3cfcbcf76fcaf1a433ccb7e90b2345f86341a4f38373ba9d57b780ced8ca52e4

Analysis

max time kernel
0s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

23KB
MD5

83d6f0da8745565b4aa9e419f9906978
SHA1

f2f22eff65cd7b6d7654341c56e1c9d0045ed7e0
SHA256

0f200d8a6e0e58f7bf6437e9f3200065a146a57bab4a69df56284dd2753bd918
SHA512

0f727e16fdd2b2a749325b505894b43f2f8b0f0d3968034f52a5a6bfca622930a7ba1fc30a910f9a39975d453189c96b649251503d09178fb5d744595378b9ed
SSDEEP

384:YSFpvsthH4sCPJ2WNApqSRKMzhJ/1RFUvMotdvu3hl:Yo9E+NPJ2WNApqSRKMzhqM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D804241-A447-11EE-AA09-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1372	iexplore.exe
1372	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3060	1372	iexplore.exe	17
PID 1372 wrote to memory of 3060	1372	iexplore.exe	17
PID 1372 wrote to memory of 3060	1372	iexplore.exe	17
PID 1372 wrote to memory of 3060	1372	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:2
  2⤵
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
46KB

MD5
de192755433caf2ba87a14d9156c629b

SHA1
58b4b933b6334923bec7bc6336ebab0be493bf6c

SHA256
f8a1aa6019b070536889d26cdde49f79d2d207010f099d59928cf834ef2802e5

SHA512
030fcf2c89a5ee99ae236f322b8a66e20f254c47c2108acaff92e56c66a52e0516bfdb49873e8689f9d6a8951518a82a13f9c05a770b7ff1aee7b3ad178607db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
537B

MD5
7f02aa423569bcc6fc10db6a3d518339

SHA1
51effc306981f9c3390825aff759fabbf1b82736

SHA256
30a79fa05ef915604d97ddd39442cd24cd02d7aa86f3e78bf64504fedb72d879

SHA512
75b488e7c033828bf92fae44aac50629b5c6f69dd3e8fc41ac1d6b0feb1f464d13363ec947393dbf126873846d94ca4bcc2ef7ae585701ce815917a07675acdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9a962b9846d20fd12d02423c5efc6f2

SHA1
4408728a5afe54d004690706fa23ecd69a20f0da

SHA256
a4ca01574ad7159679b6628d0f5c7fa97227c960c688122c908981c8da9d2a38

SHA512
8cf62f8111270581ca3f2424e3b6a20ba6ed59d2b81fcb38c0442abd7543d3cf0a161b9f7e7b4c80988f6605ba8f2d264c575e20476b46c106881a5982ece4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb58917ea4e0994962645dfc57fa0dc6

SHA1
ed6ea3a3fd99aae7f1392476df0cf06d6ab7c64a

SHA256
fa6800650b26e2a63daddb39bddbc4920cd64e6d369ab7060cde4e31b366859a

SHA512
4dfaeee3983cca5c1c9b9073fa7e1a27681033b5af7dbf0c728116ae21dbf134fec26ecff0ffce0acb59454a865933c9c759a9795b0a629fae7fcb751374bf9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e068be8609c1c6711e291966acabcf1

SHA1
efd9fb418cba6c1613f6fbbd3da54adf23155f85

SHA256
3f592ef4fd2f7b2664ccea1741f37009b3bef96b9b8868112a0ea255a9f8e2c7

SHA512
c4d044ba2a493fc42349d3285fd83de02c93dab3880123c5f7492d61bd80f7e0f32261ac7a34cb485d5b9da2e5cc334e60eda7702f37a67feb16c0e4f9c22359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ac8f8fb0ca09f291b15eb0e8f9e5f2e

SHA1
dd64cc5358b8ca2dedf0a1a5ba31c9f3922d84c5

SHA256
f9abc906b8b806a6ba736f9649f41f17b7d3ccd55be7d9d1532fd5b369b70e05

SHA512
089cf1b55f14999abb57dcfc55310597994aff74552fe7cfb02ab97aca16dc195b715ba332839eb99b115c7ec927f752781e5f1835385599279a251d5632617f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2004504c63d2c39bbc882b45b045f4da

SHA1
4c2d7f6d206e8a89cf313141ee6d9f867fd99ba4

SHA256
c672e80a41aa79fe24d45fe990ec57d919ff5cd3f0d6ad28d5b08902368c5f1a

SHA512
ac8748fe30ede0136a8f0a91de7dfdd022df285e74d86e1023901faa354e8a0f148e65427e6d9ca85c4f0128b5c597573a888c85e47fca69aabd7f5ccc30375d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DDFWUBDJ\Hardcore--sexy-girl-with-nice-Big-Tits-Breasted-fucked-by-10[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E7NSSMJ7\K8Y5E4WX.htm

Filesize
32KB

MD5
2f28dcb0cda9351707f959895cbad479

SHA1
b89fb62f53af5f025f98c4336c6521732a1f67b7

SHA256
517e78cd03d7381afb6a27430641fc080bce3b1cead38f48dfc87d0c2208766c

SHA512
a8bfd78a15ae2a068073889013b778e052594e1e7bce40bf97c9fbcafb96dff4bd2f905a8aff0b2fbb39e37663b81059abd2320988c953a02dc231c09cf90b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD20.tmp

Filesize
4KB

MD5
b76bdad0f9dbe6a6efb8b6489529aa26

SHA1
a6c8c4fd740dd7e965ac6efee266e70cd2356194

SHA256
563ddc007b5bbf10e3a9f30632747aa5cbf606c7e12b5be2716642774f3803da

SHA512
7dcef325b3f54e8521409aa081c1595db5cb3d850e5b1915f938379e7e80349c4a98474a2bb814d88333ecc4d7b91b298e0c8aa146217567b3cafe1c78d22423

Download Submit