e4e2821e130ba27c5410b1cdd7d1e436f8fe6f8a6a84598870ab6ebe6d303dd0

Analysis

max time kernel
0s
max time network
132s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c2291e1b320fa98f1b622cf7aeb56f1.html
Size

28KB
MD5

4c2291e1b320fa98f1b622cf7aeb56f1
SHA1

cb148bbb4a500dac2911c8ae17bce3f51f9fb286
SHA256

e4e2821e130ba27c5410b1cdd7d1e436f8fe6f8a6a84598870ab6ebe6d303dd0
SHA512

d95e983411764381de4a9cd2b290be19a71d73c49acaf27d83c8db62caec839903d31b93d160aefd4e9a71cd2f59ca446dbff2a21263190ec37f66c38719f5cd
SSDEEP

384:SIDtlgg3cLdetf7YgGoq7TnFhjla3IPOcu5tQDlI0sV0C7sIA5Hw:SElgg31ujzrInV0CIdw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E42A2A81-A394-11EE-8951-5E4183A8FC47} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
824	iexplore.exe
824	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2336	824	iexplore.exe	15
PID 824 wrote to memory of 2336	824	iexplore.exe	15
PID 824 wrote to memory of 2336	824	iexplore.exe	15
PID 824 wrote to memory of 2336	824	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c2291e1b320fa98f1b622cf7aeb56f1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:2
  2⤵
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
41KB

MD5
e53a120191f3c95fec471561a0b4f665

SHA1
88e5201d0c7c2d3c30afd00ec7fefa6a50e5f8a1

SHA256
b1829924f13d9f2d7449d6d2722d72fe85b4b4e69714ae3e84a56b90d39257ef

SHA512
7028fb6a7a82295b226148aa065f164ab35b2ac76214ba71ca6c330c8e6c1442b8693e7eec78dd1897bcb4cfce299162743b0f998a2d64d6b855a0d8cbfcfff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a3e43a37b144764a54af49bd7162e560

SHA1
8187f92c235f5cee3b3c971a6bce75868f978a44

SHA256
26d0e5067d57f82ba04a33f0e0345ffc9a2cfddfc5f895002ed815d7684fa422

SHA512
8378f63dd5b46e71a842c57015696aaa59e6d9f426f286c1dd063fe9fe7e1e8342d54dffabf67d7cc068227544bf552bc3b1088fb93cf6238118dbe92e4adc12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2d3cb490e0322445eb8fb90f311c28a8

SHA1
a9194d7c204201a34cf4e653737b33a840fe2eed

SHA256
e171b7c4d9e97676cb96174a69bb8fc07c19d66b3879777d1ab8212ca555490f

SHA512
25eee10e451cee7d1dcc1fbca2410e38a7cedc3a91669b98d45d47fe6b28b6bc6fe2aa31027539a7285515fd433e6bf3a5ec5a9cd473e5baf4a6b068a2a3cd63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
53370479914d1b26a0cabc54924e3995

SHA1
0f149dd0de96134252d0cc83f99aa121ea00ab9b

SHA256
651f08f49d1f52e9bfb03b159d994e9865c49eefad12db58fd2e9db3a8ea150c

SHA512
33eaa35096fbb1dbbf844a1c0d66ea347725fce11c1bf9be3e476286172ed3c17c6ae5e8835766e1f425daadcb997e148ac2f3f7b434b1d3b8b9fcb582f4007b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4cb50c9309d338f09443809b50fae24d

SHA1
5e39132c77d7b3ceb0c6795c71ccecde2ec593a6

SHA256
b8d3b83d5a06d43e28b9fb8ea2db0d5c623733eb0a0226e2cd23f37521fa4b77

SHA512
a58f4680be25101e0caa307b97541d110aaf383c32d6caf3a6440ee30d6500f79541223fd5b4047203b2351ac4c36ca02b18696902d389ff8aa8a0ef9355e7a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7e39ba548a9154a9a915d263c0296be5

SHA1
c63ac782569dd0411873ef4b2dfd057fc18faa69

SHA256
e272d36034863be5e98d6b79b684d54665f26c48b541b92f01544dc9415b102b

SHA512
f2c1cdfeaa05c57f0aca8452a1083d731928baaa9349b21303422ebea620063b9be337bcb2de543dbcaf6bf94e85b3b3fcbd96e9bdca28a2c91371865a6cbd31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a01c52af00fd06670565e39023962bd1

SHA1
64f1a78e9763fdd2dae4e830eb3c4abe10359ba5

SHA256
909e6b0cbca500ffba3de3ebb9e1591526a06ae8a37a82cfd521b743dc7f8ec3

SHA512
17795c7b8af2c03741bd86b560ed1d62ecdc344f566868a75a710487bbb37f6e16ea3a2ed950cd4c6ba1e49d97dd57087656705116dbb75a9ce53ce7ddc23323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4033f96457a1825138d5f245fd4ed9c9

SHA1
d7a956cf793e99245781f5b0aabc9a061510c92e

SHA256
c81d22b68f42b7669e3a102db7b8f1c2bfbeb105ca8c77e4e92abe6b729d25c0

SHA512
d2ae9f4a049c6e337c258e06685a5a34562aec095a7f7ac3345a9dd7a004d834f0730c25e9099f4f9ede1ce63671db21e9a30d765293b7a79af27549301e7285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8209e395fc9cbb40fe30636c68421ca3

SHA1
03600861f0462f92546918d2d69d5b62a7423c79

SHA256
d981f39b19ebd450c55eefba6449b9988a1b98d267f26d2cb4fd0c754a3a126a

SHA512
fe4ec4b97c002cdf3680f47be462a1c5d6563ae4f7f505ebc3002518d09d5ea8001d4a418a94183476d6760b9d09387e359c3c0322b490821ce8e839d62396b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ec46c3217c1bea7e95ea54c2f95cb9de

SHA1
7547fb56c8697dada11ec19d496c14cf9ee52eec

SHA256
f281de0910892e85348df77c09ce45e539c84b43883ccdbc3d906d69aa841f1b

SHA512
62df6af0af87c4c7c5d1fad9cbb8b22b15af2790602fd5a4e82bbb51917526d7a9611cdbfbb5207830ec233e35bdca107a46a2458b0702a87faff569bc981999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
969a48575570d33d6ddfc0cfb5c050f3

SHA1
de22913e7073e7ad411c763ce47d875f18c1200d

SHA256
99be07c51877ff9f8be729c97e92ed6ab934f49242325fc3353c4fca27c3926e

SHA512
efe35040bd898fa2f535fb786b935b89ee11188493f2f3c9b4b536c427bb4b36b2ea114782a152f21eaf447beef410a99516c889eae3c0b69b202fddd5df1183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C82.tmp

Filesize
20KB

MD5
206c555b853c2b1acd47fdeeb53b60ef

SHA1
d79a628c8f358c18eb96d2f321b4721d9ae5b91d

SHA256
0fa43de5eea56a2ce12c2cc0f64cfd27017a1f068da859246386dc8953e4a490

SHA512
54bb64c7a943644e6431279e01b749d681f9eafedfe68c8971884b035957d8498b4e8343a3f04fdb43ad1edc5ef1b738bb9b017004961e77e83e91df7e0cf329

Download Submit