd26.html
Size

4KB
MD5

10257e9e562e02b1634e6e4a94cecd26
SHA1

3318f13b32ccda03d06183f34c6c01a9fe79c811
SHA256

51869c981d558379542856b5298852305f6af9a14ebf26a97a733c35330f4820
SHA512

1bc6a1735775bd4032fea23f5fe27aff210d260b205d61db1f4fd09fa3d992455eef76d16cb85d2259545e9f3f02f9e44117f0e5c9fe165329532a1e7e06c082
SSDEEP

96:rf9seakGiwLsvfpFFOxUEIvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIaTvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45E181A1-A2BF-11EE-87FB-DED0D00124D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3044	2200	iexplore.exe	17
PID 2200 wrote to memory of 3044	2200	iexplore.exe	17
PID 2200 wrote to memory of 3044	2200	iexplore.exe	17
PID 2200 wrote to memory of 3044	2200	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10257e9e562e02b1634e6e4a94cecd26.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fccdec7e0053a6c7e580a542bf12b03

SHA1
a020a3757ca19db7b9599eb6d5547db7868d439f

SHA256
0c5d8ed9dca6184b4cbd6eae46e011f3db4e136a2c7ca8703c503de37c534d25

SHA512
ec2ef34902d7d77216e2710515daa7bdabf10727dab0e9c72cc5144c863b7c4da0d8c3bcee312b1da0faf4af14d1ed6b185871f9436eb5f981a98f288391a72d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
457575b9f839596807d1441155fdf9b8

SHA1
b9fef04e4b0eba36664eea06daac5fc92785853d

SHA256
908b43daa6010d5947b3510de19c62744f820c733bf8539115bd0170e4c0fab4

SHA512
99da30ab018db3ded6789c5253e001323a865e93e7218ac99c24a40bee0a5b117b8a3803f43b089c613f3d87663648f512cb4dbfe7654fcbc79b636d79889f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5968d920079462a0cfc3b4a0a5fe1d07

SHA1
005a058f5ef0c032d8c64e9baed1cadb5811e73b

SHA256
a362d7c6c15f1fcdf4dd6ba1d766b07ddbfac226fcab6dc5ffe465825f0c1fcc

SHA512
4b41f20eed09d418564ab4d3f612444db5d5d8effa70adff3a9f930eb46171e79806d5b7783c43b217ba4114e355434fee5238178db422174f2c146e126ca5a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7729091c000c8a20157ed00a8a970f23

SHA1
a5530267de9ff6d055f173d6204fcb56497afc0c

SHA256
4e9bd788fd8c3decc4873b39178841cee8fbce9c3e270eb6282e5bd3cf0446be

SHA512
150f5843c93a670402be5efddc511a3266950113b6efb05594245e70651c91f481a69504b453fe3819b071972f00c84ad00ea7a9c3004f0cd39ea38c1f4db48a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01ff5ed05105b5cf13740ace5fb2f153

SHA1
e81d3aff78cfa7be2eed929c34a5e999d8de6455

SHA256
5d819994983e30e870f8ef5f8db7b5ea1393699062f56e9cc18802bc64182b8d

SHA512
ce436cf7260276f2106a2e5bee281ee5e24a38b8df9e75f3d0ac34cf872c3cd529e17109d8169f19d15a18ec1d77d05ff4c007b8a41dda0b5af336be6b893907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80dbfaea5ecd9920d4935958908b7d1f

SHA1
2d6d69db98271dbf41208e56d27ed0b912a22e01

SHA256
e1919d0b8767ab9c5f033f85ebdd4098d9eda32f664df733a8dcdd4f2ff89423

SHA512
bb2d23502809afd0cb93d8301af023fc4186ea7633a7fcc00ac38029945e96d9a00a6b5c4fe4dd972afdacf8d7db6c137fefe7a4647d177ab71bd6e58a2ab07b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c5d689a14d679c61f853bebf1ad0417

SHA1
55905225f370bc641ccf8d9c66508dbfc24def8e

SHA256
b9d3007b24ba502cb3c24f9f805659a33b95406bd337b75f47006826161b0ae3

SHA512
7daf5fed21a9b9f84efb5aa231d239c411caf664f425ac9eac81cd14c876ac73b3fe361b66a1c46b47c63556c14284dadebb2dd89aa98eb3ef81f52331566ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cda23453a73b20587f38f01c18a521e4

SHA1
9d38df535173b331cb0077f168e9306ac3cc5126

SHA256
d08a1b942bb6f04e68d169bd98b510ffe4bfcf280951a792578798a7329910b5

SHA512
8d27fcff27eb27449631841d5615ee4ab59d090ea3be0dff092ceb27020c22d510ca8a93aafecdd022cf9da9fd6f58eca0f6bb8ba1a9df6a8408f6b0a8eb9549

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AB8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B78.tmp

Filesize
1KB

MD5
fa527dcd6b5eb05e72fc51570a2a6608

SHA1
3380c5ef74408265fba2f67e790636d0ad0a51cc

SHA256
4dc7a4a6cb3be2c334a27a49df89f18f8f91749fe6aa1cf28d548e0e0c75ce3d

SHA512
05c0e217c433949cab210102a26ca7f6a765515b228b217e25c7409408fc167b5a59a8494e1181284e9ec72849c90288f3a066faa284e29d871097ec76291a5a

Download Submit