e00fab2f9a359829992f808de124d545cebafba72aeeecf05e3d0d7273753079

Analysis

max time kernel
1s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60b7cbd1802df766fe8c3f13c04b7489.html
Size

21KB
MD5

60b7cbd1802df766fe8c3f13c04b7489
SHA1

5c022219111a4fea7d05093567e1ae74dc1040e7
SHA256

e00fab2f9a359829992f808de124d545cebafba72aeeecf05e3d0d7273753079
SHA512

af8117f13c69ac1ad684c3f1b0f41673c7a85278ca359acf9472a81adcc46a14945213266bd528486f08f80f689b4968660b887983e03d1ee8ba8c1513757170
SSDEEP

384:Ou6gKfo0lBHsdgpQ9SK9IbK+jaITHRb9wibxxLEajkwEwyTTYwxRsxCTUnO/MeAr:UlzpQ9R16b9wibjLEajkHvTTYSRsxCTo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{125621E1-A4C4-11EE-8D93-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1204	1244	iexplore.exe	16
PID 1244 wrote to memory of 1204	1244	iexplore.exe	16
PID 1244 wrote to memory of 1204	1244	iexplore.exe	16
PID 1244 wrote to memory of 1204	1244	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60b7cbd1802df766fe8c3f13c04b7489.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dc7572717927e1a29c894fa09367ab5

SHA1
c6ae41e0fcaa1c82ec5950497accd14c0425a628

SHA256
ee497097f7eabeeb044a50a1aa95da8bab8d70dc2414e3d28128e05bfa961f59

SHA512
6492bb34f1aecf7216b0db8183673ad05b391225df672e235cd719d0daa171fd3d543fc67c707317d1acb030f50e69bb7cd8f31455bdd17b4a5024d48eb7de31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4018b3c7b1b62febe6c01a789f1130f4

SHA1
d05c19362dca209ea9b6beb1d017028e38529239

SHA256
4f60bf0a9259b5afc61ea0bd9e53cde1309fec8e7aa107bc14f4aeeffc2eec84

SHA512
e1761226f9a7894511341c03315c36f0ed85b7ffbcc03572791b9ea5bfff0159e122a1d8ec7c7c553dba8858975a7da9726721bd6b05a5c443e5ae0723f84f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2615fd38aba13cfeb370a10798e2f82c

SHA1
ac56a0eccdfb4e9e606dfbf6fc377635228edf92

SHA256
e3a67104c06c200479d928ab6ce080faa56970303f25a00ca5d63262159b05d6

SHA512
50019ca945c2b4cac72f51e3097b8411f81a75d5c019847b74248be44ac0b904bc96eea274a7821da118af11bf560b41520c48633421910eddb4c40010cfc984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
371463928b5002a6bfaf9264821d0870

SHA1
a99deaf6f23f44f640dd719ab97feec2bb7c8bbe

SHA256
2ae35a0b739e11a5a8eebb4e119de21e08412ceabfb76eebcd05120b8d91f365

SHA512
b5426dd0235c7c33c9b0600679b9e626ed5458767a354a3b1a173baaa13f6b917286452f344111dc7a4588da4e9c3dff8e29551e5e41de27560a0c7f766d78eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00aa8ced900e83cc14d0c508056e032e

SHA1
a4b7ab3199057a1cd211baea20ac5e4115d4b5ca

SHA256
32b4939edacb3d67feefac6c5d8c99a6007cea0ad6517624f7873017b7131595

SHA512
222a36e870cb259594d4cbf625b52e162ea82a0910f72b6682928c9d721e538b890bbc0c21d80c73710a9d469a1bddb450b20286c65da77592d042d82279949b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbf973bc9c588505bd861a06b72e8672

SHA1
e757e1c70110627cbd31c3bf5445eeee80e950e6

SHA256
3226fc3be0752d85b5993612fe46b1c8fcb1fbbe969d5be785f3a8b5b7a3d81b

SHA512
8d42f9a20aa126932e96f8edf28522858206d81879bd24169af54b71527afb298ebcced47995e3396efd4d13b31d441fb8a99e902bc3289fe8b080d159a5d6a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a345cb5df00f0e123611952c794ee65f

SHA1
d7afa79d3b67aafd509d16b9cbf657a2efff54b9

SHA256
24fd3bb0d945b34fba9e9102ddbe094b3f833c73512fc26e72f41eeae16d8cb3

SHA512
1e7c458cd17362052451f9671133fb25203eaaa1f424e2fa6783c921b6141d2597648d264be5488c1e6dba292771da2ba9310d7745935bf4d1cd86a8144c2a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6de432274af0b8d5c94186bdf637f056

SHA1
b486a782e8dbc91b6d0475d3c5f5a19275fb62e0

SHA256
ed5b996ab9ce7aaa86ac25a9e927c3e6af6ae87182773db57e01b01afb107d07

SHA512
961f9b0ead26a4f6dec830d4859651523590d224ccfc8ef0d6d8f165cf27a6ff3c1e23710f275c751db37f5ae9d0c01dfd6d32c13ee6d2e0c7b9cbc1caa53f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DLVVAHHO\www.google[1].xml

Filesize
91B

MD5
3b224b0e7992192c723f07996a421508

SHA1
02f1814516ccce2353796a772bc0c15418020785

SHA256
62cfd684bd92d84c860defada8b02e432953a2bdebac535ce337b020abb2441b

SHA512
677c2665d72e75c1a6aefb94b0e191f161f504928d0f3620813ae1a2584f02a5b2edf4acdc3133d7e5fd9bc1fe8064f4caa42d10f6f450b6801d2641377a2967

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit