e849e29d218797207bcac12c2eb6d39b668c77e6d208199e44798b151e3dfe3c

Analysis

max time kernel
1s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ec2156430a94e4e02da5abf038e5eb.html
Size

53KB
MD5

00ec2156430a94e4e02da5abf038e5eb
SHA1

13287fe29e770930d855b098eb853d3db81af1d7
SHA256

e849e29d218797207bcac12c2eb6d39b668c77e6d208199e44798b151e3dfe3c
SHA512

40aa282fbbac5be9cfa72f625689e3c0c917e1abee3faf8dc9b2f0c7a17ceb2aed3abbccb4cdb24de90cf574ca83441e29962c9fa21bad58ac2e00798df2e922
SSDEEP

1536:CkgUiIakTqGivi+PyUIrunlYF63Nj+q5VyvR0w2AzTICbbuo+/t9M/dNwIUEDmDy:CkgUiIakTqGivi+PyUIrunlYF63Nj+q8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D83C4AB1-A316-11EE-A1FE-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2368	1708	iexplore.exe	18
PID 1708 wrote to memory of 2368	1708	iexplore.exe	18
PID 1708 wrote to memory of 2368	1708	iexplore.exe	18
PID 1708 wrote to memory of 2368	1708	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00ec2156430a94e4e02da5abf038e5eb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab406D.tmp

Filesize
19KB

MD5
065e3398dc077a5ae15e110a1afcbe34

SHA1
903bee224bfb087ce66c25ad18efecc75d4bfb24

SHA256
9803b2a2873e21e93906cdc51794a6218d609a5f502a4bb591b7b2f8f99cccee

SHA512
0481f6464b51515682b7ad971cd04f60d503f5beb1e5a933ba543b69b0d6d2d10b6fd15b3ff8ad61d6e6c7e51c72c0c795e78222c8b8abe0a4b77f2c90afa768

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar411C.tmp

Filesize
33KB

MD5
6cd3c6110ba29784ece6e4934c98b052

SHA1
4b0518c33dcbbff6f54d5e75563506610f0cb7d1

SHA256
209ee617eb987978208e18785b647657fac85a61720d00eda24a1ebb90a3f104

SHA512
654c393bf2735271927fe636c651a56ecdb699ed5dd4f7015bf01761ea89303e1b67a650be9c4668c008c8eb17c78be2f0e4f2acebdd458f64000db41ada41d9

Download Submit