e9131624192de14648e02e02408760910f94421d7b0adb7846b69bf5965caf46

Analysis

max time kernel
0s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26b8573ef0d6ae81fba966fd6812e911.html
Size

184KB
MD5

26b8573ef0d6ae81fba966fd6812e911
SHA1

add29bd45c5c5d8e7e8d61d6ce701850a6e35fc8
SHA256

e9131624192de14648e02e02408760910f94421d7b0adb7846b69bf5965caf46
SHA512

a686ff0325d95fb330bd970e7c84297e658e8d14c5db20fc647e9cb67da56597e71698ff04f619c3ca2cb72e98d010884120667635b57e4085ab4485b7405604
SSDEEP

3072:SdvfaaJQmms6tf1Ht4GfVA47ySWmUO3BCyTPj4Cd3kGbB4GzN28y5pYTaOiHLOy8:SYammms6tfpt4GfVA47ySWmUO3BCyTPV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD7C76A1-A3CA-11EE-993B-FA7D6BB1EAA3} = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2468	3012	iexplore.exe	17
PID 3012 wrote to memory of 2468	3012	iexplore.exe	17
PID 3012 wrote to memory of 2468	3012	iexplore.exe	17
PID 3012 wrote to memory of 2468	3012	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26b8573ef0d6ae81fba966fd6812e911.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95ad1a880aef88b254a30d0d5dde6a02

SHA1
9706c380c50909894df829a4f0d51d3e4f1f338b

SHA256
191e299bb0894b16949d4b8a890ab4d0d8eb5353e60248424b9ec890d76f2169

SHA512
581f937f50124f2a944e645ab989ed512670021bb5b69a4c679c97274ac217dea67a40647d93c44b287c5d579f4bd56b3ecdb348a54ec21c01e2a21ec5e5e58f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
865c9f275dbf7261f76b861b7e9ea8cf

SHA1
95c16f260b70e670aa214eec498483c4eecf661d

SHA256
4069046755b8d12c28b22a08cab1840e9a4dedbdc826c0ae33d0c6f195d09874

SHA512
4588b3580a0d466b9c44f7b11fa62c5ecec9f3b8d1e12d7d2889881d889465c525dab44d1ac5095c846b71006ab633d0660dc36094f06235e9013fd2bf9ecc79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b1132633c4c6ee8adcb39fbfc69f150

SHA1
d822193e0fee5a2ae8a7775c29d436eb9ac9aeef

SHA256
47cae0e7fce74fee9551cac97f4e81a8de9c7026585665984e3c9daed40b5cd7

SHA512
88f6dbb3d7cc0a2fd1f4a32c88f0a68d6b375f8d1da58f675e70958e96b7b2545a5ec208052d63ea94a78b26297d85170e12d44379bfd7f98535159d5059ac42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f728a1ad40167ace9057bb4a7aa7d2fc

SHA1
f6323e4e62c5c09df8eeeeae8223c2d19b40eb60

SHA256
5d67ee16d5576bc61d9a371ad63dc9e92a485f165f6880016ef496cce088483f

SHA512
4a0148fe73ff7fb10375cefbe9537c198acafb7f3f79d3f780502bc4dbe534f0f2b7756b5c3936ade6fd03041cada19df55b2172c742a23ee844636bf9290275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8cd5a4e07bd7817c96e88a2ffe014f5

SHA1
92ebe0c6caa41db91bd934a7f92fb9bead306715

SHA256
83d76604ab5edcf0af5fad1b83eba526030a35c573d4c87a721c695da4e84d46

SHA512
06ea8bb0fad0aa44c046e7a7ea5d944fa0d36f39e59569cf8457d86b232cf9c47008d719db38fa0abc05f31b5d78b68b3ed408facb21d7e4ff6903b3573b8a35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62d128c06958c03e216f655ef507aef9

SHA1
f9f3b39bdb809ae5c0301466c906574758cec599

SHA256
fa2bfe2c6d2b51c806473b90d4c0dd72c52bf9f573bfd4e833c5df8cec69dff3

SHA512
88d9a063664913fddcb5388b3c37498245e2aeb52d33c924a16b0b6d8e66822f4dbaefaf82c0506185013890f3e58bd4854baa5322a1a7ece08070f11943c32c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf4043c92eda8365bfdd4e77adc1c7b6

SHA1
354d70eb1d17bf5b44deed7e71b1d133f5dfcf85

SHA256
8a5fc73d961483cca87d015e60646523ee343aa94e147326469d13d3e73176a9

SHA512
36414add50b7e7d1ff3a22d4adcfedabda55d37179632fcc05e71ab8ae146d9baf2c77cd13837e94c39619e7705f7b7f38551037c52fe4acb4a0b40b89e08c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e849b818f2d1d7d0386915e712a8c895

SHA1
a0063b9be88c98800ca6c1949640ebffa3dc97ec

SHA256
056056015e43f67ef8e51b376ca63e0d6a2ef05655118e357a2d30ca294f161a

SHA512
38307726c4e5b987264ebfa8725beaed76b7d77a84794232300e8bc786b5452d9a543f7df8e5340bc7f528b122c7b53a2ca713a0b7b0e41498a07ed6b5a8d3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE83E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE88F.tmp

Filesize
103KB

MD5
c1daf02315640c25bbd941b5709cb947

SHA1
2638e4d524d97669f066b33c751923679b3e43fa

SHA256
c630b6d42f8627c1e5b2a25fff0611b164472d4b8ba4e9405410c73129e17dde

SHA512
0790e2ce082320c35eeb13b28e00aeb05baaa72d1c1255ac091f140a3ce599efd46d578f774098ed377f40b2b4de1f048dae3cd13ba83dc5687c3e31a6cd1564

Download Submit