5e1e2ce03180aa0a0d2f78ffd8900caaedd66cf17b185c79f400825c9247d6ad

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b3b0d472e7b3f45f8ffb7c25744bf55.html
Size

432B
MD5

1b3b0d472e7b3f45f8ffb7c25744bf55
SHA1

05a0963d004ff9174834ef11ecd600abae315e05
SHA256

5e1e2ce03180aa0a0d2f78ffd8900caaedd66cf17b185c79f400825c9247d6ad
SHA512

dc3d8a01c46777279a47d8d795c40ec2e27f3c79a8d23892311da32b3efc45b67247be8ed2d8f74098f5d213bedd566aff96a7f2fa851f5be15f4d4fb29fdc5a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAB61CC1-A398-11EE-A76C-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1668	iexplore.exe
1668	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2436	1668	iexplore.exe	14
PID 1668 wrote to memory of 2436	1668	iexplore.exe	14
PID 1668 wrote to memory of 2436	1668	iexplore.exe	14
PID 1668 wrote to memory of 2436	1668	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
1⤵
PID:2436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b3b0d472e7b3f45f8ffb7c25744bf55.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7039c3e7c4b0d9142f0a6ee2e85abb09

SHA1
a1e3766494325f3544de118dafa7e69ed91ef8d7

SHA256
645fc425bb49b9a16e3e1debc385d5423bf5d52f819ca021e5e80448d823e053

SHA512
50d62024dd5392a42547c0a356fafde8fbf9d5f427db4f92426e78c2fd2f7b13d3bed61cedcbb912ea1585f669a45b12e6c3b100883ecb05b48725f3b546424e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
670ba8480027de691e3aecdf19add427

SHA1
a70c72358d3c779d2b1ba1e83dd9ceee8e984e50

SHA256
519de6ab566d4140e5f28273cfef002659e0490a7b0f305468e3ecc3db1da3ce

SHA512
158a8f010e51d278221e220de199eef5e055f8614a80746e54f59c22644d4f6e1b35b79f2f37b8e47cdf7730ec7525f5dfc5da3c9539c28420d98c577c13d2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7757d2923c1ff6eacd6b971e560fe8e9

SHA1
0243d83403a227c3ab12a91cd83c47eccdccbe66

SHA256
fc0227177ec9e7771feba7f5f0762e850ef7780cd1fce44f8b6f082b0839e96d

SHA512
508b21b9057f42cd48fe6ae2c89e83b627026bade8f26342d0002a987b48ea778a6c705a5d9b282673bcf79a8791394155efd51ae19d3b185355c0a245bbde1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0019dfb1459378e25482bac5a62de51

SHA1
e42e468cf1c8bb6e9be0f64ddf88d9bf441a4dc6

SHA256
ef8f56107bb8d9efff42c21f57fd42e531ede272a9e1658650bb4000d13b5a24

SHA512
0182ad89db6181d4b30e62ab0a792ad559c4c524867c47157d7ccf2a4484dedd1296fd8dc087e875c0825ba21d4da7336c21cf77ffa431e67c310e67159201d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d4f479f1b43387214a6159123c81074

SHA1
7060b3253b3ae03f1c9d5280709c7cc889e96fd2

SHA256
239ee7dc0ca3f96c112a8efcbe8a7b4bdbda4bef0b235e7928cfcfc4a722d440

SHA512
a7944ecd3f6c19acc7f72efa3b8e3e04a9515a70682b8930cc8cc0f8106310c82013c034d094f639868b7d0e6d5433764dd2e20322686051c9e8210bb10deafc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08b174366dd7d47da4ae1aee6492cd5c

SHA1
43b8aa709d4ecc22301aed789658ba5662666c1c

SHA256
dddf2c8ca892ec7d4073cb3419842f47b9ceacf590126cf1a2ccddd3d12a7a95

SHA512
8d99c8b812b94d0857a61cb0817df39ba38d65a4c5937e7581bfbb47432fc606b330727d55393f0d9951ee44b011a90e246b00d4abcd74008a9de1086bab926b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b478fbfeee8d1d2d809864bd7ac8c2

SHA1
07af14db5767df6abcf00b80c479347e17032136

SHA256
c437eaff203859cb6fa60f0ab009f5528b6e4f80005f92e7f355e4baa73ab357

SHA512
db5c7bbea3868a55cb78b9f020d17454b51a4b264b038969d46cfc9da157416c93b0fc90f978be9bb7fdc14e34c8880327a489723f1e3eda7e81dfaa2dfd06e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b577e1580b147e489011e6e960f43193

SHA1
3b225caaf2c6fd432d6da8f5801b93181548dc98

SHA256
f2d22701845bcad0ff50cacee4adbc5611d7c395bd228d51fa174061a4163498

SHA512
4617f79d8ba1bb8e7ed4c2fe135c985cd0e99aa0aab6b8cd634bd05e7170766d07a2ba8087f733dc85983930e679f4a0313b6be777743ee0ab05ea960a8f677a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de1488baa568329408ccade61f609b8

SHA1
5878e74a260c43871f31d86c888a12fa661cf917

SHA256
50739cca9a0a36e6803c26bc9e137b5e8b3b00a54bfebe5c736405f26460d720

SHA512
5e9b6410cff827a3f77544346eceb136c336d046d1bc93a039327e63c3a25851d0bc755a36062f2c9ab00e89e93fa8f435a76cb61a8a0bffc83db71b9b7e6c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
1bddb610f3f6cc117a8991d71b81d004

SHA1
cad83720882c72a598f1b447e6f5c9942fa3a4da

SHA256
7d4f43131246f6aef2301ac0cfb74518f37417c46859b24d1c75b9b62c2f009c

SHA512
0cef12d07b5bb89b7011218347ed3fbc4158aa54675d66326e4851ea793ae4aa15e15137f49472c3420c6655c57241d5e95333dedb27ac0e2016743e3f7d2e74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.dat

Filesize
5KB

MD5
3db541e350e995dced118cbcd972cf69

SHA1
d9eb42ca6aa5c0c9f51225266b8906a254a33095

SHA256
e135feb6bd2a450e2a9a31d7d720f65c0fc26c540fbc0e689ad7d0e31cf4c735

SHA512
9543a507e84c4933a91b7e66de411cc42997aae06ff7740712ebd46066d7eb6f36ee8e62d572aebe6d6fde634d59e270750c847a14eea64033803bc626f63daf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\favicon[1].png

Filesize
3KB

MD5
a75c230f34b9296e6fdd8b0b855df5d8

SHA1
e0b9e32053d44532fb4e8bb55b54c3211965517b

SHA256
8adba20b1dd9747ec8ac6ed5a26a8dfbfc7ab82213d8051b76ac771c76b87920

SHA512
950b94afc397ac760f38f4c68691bda6b541832e1d23f496e36568def2b9f9dcb6984c6a42ff6b5abef0e19b76c37e40baab22e9dcc9360091b609333029b24c

Download Submit