aa8049df127c99eb7f8ed4c264d06eed32091faff43708999e38e09d64533ef2

Analysis

max time kernel
0s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f0c96a5348745876f88d8a3c5acd52f.html
Size

37KB
MD5

2f0c96a5348745876f88d8a3c5acd52f
SHA1

80019d8471e0d777c3fee7b46b0c908c39d3b849
SHA256

aa8049df127c99eb7f8ed4c264d06eed32091faff43708999e38e09d64533ef2
SHA512

8261e574333169b19d2c40b3269643246cd01220e72621d589fd3c9f68fc85952d2f52618a8a7841bed44bbe031189dc1cfe01a814daa22f8e749938a20a9f17
SSDEEP

192:DOwccTzJSqwQ5bz8BNVQwQLqfw7yzbXAxACAwQOGezZL1wQQVzBPwQlkdYPwQSoi:6vBsqa6jzPimwBmi5X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43346D31-A5E1-11EE-AF44-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2284	2224	iexplore.exe	17
PID 2224 wrote to memory of 2284	2224	iexplore.exe	17
PID 2224 wrote to memory of 2284	2224	iexplore.exe	17
PID 2224 wrote to memory of 2284	2224	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f0c96a5348745876f88d8a3c5acd52f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd2b98a998a9efb32bfe1c102ab2f264

SHA1
46cdb3d7e6a06b3e9c08f34f19817c36e64493ec

SHA256
8c402f686ca42bf5d0f6a68e22e2a913d84bf0340e0b6e0f22a3d82a6c6978bf

SHA512
83b87c90478a831549401d721888453a3119bb0ee77d6d77e39768a2175b04920457ee1a9ec33863f1f00267f6e7e36e81a6ea07ee4e07df7a9c5ceddfa92dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f601da43cef28eb25565f4df1794fa

SHA1
17dec8d2d18f8417187fe4bce94ca323a58e7dcb

SHA256
a612ff37b7dcefee9af1383bdf8ef24362334ab4803022d0eb5ebf0325fedd21

SHA512
ce186a0378005c1d1fc23cf7d6b61d526435de2aff764d1060f3aadc23fad64f88292e3a79759171d6abdf1b3e2d3d19517cfaada4c7318daebdde5c06e523c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6b81a5426e689500396902057164322

SHA1
c67a6c49a7034a908d8f5668ec5228b50f7a02a1

SHA256
a612fff668f286d5ed5797f3c9e047f67541902e24b3b466c2df3ae30d149e26

SHA512
a6d09b6122a585e68f9592da56418288488019c2f65e85e4aef4451a1cfa0e25819899a5ce8633bb89d137f778423cd67f92c2f0b2eae3b8e0a2f7911cb644df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ae9f756da85b1dd2894ca170ee86d42

SHA1
fdcd5440f39e9fbe988bb80dbcc417de54464fd6

SHA256
9c7c7c4b161b4573cad39c5f1b661d3cdc35fd2bb8a4be75f0d3c0d21b980ace

SHA512
a74e635a5a51c54db3e9065619f4a9d79b921cbeafe7449fdb142ecba1813debee3129e4e07389ba1c4251d13db2aac554aa288c062d80aeb1d703ef6759b0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5015aaf627c83d719151a352c92d1ad7

SHA1
6b03d68c28c6fc674d6b2961ff4066fa3842b1c2

SHA256
91fa8518dc6755d786a5800ff46e9993acfc9cc29711473881edcc73e665ed12

SHA512
377b3a7ba51b85b31ad043bb43121440c38f3dd1b49fb4adaa7713c7e8b5e69fe49c0a725c59f180773ff74e85b23fc222ddae51a8102ac100834653c477a3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3f64d75ac1c391df9f0c25a2a45a53

SHA1
9182387a648cd6bfcd517662247ab171684f27c9

SHA256
73b3d1155ab7dffe81145b29cdaafec2ff313c05d2e486e230814cf3da788b8f

SHA512
e1bfcaaa287d354aec6371dcfb2bf0f9c5785f54bd45e0e839144265c11579f18747d77d1b81bba0e237b68844a678e2e836334ccaafe29aefc07718baa1cfaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
216B

MD5
12262d910b93ef4135cef948aba45431

SHA1
b758ff380f20e311d80c882160f61ff60383a285

SHA256
414c9382fd6d7269b70045204ca94f9ab36c75787cb68f7004653395d7c4793e

SHA512
0a017b86ba9c3dafb5f2e4344e001caf45007d00eeb64001b4d48f9f8ef89898fff6a2954c6cbb5c5012a52fb1660bc5d0c2413b814854b64f4cb12cb094b363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ffd830c686ea39a33f224fd0008ade

SHA1
77b8d1c13db5ba62b25f8656be4b0f40ac725dfc

SHA256
6c8bafc4c729faad4a0dca0e24cac2a9c78f3660bb98706555c164207a828069

SHA512
6ac04bb6724b4feb7c53d8520794149ac352306bb9c1f7d92465c8cef72163aeaaa51bb997298ee783b397a56c7049bc9bd85c80992c71095f5091f2c0095f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f028fc14887156766a8c0125eca678d

SHA1
fdaeb065a251cf5fceb946c1b99bbdc62ceeb5bc

SHA256
09a8527b7675e5062196ea2e73cd94de032da827f81333d757268e26d38f0958

SHA512
a75d03535e4a46ca55dfe1dce9eefab5b047929f37d104b9a6138c4a20fde17e36836ae6936f86973be661bd3e757fc36c9aba646c873b8b4c2f4f596e8ec3d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16646972529381798a95e9cdb148a8b

SHA1
db2a068a5a051545be9b2cb8d283eaba396a4e68

SHA256
483dace84913794172b5020e5b6797e7ce70b9aa6651eee55527a69481562fb1

SHA512
cb566682e62888b03a38489f5ebbf7519e1de5dfebdf3628cc1c86fac90eaada05431b5c64adede564fb094db6419b2af81b03b4d4cf9daf32c06482f307eed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC075.tmp

Filesize
14KB

MD5
4080f8a1b61abac67b7b977beaecd19c

SHA1
512f1f7e78b79e7ace2224413213922e74e0d225

SHA256
4067dcaa2c4b767bad3acda905f53145c18d52dfcd55d75c0b0c340aec8180ed

SHA512
c9ca265f6a17518de75143c9e32e5560eb1df64ed2d805999e75ec0eb46f917bdd1807a599e4980d6f05c17beff305ffcc68a8c81bf12bba8a8d162829030a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC076.tmp

Filesize
32KB

MD5
1525f15686cadf86f403e15e9a0e5b22

SHA1
ed4acca1d479e5f4c7c9f6961fca051f78da1ba0

SHA256
30326b6f2d787299a2163a400f629a13f5c8613c728184a07f2c84c88c05e4fd

SHA512
b480fe65254a49df515017a16f0f047e9d4126c4c8af36c4a4b43341d090647d442e2b2d52e22748e843df4add9b38ddb27ee28493f12250e1db7b0c95622660

Download Submit