df5f699c641a391a5d1a0077ad25b77519d509753b5cdbdad2d4a1cda7176d32

Analysis

max time kernel
14s
max time network
172s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

574e46dd41b12ed03b9781dcf5d248d5.html
Size

13KB
MD5

574e46dd41b12ed03b9781dcf5d248d5
SHA1

25829c827cfd8fa2d9a753c6783bd6affb44b5bb
SHA256

df5f699c641a391a5d1a0077ad25b77519d509753b5cdbdad2d4a1cda7176d32
SHA512

0d63764533f3103212ae9f6d4d7b028f3f1c9bd757a6c64929a23b6790bac42c546bb222042c77d4600c0eb0d97d8cc0918dece653f93800780c29714189a467
SSDEEP

192:w92OluexhGPeBZefyDe5Ee+feOsX30Zx32us3ImhW0Col4n:CluVPcZEyDwElfzaIv0ColI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB5BBE41-AC21-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2640	2056	iexplore.exe	22
PID 2056 wrote to memory of 2640	2056	iexplore.exe	22
PID 2056 wrote to memory of 2640	2056	iexplore.exe	22
PID 2056 wrote to memory of 2640	2056	iexplore.exe	22

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\574e46dd41b12ed03b9781dcf5d248d5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
653f0270a60273146658843b891909e3

SHA1
3d08e6d1be32e43537653d93bdbe6209125c12e8

SHA256
be9bc6c6cb7c53c2f0a9e8c3ad83da9369639daf331096793a078a2a92ff614f

SHA512
64f546e597d8e26402b4f1965f566554d82d95cc6c4cdb6993ca47392d6825cdf7fd707dd72569bb73448fe9dba8eb5848399f645b0cb2920db621165f810de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae5cbe833c4f3f54601837e20dfe580

SHA1
8b1c4e25d7771aa7f01de129fa438acb3a8bc63a

SHA256
ce062b72d7d49cb88e6709067de55eb5e94e8fbbc27848a78ce9c862ec4f2b08

SHA512
27732e006694af5779b8c573728488664048c13823debc825932e070fd6aff19593592e67396ba52aac583d8a591979398167427e6727f1d9a82005b668e387d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
374f6fa0e92f57437f73df43a83bfbd9

SHA1
2e2ffb64996ffdecfa4a497e9b535b7d85e8d96a

SHA256
596a2f322ae7735b552555b480bf7fa5ee39cab86302a27bca248300b9c0f847

SHA512
672e81074ffea2b2f4f2057c600daaee7ecf182d4b9af1daa69deea496232ea1f2a7577426db82d6dc39af265bb29def3332f15ba7acec190a6cb3c00a4fe243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0315bdf185638d94fad5136dad61b4c5

SHA1
982ee9168459ecbe071e55ff35b365ba2be56f2e

SHA256
4421c95ed13ec4c7f66afa18790cb56ec611a61ff7700719f1cebba73dbb017e

SHA512
00012645829e13bf6d2c3bc65aba5eccd7bc9f1687569d22d8af0bd8d42197bb9e6c29a14079aa2f59bdaaea0cc6f34e148db4b93137890ceb5bada43be6a4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289ea02570dabec3e8d515af7a7d310a

SHA1
515d28df5bd9d62a8243980d89c6330f26e413ab

SHA256
e216f2682c17c1fe76d16bced70e7097437b70ee333c1fa3e2cbf0728eea6d62

SHA512
bca56dae417ca414e7360c5aa788b12fb4988135e7978fce2df9a93e4aa951da7b240258523a714552bc0a48947b50f496b947818ba31d6e764a21d2d28f5f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0cd2876a5d2d6c18d9d100bb2b8e4ac

SHA1
a68d6422e0bcc04345ece75f3cca53a00a73a349

SHA256
2861e2706ea53fdf3756dad079c4ecd4c3fc75e31760e1781cf28f21d9d4c92e

SHA512
cb195276e546549e960476c02ed01e4d48b4ea41707eac53ec921fd7fb0026f5b3001f78b4069b26ef4383102ab0ca18dbeb6c6d442b5879faf66bc80dd5b810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04e6de1fd26fa36b5f16754d7e9f322b

SHA1
49b2103ec97c8c72b0adf57281253fbd72cdbc6c

SHA256
42ee17b92b9cb0f4044c11938f37205f8ea1cfa6db00c3c043f8da17ad4d15c9

SHA512
e4d49759136cacb914e18dafc03f8b73db0a90557ac4520dd2d54b84fdfb5c1f068e87c1e69272a8ac7efa1f80d437b4fad320738ce96c1d58f1fb0a3c1811d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d773ab0da4dc7bce08f5ccb5ce3843b

SHA1
c7f69dc0235c358b83b3c1f3768613397650ec3e

SHA256
2dbd66b28ab4deaeae27052be9f119f302d09c7458ad448a55bb1facebe11e6e

SHA512
6cf19d3c7647824ade6c3f771ba20e2c6d2be4219d6fd4a0f303b8a7b03465c8314ce41d7d5375f81fdc5b6f4720d886ebff65e5f80ceb14fc1dff8084fac067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4568e18ec96a97fbfaae15065af392d8

SHA1
e9e0a99e972ea00dc95813fd530b65635ca9051b

SHA256
9e1f72297ddfef84a1960f6f413f77baf6b18af8d0badf51d56d2a683ff27e73

SHA512
c90e56bace94ef36fcb9e4d1174a3d1eba517fe9711651f371110bdbaaded98657965bd513f1c18ce0d4feda0b66e737ca2c9ec166e2d030cef57d8c945dbcce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df66d632124141c9d2a481bc8dba4ac5

SHA1
4b5a25c34e8b0ddbbfd2392c567f4d25d0cb1871

SHA256
cc403cdb36c87a1c894efcb40cf4ffced49d4a3dedf05fcd2f43e558b5cccafb

SHA512
0d453803b97241c7e9ca7cf52bb8f0389ca9356fedac8b13da276a08634d7515115227c5399f72e6d31cdb6f5fef1af8f402acd84fc703e996e3897f1a7e0a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3b90feb9ee7ca9f317ebee63408acc

SHA1
6e970e486b48aa07e4731d8c5cdfb7742c2283b9

SHA256
8a73fa330fbc48d967969876867f4dbfe87b963c0934d60e6ab64fe1ee7bf699

SHA512
2b47b3425465411793f6a321cebf50170541983ef7cf836f8b027a5d74668b22601b3a070f5117262fa8c0f2d58374e827b650cc7a529ba37708d3fca6704748

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab196C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar196D.tmp

Filesize
100KB

MD5
b9a27340c5add4cc0ed6fe85c75ccb99

SHA1
31af313f2316a0150bf3ad4c76abcddfba330315

SHA256
bb1bda3e899377a6abf26059f3c6f3d31863f800c61a75292b1f9e98fa187289

SHA512
964c5cd1673e0eeb8c7c3f0f5b6f6d1ab29da2a7a264c5090bc092709cadade4e2ec0764d31ec75fda392689571e4fd432f0c1fb32b18455182f2a8e03e97f62

Download Submit