e0b375f9e1f1b67565ccbfe3ec6242f5249cfd7c366f44fc3eccc5033d3a2eef

Analysis

max time kernel
0s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43592d872209e4985b71177fc09cc4f7.html
Size

6KB
MD5

43592d872209e4985b71177fc09cc4f7
SHA1

99f3d9491d6559343b5561662856ee45e6d70af0
SHA256

e0b375f9e1f1b67565ccbfe3ec6242f5249cfd7c366f44fc3eccc5033d3a2eef
SHA512

70ab199e8b0ad52df1ee83864bf4406e1b1869cf2aa33cd5b1be239f76311b26da89bda4895298629dc37b13321c43bc26e1393bed34f5160289406c6e1b1c23
SSDEEP

96:uzVs+ux76ELLY1k9o84d12ef7CSTUMZcEZ7ru7f:csz76EAYS/Db76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F1B0421-A44A-11EE-9BAD-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	iexplore.exe
2584	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2912	2584	iexplore.exe	14
PID 2584 wrote to memory of 2912	2584	iexplore.exe	14
PID 2584 wrote to memory of 2912	2584	iexplore.exe	14
PID 2584 wrote to memory of 2912	2584	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2
1⤵
PID:2912

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43592d872209e4985b71177fc09cc4f7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddba662b42b3ff2123187e31fdbf7322

SHA1
79170c33371f5f6b471db61e0f7499e93154c3b4

SHA256
88e9302ddb4f9097d59fe261fe3cce9f03ef143934b9a985b3f8586c2f3092d4

SHA512
cecf40977bfbeee430c8990c4191e6e5c67bfc657f18de35c9e0a85ed4049b7b34e98435bb313d7585d856d579e3ebb623f228305c1d1535b0243fd47c6e85a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af516060aabb608be9d62809be852d69

SHA1
32d663cefb9c5c961eee6c802af4be1d49610944

SHA256
327c13dbcee6441b37346a08e4610be53501cb02976356238225b0eacc8321a0

SHA512
be8781580bf3041a3158de04571e2943b6e7cfb5124886c713a78ff3932175e4dd799f085dc1e46170a6575641e5acea0ec6070b259516563fc116b41379492a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b152edc4922535bf1d16a1f8a3c4216

SHA1
7a2251527d534bf2197196084024a5807bb91930

SHA256
2fb268fab22aaeee014801e6b607cecb410c4c77b5b47fab2c651d721f711de7

SHA512
1e72f2f359e9f3027c1d41ec66076295cf21b5eab50fefaa4b84dc2cbe31f5da4927dbce5691c61f303501a04351005eb53137e9bfb21287137d89874dbd792d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fed2b97fac8f2ea91432e9ded0c4d13f

SHA1
bf4b464f45f6dd7463be56ec3bfba0440d13b179

SHA256
091347932c5d36b2e924ee215fdd91a4bf8193216712c1c308c9dc9111bca1fc

SHA512
25d8cc96037a32e19775123ee6ddf8867aeba7baf4b357bf36aa80997e30a7e14eaaefdc71a18ab8d6216dbf10a6e0bcfa8a751a7a566385f352308039bc258c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3d8ca1fc155b9d013f575e9f8681a6

SHA1
8eb8d88c87691c6280faf024ed9388591e200799

SHA256
13b10965a152dcbb66093959a6ca3e0cdd643ff2098a6051ae1ef7ead1fd4478

SHA512
e111d9cac871f72f2292b2e9dcfcceb694c3dacfeaee02d48913b0ac50d66e07a68ddc1414bf2a9ce399014cc06ad28151cb6c15854b965ea123e41aea665f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8731626569eaf9ab97fefd06a34257e3

SHA1
42795abd1d2e60c42a55c3c8591a01f740690caa

SHA256
c4b0cbe20708abb60c3b66ab5ef49c2d6d3697c5d248cd4379f3f6ba3b74560a

SHA512
bfae57fe3751331f6086603d0b64b5041e31b6f1b84b7bb846ec219e77b4d9b7e126a04900fe486270c7ab3c927cc4073c86152954d1f44da8c637bbd6ea19a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b612bcde68c4e5ab76ecf4946612887

SHA1
d28706d505e20444f90917716557c0577f29f3f4

SHA256
8f24fb5078cf740e4a131fb9a8b9e7aa13a0a8b224d3e175a830442db71024d4

SHA512
f56601827cf2c454d5525ca34a065ffe9d4678f1e5f226e4e416d07f3f28140c06c43623fce7bbdb3f5d61cfb9dea173b6c9c8ef82855b87910656dc73f17f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DE6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E95.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit